Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 17:58
Static task
static1
Behavioral task
behavioral1
Sample
aface47db0af3048335c74c7c33cde8e_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aface47db0af3048335c74c7c33cde8e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
aface47db0af3048335c74c7c33cde8e_JaffaCakes118.html
-
Size
461KB
-
MD5
aface47db0af3048335c74c7c33cde8e
-
SHA1
4778d8c24e4bc2aec48ca7976a743e58e7cc176e
-
SHA256
277d9331b2593f7e2600f09b5221ef4f1ccdd022cb4e16f6289f689ff1ebb1a2
-
SHA512
651279df0eb45ca0ab3daa366780e0852a908d7eda33be4ecfc746fde26fa9fb26ccb2709dfcc72735857907ebac4bc5ee63c4d7daedee531a0bc4be04362906
-
SSDEEP
6144:SKsMYod+X3oI+YaEsMYod+X3oI+YhsMYod+X3oI+YLsMYod+X3oI+YQ:H5d+X3l5d+X3n5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF99D9F1-2B40-11EF-8156-CE03E2754020} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424636179" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000bcf0f556b95329313d17ad6d7297d70b0059a7e9c254278d978864bc605a686a000000000e80000000020000200000006e6bef44308492fbb7314b745742135bec3c2927648d7b236ae1c49948faa37390000000956a95c06d50456e0aeb54f00cdcfe35efce48141b20e104a88d7de8a0b141c03c6b8861e127c50eaa1a7123c895a25bac0dbf381d3212e0ab5085bc2686032c547e49879ad9e9fd0e24b6ee67626b5ee65d89882a1f53ac796d6058ed599d2359634f6fa672b1f45c363b711d612b85aa914fdf8e04399d9655282383f7add469322943a1dd808bb654280cdff9693040000000a869f20b0fdf86cbc83ff785cbd6bd03b2c7a05008eaef22542391188d15d8bdf10b7bcd74be614cccb8021977f4e7fd0ddef9801e80cded57f7fe8e8f0c4088 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000088dbb35f32dacdd981c9738f87ab01004688db6f3fbf2069f97a1a248f320a2e000000000e8000000002000020000000395fe401d9844256b4ec0cc2a2bac6c79a9c0af0008c8fd3657bcc9583975b23200000004843bce1cdd5b531ca6844be0007467131dd489b0bd0b66d29c25b4374034c7c40000000e04c61776c496e35c9559cb6378719e0b36407cb2027fe549eb50a557907c21dba5a273d2cd5c454acbb85328bb847ab7ae723f42e9dae0c332d9733996334cf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ff77b84dbfda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE 844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 844 2236 iexplore.exe 28 PID 2236 wrote to memory of 844 2236 iexplore.exe 28 PID 2236 wrote to memory of 844 2236 iexplore.exe 28 PID 2236 wrote to memory of 844 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aface47db0af3048335c74c7c33cde8e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b484b73ccf43f832ebe910953bba8760
SHA135917a5e0122a5a52e0822744fce6677c43327ab
SHA2568f565d3dd2eb5f6a6b679546a2edbf9c628a668c44874c7704c0857fd87899ed
SHA512954b6702b92c32c895e72d7de4ea239b5bdffb31cfede1ae11dc82970b936149876b5eb681f3123de57bd95dd5cbe2c1430e69a1b42d68bd73c27bfbcdba33b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a78165bb24e7b0be75966366b71a5e76
SHA172b3b19e87896c093ea485171a6657a01adfbbba
SHA2568fcc837a752f8987a4123d40526e68414f1f9834ebbee001ba82bc1fb141c9ef
