Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
ae1e704d6c348408d7b22bd8b9354747_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ae1e704d6c348408d7b22bd8b9354747_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ae1e704d6c348408d7b22bd8b9354747_JaffaCakes118.html
-
Size
3KB
-
MD5
ae1e704d6c348408d7b22bd8b9354747
-
SHA1
fc059f8880f52b1751c72e24065ac187234966f7
-
SHA256
a4a56b86c914ab74634c93f8edcc9b757f1c26be0bdc7857aa1f686fe2f6dfa6
-
SHA512
7fbca0de9113a68c9442c9f5ebdf191effdb6a1d9b0c246b00d03bf1096de5e5521f42a3f16bbcff7adff0e8fff1cabf74bef79d1525a55a079e31c504277c9a
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000659aade792240df553ab5fe50f8c67dd8c0f2d64638263684c3f67e3934f8d51000000000e8000000002000020000000c5894d2a3d6816ad2d3794860b30f6442110bde471b9034ed8f9e66fc9713b3b90000000f411aebcd1b148d2ede5bdd65fd46be40c6cf28931f57dbb078881194e587ebc3b1e8727c5af5182af30c00e19280b13332c3886be9268b2f2da90f65edfc6e3655dea762ceae7f052663a0643c12bf723c7055888af1498d2719195766269f05e07a52ba4fe182ba482bc52260e3353ebcb906e18934dcf54bf486a35867c9efb80826d4d4bb65109edc24fa04a86d240000000eeaf53b250cc0df3be17a33e80dccafc770fa252c1964bce6c361dd84850eb2af756effac3d83cecac5e0df37cc637cbbd14dd352caa4eb88ba3ef1d7709eaf3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0215411-2B06-11EF-8F67-D62A3499FE36} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c3f4845b6f1689c4ad1d6255f25b8d459ee83fbad4fff981c3e31e1a77f58953000000000e8000000002000020000000bcd5f6ab9aac38eb81b8c3f261a0f6b963ade600d8d9b80eb9acfe3a3f5e26852000000091c0577b77924b61e5923ada5c4c29b70faefb9afc56f1409ce725269d240af74000000026753076ee38cdb9b1e8011d17aa14eb1bdae51982310862df6b3d30b2f5ca46c14cddbfead7de0e272ae67b606ffe5a5f0486603d970acf11fca33cd8a4aead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07ecca413bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424611241" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2832 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2832 iexplore.exe 2832 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2832 wrote to memory of 2612 2832 iexplore.exe 28 PID 2832 wrote to memory of 2612 2832 iexplore.exe 28 PID 2832 wrote to memory of 2612 2832 iexplore.exe 28 PID 2832 wrote to memory of 2612 2832 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ae1e704d6c348408d7b22bd8b9354747_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acab66d9db10aa5fd8bfefa23355b40d
SHA197d4aaa739db4a3f9ef18547de9f5593150cd0ad
SHA2568be535eccaecfacc4743ecc5f09b2afd42bf130be32ab9f7e2670c884435b608
SHA512cbfa190fe7372a74ec1ad1133b3b9052cac990ef96899ef1b733b95ae0e9e1cc2dc9b001355b88da438d5b970910d56b3f58a2bbcd74d895a7a23dd3f33c7705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5016f3ba3c340f19004ac5d77dcd62b45
SHA198f2dbe7759e9f3c6ee5f08c4f19395f11b7b4fd
SHA256ddcfeefaea0252b8fdd013cbcc52e4f98db75e4aa95c9a91e873a315e5ee14aa
SHA512e1c7c36c44ad9beb4edd245d14e18b6618079939b27fc67630d8426db8193e5699da91aefca61ec22cf668217a68d69fdfcbf9fee5fa625d3094f57fda055729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b180668d1bbd8966fb3df0fe8c75ada6
SHA12fdd63b118ea9a9634d45f913d063ac1ce76a32e
SHA25699d3f19e3dadd67825bbb9993fa76b61374cb6442666825595117820fc4f696a
SHA512b5a9b3feb9fb070cd77d5b8bee05803662a4233c58c26927d4794ee91e2ad5bac32ff965fe3c03fb91e0c3244a5d918833fe08d654528a53f7c099b0e6360e65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51776bc1beb0d236e074380a700e11db5
SHA17861f387cef49d7449db23634f79b09eed12ccae
SHA256a0dd63dce6863a0d011c37eef915f3a04e8692b511469c2e88161cf14212e96e
SHA5120ecc2131afc6f44361c30602e6bd42a3b6cb03eaf40b1a24414bb4b74354534464deb26aaf7fc80b2449b5dfe22e02753719777762fa46d4bb274f78700719e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ab24cd772ad5f9fab3c64f58f7bad8a
SHA17cd402f0cbbaaecdf5c436513690b484d7cf85a7
SHA2561366e411dde88ef0852c4e13f793073d93dd8da9a06a02fa9d06b1753682f627
SHA512c488441d855cac27847eea01c19f35edbe30c24680a56d229c86507d51a4b05c396169994b5dacf276a98f28494edc35d382f2ea36e12b7ee3a0d3d6f455630f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5733503342609536f1ccecd54df9a17ad
SHA1b99e6ea9448f41472cb58ef3a6c5714445d6c71b
SHA256efe1a8c0fbef77d0a4633a036f26bfa7e04b33765299246202ca59a529199ecf
