Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
acb3782c213c9ae59f7bcd0a66266c3b_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
acb3782c213c9ae59f7bcd0a66266c3b_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
acb3782c213c9ae59f7bcd0a66266c3b_JaffaCakes118.html
-
Size
6KB
-
MD5
acb3782c213c9ae59f7bcd0a66266c3b
-
SHA1
62f9af9ecd11c3b1336069a275074bff20bbf68e
-
SHA256
c9556d0c887d0ec641db4bd918f62b2b5d2d96ceeaa0c4203f28229cec2b7276
-
SHA512
7dcb24c8c65a1d299a5fa71218e715f46e18723d29d87f671a89f55abf671c207742a21a02ba58207cefe26ff44a7b67c601b9121fb3795d643b8b81de2a83e0
-
SSDEEP
192:IhUPTNPa2EfcwjbhlhJALVWlF2jIUdT/W3K:EUPY2E7vrKU+dJO3K
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000003b9d212a7a3b76563529f4e941e886dbf0983fc7ebbe5a9463d30a427d3d0ab000000000e80000000020000200000000c5e5857e4dfcfdd31aec0b1977eaaee7e0b46709165f71d2b54d99145920454200000002542d0fb8387ee4cf9680f306db67bd89146b3bfae737ad53d9c4fdb1261e19a4000000094c8339e5bde72efaa25fab4ed076c9cc65827eb589e336cb00c67e85103345c9289eecd8f25a12381417ae09c88bd61145a6729534306ae549a930c0965c99f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424582883" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d8f99dd1beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005cecc70a1dda4f0dfc4aecddb2aab84eb6f95b71565b5bf21f05388b62e8613e000000000e8000000002000020000000629760a2f90671e484813012735002fb379790514f7c2004db46922a0b28217e900000008e5e9f104039056a7f45601f90899c6a7fe0582df653ee9139965d272a101e4c6f2e6c5164f600edfae54848d8bb498c506216eda7bb955b52dab065f6241647007437863462fa897eb2611149d68ce6c3afa087901f234866630ca0ee06ad507e2e78dba1662d3f9cd6900adfdcbcda67edc2b1f0b8247f81ec61065ba2bf5f69c3113d79b4320b3251005a43da3bd44000000056e49630b94626d88381b4867d47cde0144347aab47d97b74e7277cc1244110a3f891c32f1cff865d318d8a9125933e5a1a662f8d8958340e0ec8fb1f5ed9d17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C80656F1-2AC4-11EF-9E55-E6415F422194} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 3004 2184 iexplore.exe 28 PID 2184 wrote to memory of 3004 2184 iexplore.exe 28 PID 2184 wrote to memory of 3004 2184 iexplore.exe 28 PID 2184 wrote to memory of 3004 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acb3782c213c9ae59f7bcd0a66266c3b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deec1cb52ca2c49f4568a4573c6e290e
SHA1317505bbdda8b8ed89839e7e974c1bee41ce64e3
SHA256a8f03f73e73699f5a7becb523dd1c1de9f0711e34b2334acd074488269c892ec
SHA512c65a8a88a6b62b8accb6f0734f6d11632f094b06406ddad700ad5ca6f8e41a5d465b2a86541771b49cdb6bcd82e52eb49fc08cc41a591b7507bcad91018ef8d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5a827a5bdaf87fc3e445e0ed05366e1
SHA165583c88c4f58bab27bc001c4eacfcf7966ceb09
SHA256ab2ce60ec3b4bfde620cc399e78196e60f73a4059f65942f034c30c20f3810f1
