Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
ad7e500fca82c86038ec30dcdfb18b08_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ad7e500fca82c86038ec30dcdfb18b08_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
ad7e500fca82c86038ec30dcdfb18b08_JaffaCakes118.html
-
Size
6KB
-
MD5
ad7e500fca82c86038ec30dcdfb18b08
-
SHA1
b09b24e1088904d882994b3ff51a606a14d04c4d
-
SHA256
12aa69b0d4be7abae1a57bdced0eb197b46bb46a774d41164c93936b7f22ac06
-
SHA512
8834d9981b0c25b6219cf802247ef21fe360be2ae9098c3d1ae6c2eb54393d1b0633b52b5ba6271c22237923395b46453b13752e9410b07152b6f7c171b30aa8
-
SSDEEP
192:7QfyHp3k3ZxQeqA4PuNYLwMaOxLw9Hp3k3ZxY:7/HUZIPu+ZwHUZS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0207A01-2AEF-11EF-A13C-DEB4B2C1951C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424601282" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000003d5d01e987bedf355abc0c07f3a57151497008cc4366bff335f56937c786d557000000000e80000000020000200000007e2c8ed6251981d403f478c4cf47a93c7d753c9820c65c9ea550d2adeb8fcc36900000004cd548066d9211a5da6eb71f2f096ba5b92fe8f0a437932b580050bc68a63148584460ad6356acde6c1b3216e6240dd385f54a52fd6983e4a5edd9b5c520bb7719723528dd946669070f99542d3609c31289f9b143a57c35d960389705b55943adba9b2635a1fd8582691839634cc0d7ad8a3f1ed6f72fdec1e677b8e95498a91a8967c631662c531e9b21585e8b85ee40000000827e871375230677cc273f44065be248891baf9267ce8728bf7d20ed1cec3b8f078d0cfd6f7a6e0910a90ad01dc29f0ea92c397c6aff3b4d172c8ac74116d757 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c9a774fcbeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000008031c1791eacfecf9312372b2535bdd06ee4e1f232ca14dc9b57da8130a936de000000000e8000000002000020000000eb01bc6d38f880cf7b3c9c61af7a8491e6272d96957e9bdff6dd23948b000a8520000000978268b3838c2f9d898908214b01921f24fbe9a6bf36d76179e969870d5dfcf440000000860057be17bba861d9a2a0ac6d45c18b5103c11a66d61944069fd5e57bf710399e1348b4e158e5cf8d706ea9f169066655edd12143539fdea4715cc55cce9142 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2844 iexplore.exe 2844 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2988 2844 iexplore.exe 28 PID 2844 wrote to memory of 2988 2844 iexplore.exe 28 PID 2844 wrote to memory of 2988 2844 iexplore.exe 28 PID 2844 wrote to memory of 2988 2844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad7e500fca82c86038ec30dcdfb18b08_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e80e8a568f06a2a4735f946a371d0c6c
SHA157ac16d58594cd88698f48f0793e49c389999f1d
SHA256ffaa2ddf625a88253e80ddc44bae16ab7e82630065b77df2813a320986712ba0
SHA512605ce62267427df228b22a83d86a638f513e27919a6a83f8c285ca4bbf4986922ba7eb4b557e3ee44381a87a31f067f3d1762a5100fa0c5d111c1cf0fbd7539b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533ebe3152cd3e06b47d0cb465fd0d43f
SHA11d0e1fe1db192bfeff8b43adbdb3aedc6787bdda
SHA256162ca858b8ef920c3242e58ed417700d445d492aae7919ccc2589809cf3168a2