SHA51278cf02dc2d4dd5c133cbcb9e0f5e0a705f815d3d271f085a7aa9bc52f9e63d7941bcd98726db3dd26ff18f30ad6c6ebde92b6659fef94e493ef6c9d961e8f75d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6dc88bcee129c10569cddaf6cc79e41
SHA1445caed8ca2ef150d5fe0d38e5a8ca763cb80c53
SHA256df4c2a7bcb1296565cde0dc9b37d1370074983ab3b276db4ec412ee41fd96435
SHA512d774a124a1e0a3280e39ec7da3fb49f4df9a8faee9137a896ca3c95a8a13bded6511443acc3f045eb2aa7ad5bb769c93eef1fc1246003e58cf172583b2b3fe4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582d5c877d004a78aff3e8f7215251fcb
SHA1af77c9389d0fefb3865fd8b425b5d2321f20300c
SHA25632ab048e95024e4eb9fe6406b3b0f7e1a838d642b4b75d0a583a815e20fa096b
SHA512faa3db9e08b9db77c41d8b700e85698ee6cbf7cb8f756ec9cb989fff1dfd5f53e2bcda162d06c81ca23fb1d315c3c98188e24cdd44037697c3812757b3bb5e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f0996f8a9f28bc5cf40a76daa337a59
SHA1af8d883083f21283cbbea7d2efe41f41a2375742
SHA256e998379f605487685c40d989a342b872c33331eeae4321b2fd8c4fad82ff53c4
SHA512277e493b6932efe8cb77524be1f31daaa11151a045849d05b0a624fb62a11e6a2262389882f5568ecaffd56205cf39a7391203a4b140efc8f905129615defd3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5463ada8c42036618b10792f9973b25ec
SHA11efa97cd4503b0a03802a4e18e34b5b13e100e6e
SHA25681153fc3930b02cc6eb09782c8b08cca78e3779829aee8f552920945f8a3f5c2
SHA5122b7bd580b604bc2cf3c03b9b3914fb478fe88df36856243cb1578b1e71f186822125cdce7063bb773f0e5bc320130a6d5ec40a28f4a1e3575d39c9457858d85b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f3d7ae32f734d623c695cda7b38bdf7
SHA1e2161f75b8a952dae724b4a60d1b68672ef725f0
SHA2563b5431b66d62138b6bf4d8302add7cad785ba1c09dcb17d81ea61dd5532fc032
SHA5126ff1914091ff2b9ec1ce24d0fb1acabc16618e7d9cad784668a5d651dfbf518a5fba641debfad2212f870ee21f1d92021f2d323c6aadbf10d3fbedd7697d133e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552e804493a3ae395faa90815d83d04d6
SHA1365cd4539e8a6d3a99f6cf362331ce9e2e04e137
SHA25639e44673b594e00efcb5b60514b8dabc9d9ef82754c5d812da10d46b357d66b7
SHA512acb9a5628d160a490d9d6def8230f29db3248e14b5deff0ba7ad3c26443069594efd45e4677f4c617d3c19c2e18d05da63f2a9ee6f581a792525edbe5706b7fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dd5fee48c69cfce705718b0f0962a46
SHA1c89a7cc3a51f85b7423c7a4715a6fab655998702
SHA256de7bed5a45e51a5a4d2662514e7c2f81dc7af50659e1d058ddf25848b0ec1a02
SHA512aac05d8b8e604474c2917cea8eae2ef198311ed54d928c83b759ba5a5365d08c6fe24562bae6a16df71228dd4609ba5e6b3b68f6191d7e5d7e62e8b8b62b4f08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3693601b8ad161ded52e47bfd8871aa
SHA122c3cf13c2749d93825a76b99f57e7e4362be3a2
SHA2566127910dc7ee19b5672ec90f86d21dd0c2e1dee5f49fe3ae6d94b5cb92b2a780
SHA512548c95feba45370410c1fb9171802f6fc66c4cfde550704bd32b08a39590904a58b975ba339641d58ee8706ec28ec8e6e34ca9eb3d0b27edeb9b48780da2f596
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f450966247a4e8936b74c486d83f4cce
SHA181bd5300059ca628840c6bfd70ea4a8f208a4cde
SHA25603302a9286177ade9f50b0a2aebca1ac1ddebac8082d4a6ad17e72e528a7b9f2
SHA512d77ebc66efee15fc1c68b65b619485ec2da59c9ae40007bf8fc77ddc305dc88d94853c03f392cc7be3891a87cb4e39ae790593267e596ae9c786005cb6b00fd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4a7e5cddb263f7b1b1e35e60fed783e
SHA19dcc9d3a4c216c7d7a5b87321fd64a40d5484c1f
SHA256160bb8737ee68f5f5de065cec600692a0b382774ec8ef85c7b29bc857924bf0b
SHA5124ce0f5973d51d1133f235f2ded0641f956479389032d250cd17d5624b7a9107c9d2041a709eae290644692b093222129067176cb3b8d8eca7a6bdb50ea455b25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5785adf6be1c387b3dbac8ae5cb3c38d3
SHA1904e8d32bf76d36b6af18fe5e4b818a8175b9394
SHA256da26e0a0dbb6a66c14067c917a19f9cbc0477b8b34c3adae18ad46a3c41e48e6
SHA512d2599a679e907f52698791f5a5619dff941d832378e86ad1a4053f5e440bfd2e35e61d2c6e0cfa1d1d8aa077cc0de1c05883dc42619cfa683ddd299ccff3442e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d004d5e22904f38b2d3937a2a8837da4
SHA1c7e9232ab07e38d914c3a0d8c5ac9f3e1e77df53
SHA2561fd6c9e6d6970d68c3dc72164ad44248b852ab8976cf7738935e4e220e999dd5
SHA512feb3d6c377c54db99b15fdf6f486874ad968cfe35c549ad71767eaa458e21f5da045a24d9ce2419beba8b4bed91b95185a579da882bc675ddd0f1480d4e400ab
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b