SHA512e450134fa19d6069dfc1c1502adea6dc8fcc281635551bac0ead3b59df51bede2a14b15e2e565aab51da0bea43c56643c97cfadbed4e25ffb39c482125ff0b4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afa58ed488adb39546bd02e11d9beb89
SHA197ca2327fb117c9a9b07768229c6be88b595b942
SHA2560670b2e21e4672b346fa7d76ce9b562b77a7588a778ce490b1329c2cd291a547
SHA51288d43d2e0e907b0b29326d1b7424bb44d2d7b05423922346faffe7ff277a870602847940572485289c3d7609e7e3beb9cb6e7a10abd7188cdbe82269055b7da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59270d4fe647370a6271207b6fe6f1499
SHA1f6ad1f04aa4e1ef495556a4a4e7fecca3558dcf4
SHA256d7d8bab3d6a26a38f1fce131afff0082fa2221a1e2f81ab7fcce85fef4e559ca
SHA5123ec79bd07fbacdfa432aae861ea77337fdfa919593b5bd54ce614fe940cc44a256ba294d70ebf6f0ff524ecab91dcbb56876651bb702161243f013e9b2e5d18d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507e3063269e4837b2691893adba8c2cf
SHA140503c790b26032e26f72a6f1165ca8355700b27
SHA256b6b608d803fa43b01b86e53d3776bfbb049f2fbb9d2f38db22caed76763e4105
SHA51208a2fdcecff1f044883d48d57aaaedca59a3f57a4021d4847e8a286122c419ad183a2a6c40cb8cfaf97bfd3a0ff66d4c2f0a6ad67d19fbd7ff105ed6ecbce9d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f630235c9613307715e76bdb5e07cfd1
SHA1b07815648b51dcc94d33d7e693cd4a01c264cf46
SHA256beb992481f1e000b1cfb8606c368dd6a75ad7e2c438f67a7d9b89f7374fa16f9
SHA512334553b417087962178e7e2c1f4d1f3bc996d8d9f621410044e2b0dc729da387bb9b35f84a2f970730d9929db6fb2acd66c5f492bd2fb626859c675fc9ea2ec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a05a7977f2ba7b7e3eabf58adb0a513
SHA12880439f4a3c6ddda62f8d620ad3163d1a2e63a4
SHA256ef2bf405c64497f4b2bcd44789d0aceee26fed4c43c0a2b8d9c99fae326987a6
SHA512c0a9a74193903c7aa4c607370db5ed6cd3d2dcaa4bef2dbcc6cb513f501e6ebe8795ad590c39454ba27b99197050ee54402810883ed50d7b4d9a17612b00962b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c18d9d24329a9d6e130f0f6922f30789
SHA1bb1fa0f8e87f4dc8b2ec9d63a2384134c28f28b7
SHA256666e999d6edffc32b2b4dff813b7ea84873b6ea077f83c435f578b5ec26a61bd
SHA512fe65f6cc913717d3950565ec58ec4625705db2454b25175b7827d238eea14bbde33a764bfaf8f6f7cd201207011b7dbe683601f3c68cbeb5f3e375f3708be1d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e885ea424f6926f67f3cbdb23089768
SHA1a1649c25f96e60e0e148fa756169378546242441
SHA2566b2cf3f61695666f5770d5c9747122246df9bfb816efcd52b08cfbbe7d50f11d
SHA512c8493c61bc8960aa8b72e491309c1d7a124591241dacfdc6a8b19f4a206be33edfaea9adc6c20cadbc4ff61e082d72cf262d5afe2c665ebcade2b7f801893502
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53478a5750a61eeb58fa3ab956cd79d77
SHA15f7bc4988585c3b17968902b3d1255eb908c5f1f
SHA25642ac1f5000356663a4a32c681bc375d7e4cdd22451632fdd5578d30ba21235fb
SHA51243f14058d473300eb142681fac5192e07cbb9e7bd6db01f355112fb12e95ff59e067b2b99da0dbe4518012b70b62fb8a256cab91d277a5ed655053fe93f8c6b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57442431a1ccfbb6647fe0f76fb7a3322
SHA1806562a3d9245ade63741f74b019fa357dc1fb0b
SHA2562b64d4f1d942b6b9007996397a32df0c0ec5e3124347d362e04cb65b52327a0e