SHA512f7765bc986d9edaae91cf008aa3ba5ef8c4a879990c138d5c0bbb994cd2f4f351aa50274e71651b63b8963ecd9c4540644490d177b3a0d443bc05522f920037c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523ffb533068a82850a5ba4dd0a3cdd94
SHA184e315d5bfed000b505debb369186d6b04c7ccab
SHA25606cbc0e9936cf8f26b5505b91bbdc97b4de4552540902a32eb4cc3046c1c322e
SHA512d755ce1c0bfe7f1ec5e6400e7245db8e3755e6e7b5f8e29b162278395b13b2bbc5af372d9c230cb0a84653f178be60da19045016dd6a64ca6abc5d48571f31f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b4d406042ae96056a26165f01ceaf89
SHA14a62e6f6b4a5cb3b8729c2c8e23e73b40d961844
SHA256a9b8693dd5942579b48ab57ac820876efabc5bb152903e2dc2db97e11d58f0e8
SHA512734610f3c5c37de36f6f8ad45e5fb2fe93913b7ba9eaf370d9155cd51e50966f408f7886ddbcfd4a85739ec8756b79e369e99ae35c8015738b7242c1e4979db0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f1006160a81e9916bf1a987afc07975
SHA110204de5fe3ada060074396dbec78285d418d24b
SHA256de093c65f1a472c32a064c6fde7fd13ac789827a4ac6e28003f6fdc05d67b4cb
SHA51257e62262a79be0b3c1d8421dc17915fdad982195c625d13915eff36889614184657e1cee7f34fbf56a848a6603a00ef154f751778598ee1bcf715ae099c43fd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dd87bc04ffbe0b3bd06a75d25bf18c3
SHA193dd3dc4e76e590530cf47c5ab127c49ba51a001
SHA2564efa4aeb03b56a4eec3e64a07243be9adaee4ca5279e59a3e2c0ff980d8433b2
SHA51284294129d8a71e30f8cdb3ccbe30935624083456c1018db307b8a058075cbd41245e679a2222c2bf00efb9a20a4d015455455823051304a1197b8ed65148a73e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f17e91bb2dda857dd92272fe3900ec50
SHA16d8afd2aef2fc91d2eed58e8753963c03a4712d9
SHA256d0254cab83e37f552b48420c699e479edcf4381513de5a8f5c650fa5d12c7467
SHA5121f38be824328b7d4db2d4294d5143248b393957c616984bf652e8cf8ae3a628cbd7b3277010f822068e809a45185d329bb1d96ecab889aa558c76ee629eb9d3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591cb1d16efbda9b985b7df1d80450a2d
SHA1c0e770275bf3694785ec0b82c015864712d69b03
SHA2565c8f12646d248ebc4fbbfefeabfe29e4b736b69a07f1ba362d3a6193ed32f96d
SHA512967257fe71111e3816552027bdff85c245181d4c1c8d2823fcbcfb295bff5dd8cfe9a510c15e8ebc8856c6574dbc56346d87bf9329a1d6acd07aea2d17a5db3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fa56c1b4f0468b0a5c4361fcf12099e
SHA178d6f9685397701d47b1faa6bf1cf1d45175e8a5
SHA2567b32329c2ad9989d886535f5e8cae1aff5090220571969b62288d4679ce5f769
SHA512e5d18f202dce64a46f355f7f8a631ceed0e4c948f7071d46cda5e1207d5b1e9131f292c02f459a327e2594bc394a940cc0b5ef2c053ebebd50783887938236bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb3f129b726e0f8c9a99f80fc6cbc43e
SHA19b5dbf2faf9094636ef532e9285893bee4fd11da
SHA256c41133cacec4a813ecafa51e808f0fe10e7a331380dc5c9ce6f97df78642cf1c
SHA512f031fed0dd412666fc76b556d892da213de26ced00d7551cb488ddb2a68c739201c7f61bf8ed091da1307edd3b6352cf05ec5d35bebee00ae7e5094f78b212ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5562c3b9ee89b96cf3328f8441f37bd93
SHA1a99241da044751da4e6fcbadeb89c3005f0c3a05