SHA512a3b618c2c7ef9a785e48e102950fe32d4d82a8e271faa4aced0cfca392bb0c63610300bcd38990e85836676e4cc3bd347fb88a6bc0585c6d99ead4201a207ed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac9161327b0a173e308afc18c2db8032
SHA160377d17a4dc6239b3de18a548017170993e900e
SHA256d57beceef11c80f8ccb7f9dc74f9e13be0fb97ad348eec36c60029887b1967f4
SHA5124ec3958f08110c011dc75e08c4bf8cb7c97134c2030384aa5a6b351890f76b13bdda22322e2c4ac988fb1916d35b20ec43718689fc4e4068ee402ee4775c4692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8de9e1f00c864478e6824e416323976
SHA1e8b33e05c52552da1fef3dabddc330d6d9042115
SHA256d794a241ec54392bc2e9fe4ce2900be69c621188c5be2f926f5f7f5c719dd473
SHA512a363522b2157ac62cd1ecc3c79f40e02fc8d48cd5023afba6b9d337346114b5a6160e8486b590c945eb8be2dad9ccc3e27c26fb6c0107c181bcc6b001a6b5330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54766a8ac73097a2cf8ab92acce30f902
SHA16835330942b266c63658ac7136ae2ee50e2027f1
SHA25685c5a0a6642c2c447c7522333c5adc7ced4ea766c8b7e823ac4ba477445c6815
SHA512013bfe02a086bc777126a7a6919160ebc0a43af44f1d54c72daaca67db7c1dc2a3df733b62af31eca000f626011ec14f57072f4bec536b7885bfe724d71720b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506801a37a9889739b919ce90593a7d3e
SHA1b064e203d14874235c281d065e89920c0b8bd93c
SHA2568dc817075d8c3f207a2f6141cea0876aacadad219f59d3a55eb90bbb49d1ff17
SHA512d3e100bf974ab4187b79a96df812064809a75de2fe8c0ff5e5800b86dd6237596d1c0c31d0f79ad7b70e9940ffee169607651d6c8cc5873baa5427b0107c1e4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567eb8bf288c7c2d42a57e1f49acfc01
SHA1d3e1ba21ef84a2bccf0115a661e00744fd7604d0
SHA256a7a25143044eadd840e12508711464750e6ae8a5e032095a32d5ed2c8bf1d20c
SHA5123c07f603fc6d53467520d2cf32b465c97f096c65677e68ff8f837f9eb2146630fc430a3e241fa53e73066268c6214ed6a9d4bcb86ecb91cb42d3e63dbc6afc51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c76e92b6b985a1d8a61ea5d4a518a5cb
SHA1a82f07a2f60332506389bda93e5e9d30518f4bff
SHA25679373735905403b51ff2e4e1705526f2fdd2a909eab381a1d5712863eaf85026
SHA51222cfedabe1fd1ebd2479c257c8496e50294219b13f6cb9367c16dee11673efd5ea5d34db778f911fbd67969aacda6a92de53958654404eccdd17d862c91f0306
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5675fc804aae4a29caebd7e00b83a484b
SHA17e9e49e4a2f893ae0d3f329560f5db61b0cf0d0e
SHA2568d057c36abfb1c2baa9aeea5bbec6cc2829078cb3b954cbeeddea7415c13dfc9
SHA51266e764a0c91fcc04967a76cc00b89f97853eee41d01ecc3d6d873d36ba5c7d05a01499251023076258a9db8e1671aff2b30c8140ec1a9c49f814b86c77cc1524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f94ac0dc49ece60e55ddad3e31497370
SHA1a57714d7f99d900b102902bdf0e60c2305dad8db
SHA256e404bc4f488c6adb0b1a1ca9e6f0861b132635e5dd1f6f92f67fbddd54eacf5c
SHA5127c38341873822ee44a003b0f6af93f9d601dfe30e525742087e36716425fabcde584683b56f2987609f7c2cad2e87aa88cc04937e3d5a68bc7a00dcee8a8ae3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d8367c2b958df81c525d9323083c6d0
SHA1145cab3aca1fb99e05361dc37d969ef95fa0811f