SHA51251b03bb7f223934f564cce075311330c194647a5b259c3402e65763502a09dd958020b40156274f633d46315d828ce930d68389c7397c92100546ca4e4dd12e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ba144f456f92ef6c9e53ae8ecc711f9
SHA14eb5afc870d2ad1a2d2ae07be2d2f74e319deee1
SHA25686be61ee0601890d2cedd81872b8131c770f0b1039612ea96c92cde661c4096a
SHA51288fbe6cb0545f396e3c22853f2987d42eb3353dfae64b9e20e1ab3532db0999ca2c88f8c8a10291b47fbcb618e20dc4f56eeb3fa8873a4a60478bf5cc647e97a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55be1dc39ba7d1a9d650243dc4c9f0fc7
SHA19b9b7f4e1985e32f4326e8d6a6c79a9d602e3b50
SHA25660096613dfe85bf0b137178f8fec94431794807fd5eaf5487cbe6850810ec9af
SHA512f12c53e83f451f3202a34da4ea6a695be57be66c9213607267616b74ebefc321205c675cc72064b97495ab18738ccc4963796104ac8b02c9a1ed4a8434a7d8e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9f525f9d68496ef4596f4842c647bf5
SHA1a2d0c0fcae956d0e483d6ab11eaf91409d3da14c
SHA256d9da2b5049895407fd76428e6fb1def155f51fd324f17620a241655598c02e45
SHA5123f02fb27404d63d23b93d5a8c54f379f969857d62580d853b660d7e7699a5a481fc99ca9e690035d38cabecf790aa0957be0e1243fcc49a5543d70f5e8892064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b3132a5c9c26600fee70eacf6610672
SHA1b1d4820ea5e19ad99f5e3db2bccee86065bbed7a
SHA25675d31c9a2b18096789c01c22a0871c890eb82c2503d80942b92d313a03d73c34
SHA51252320989d1f2a68c3defc2762108dd0f06a3b1f974212cad7f13e0172ab648e6ca48d50278f14bf47878dd5c535615338f777654309ceac846954ca9d611e890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5249d97fc64ee011d5ad6cb23f94a7111
SHA178a0f96e1c26aac42a7c76a494b10da86c75a762
SHA256cfb59e8e38d43dfc657f7d7a7053e8efcf828e4ea0e131a064c001447c4ed8aa
SHA5128f943ec93609f7d79c2bafe5c68b3b2f05d19e5a88df93401fbdb6e14e561a17aae5c9fa25b72b0c4454da228ba4e086389fa0a370b365a9ce4f416954304130
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5255c5df82d4675b64e21f5d138513077
SHA1deb3b5f203cd69c8dbf2238652fda4a07be67d6a
SHA25679d8d1b577bd884ad9c7752e1d7352ebabc8b51efc679304a54c26d57ff189ec
SHA512bfc02ebff0f9a0399696a198d9abb3f3b839147063efcfb571e0d8870b9e6768741fa98af92ec337baf4d35c070881cdd89dbdd64dd30c0522fbfa8bd3d26c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a32f67e724345dfac1a49ee827646c1
SHA19634018d4852b116e5b9a718b233c71e8b6d027a
SHA2563e90d31671fa552dbda3e4c0a744e1d76d2fa290607aa6a7450ff995de369ab0
SHA5123edbdc93e150ea08f276ee684711a8025eba42f92ed97ce171a3edcbe11fbe770b12fa3ce1b0467d4ba8dbf286dac2dae558e49eca29d942f8d7364e2753022d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f03e5e54c1cfaed2d6cba36e4b6fbfaf
SHA1d17365cd2d8f24dcbc5b559d35a08212f02096cf
SHA2568a5af8823b549d4fca24267daa521b88fcc00cab3505beda5e57dc383d425929
SHA51257a6108b6eaaeab2fd25d6973f7d7e6c82737ca9c080f8117f6c970e3b3df67ab7859f5e0d049a4d2108a6097f68cd4489d05d1ffe26799a752e0ec4299175a7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b