SHA2566f2ca65338b6343671dfe59433386f364ff625b04fddf84aa094b8e45032edf2
SHA512a78d069c5b7d70d229b1999a1c8d3e94ba3b0e2fec4f7a287d653dc0f7f9d869612ab9c1b2c09688f5fdacdca53863896e19230ab150a774fab97c247e64b2c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d49678af9f9b7251be2e102df37df83
SHA123de5ebb8f0bc4c8d1df13917297fad44477e133
SHA256fcf42580a7f4bb998d3eb57c7a923a182f6052105e3116186931a883a5c4800a
SHA512dc181d08d312d6f3a11ae8d1398f5c83a4b8a3b6913e92d436a40891f1cc612e9522bf51b128fe7b976a6fcf0b837703819fef132baf8f461865cd463e6fe4f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f8cf0c2fac65528c9095cd3acc11024
SHA1b08dca16d68bed7d942cb515fdf7251fd9df3249
SHA256ea77b129b45d03e7e36c5d458e13062edf514e256f1f03939513f3c2cb23a942
SHA512f57788c110f6dab1cccebd59af9532ae8c68c337348943dc47d87c38715cf11032326c3a48ec9d68bdd8cb0b33d9f008024ce0e476081183abae30ecea9b8575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b439e2ed536ef2e50915c5c9a0b1087
SHA16dfeef4d19a31d508b0776149b727147d7b8895b
SHA256cbe9ee688a1798fca210d83d6431e577016d1a55f85c27a76f29519ed350c5ad
SHA512484083afe4dee6d2395f8c965567b2685277d25d8255c15aca971b4d81b44ba1c058371ba845f270a4895ecf7c420dd67fcd8967a36b9cab341a452b738309b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feec8b053017be6942dbbe7b35ad4249
SHA1509c546d8511ef14f53c40e2ff4e9dea5e687ffb
SHA2561ec3b2fd09a9e355adb9bff223784d7f889b0a6f725bd8ded0b927dfc4ec586e
SHA512a762fe279313725e247823e1bdb703a854da075195ac22f50823230b0dfed812e39674983f42f965ac899961a68fdc7856343c9ac01e906ddab11a6fab52f553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5893c5f72c07b71bde282c1da4735a439
SHA175aa1fb8fb2a51bf33c95d1508b73423db564dcf
SHA25678d9b956d1c835be3bdc486ae9b1148cda4d95ff3b6bcf6a0f6fff8186c53def
SHA51299dcd5fa9eb0f3da18ff843f7bdc8cde1db58db1cd03608f3242fce5f5f8737006e924f9946f7a0f8274f7ddfa4e3ff2c15ece58163fd43cd1c038d702787138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a8d26b9c5591b438412ae5d01799d70
SHA1891d70e4bb2edd516759eae6e3cacbe17ae46267
SHA256391e8fe941c1da7edaf57c062031496eb0b479e2a6488e0abbaa0a609698ea55
SHA5124b786738895fe9c78f879612e904535d3e4d777478cf46cedf149e965f78d8c2be5ed2fc069bfb8740eec03691aa13578b85ea1a2965cb09f0196fc427bc290e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d4c70dfe733dbabae9dd1565d478b9b
SHA1739771e27a927d960af0b67dee59f676a2ab1b1c
SHA2561202f9c1b55a10183da1e90db9e68595a4f2e3d918201c8f8f5ddff16861e8b3
SHA512d153be15d13ba448773d558cd9e3b6d5ca084e12a67c7a5bafec8bc1089005043ee87e5ee539fb09f981c6457a651c8dcf966d29d97080c3f6aac0877197e330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516da85fd008f34b05e4751ca4695835c
SHA1cf831e691302d832b13673625bb08742059e915c
SHA25690f58dbd357fd976af3cc23ba413ab424d54ae6c2320fb6f93277525f7daccda
SHA512985cf664918d5a9d4a0ae6261f644ebb70ae998c325ebb971cc8775d64d7458de4024e160ddc641b9a090652b2c2717d71894a46b46b941a9d3f2d2b87e8af88
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b