SHA25669bd8060b7183acbd86766ad50b24556bdafa7b0e940641bdb413f96d4c8f20f
SHA512ad6b7bd03c5eb13e3dbea11b003cdfac914bf5dcf2dd4dd4d9ebe7e987f211c366598abbb358cc360c9c3e5bd48ba74c1f9e15349c768585a3c60ea8cfef6c6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e630b5e0d8e03109127d3f6d7f8bddaf
SHA12f40d4de6f58c2b7c86ee51ca007c8f4391bbe64
SHA2567fb501aa4824360fbd8c1454d097bf20f5ff0a0c230ebc351ab6d3769379f2c8
SHA5127849a2b53851bcde4d8bf97eed6143c3768d7e6e53908fb658a0ef275c9a012e255e282455fb67cd8ea2c22d2c419f8ee9afec4b2ada12dd5a654a4fac7ecd8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c87406ced654d194ed6e41893053746d
SHA17c3aa1e6c467ac085e546c0c24ae6b94739ff254
SHA25639f57e03e6c9c12d5dba5e0f8ed818f80055a461e986033ec182cdd8bc3cca85
SHA5129b9e41387408b7c54a411f32e736a82077191d25c8b5a062a38ddb43410975e014c8a6e9f6ec05c5990363f9c4d5b43401ef3d83dd206847a470324292184093
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df7b30c5cd3619b7a5c2c71d76cc7f56
SHA1cf9d04f6018256702189357d45063f497b459672
SHA256dcaf686ff6cbbef360c5d5e394ada96204e2b4a56bfeae9d552dfa5a9fba5da8
SHA51261f296b304d3df1fa379b04e8b2b0dd5a2e3b69d358711c4ae3a6cb3f8808c3cc6e4cb30d60e048cd1dfc9c74f4f351b4fd8b4397acc686d093b9ca587886bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c6516005aa1ae045799bf144b6a7ec3
SHA1310ce49a75da4d55503b41ced42fdd298ad429d7
SHA2561e05d1c8ea79d667788716813eace5caa6f27247514c48caf0740b606b108e65
SHA512bdae146f8283aa6d74aafcd71f155ab83e8e81c9ff2fa3f8a50e435b6191dd6063130dca8ca5184f850785c6e679b43784d9dba249362876adea4b8663150d57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58480eb663c8143e59dce35979307db8e
SHA18fd675d6ce62eb837782ad105a95a07b703db3b2
SHA256d1155957b550a7c5297c3a6e2e36b1c6ac1f575ddb3f006e6033888dbb8b3180
SHA5123ba1cb1f976247cd1d7add5d52bb73c75a3de491ae9fbae04791dc34b127c058bc1e43a0447e82e89258e7922903c5ae468bf76f0add1335ee17aea8bb8c18cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c5ad0e77738932efd882792a289f522
SHA16dd35328cf51d949898ebbcf3e65f29855406ebe
SHA256fad35a2d8ce7530d881fb4369e6e1bc6b2da7c2e4f3474f74bc18c73e65e0acf
SHA5125b986aa2d9902f6381c126de7522ebb8d6d48e0b6c00f950fcc50d3317104d0857f6c56fe6e680da095e4ccf4970918980b6fc3cf5acbf79b0ff7e25f5c171a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa6b7b011eb52fe83075c231e7e2112a
SHA1d1e6f6d9fa2bfb9963794f5042ca74c038e7c031
SHA25692dc0e27ee3d3742c3a4a09bcc9390f37b15bb34e84a8168ba0ba2980a52f3cc
SHA5122588a35384442e24422db4a60040a8d42b9d1629e9f3bd82ab265c300cf1501cbab47a8971467cbffd290a5942023f4a850d3d2280a5a86db748dfdedc0bfbff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da25f7def547e094185992af8c99682b
SHA17f2aa84eeb83edabe8d430c624c1a982d742938b
SHA2560fabd0524f2645809bfe4b054db25c9a0e12b936608940c83369d036513d2e65
SHA5123c7a54e973d92190f0ce5db0d491df0d23cb93c6c2cd3e588bb449e9187c1d98474ad960bed092e4927a395bfc39b5634fb33b7d03ae8fed0709d9d52acad4e6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b