Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
af2ec0288babb851c8500af82eef01e1_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
af2ec0288babb851c8500af82eef01e1_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
af2ec0288babb851c8500af82eef01e1_JaffaCakes118.html
-
Size
12KB
-
MD5
af2ec0288babb851c8500af82eef01e1
-
SHA1
aeb6277f250fb3221fb04a7e134571cec3ceacc8
-
SHA256
7d5bb4d73905f1144eb4540d9bf0387c23ba8e6b3bc6ac816bde232c12856073
-
SHA512
0059b161003e95b3d099b950f949b05a492cc80d4388d44f66529749184fcd0147011b1f62ee00f14fbdf5ae7205403f62e7f31135e73d9781dc382682884fab
-
SSDEEP
192:CP0kMgBEOks1QTxE6av//X7/pdcu8Mc0qL05r06pJ0F90Or0D509sc0940emc:CwOkjHav/T/7cu8J
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424645862" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000755ac39aea5c0691c521ce5257d11649ac4d0f21f8d337a02c752d0422e58aa9000000000e80000000020000200000008794c460958796dd531bee58b467c880bc61f2489f692b149c8dc291c6edbafb9000000086ce58831a5741aad0b05dfed5f4c12d588d5653736732e23644a7333d93b6c17a12c49f4a689256aa2570a62815ffb4615cae14535c7cf4df9680b8ad2b618578204c0c60c75f7f194bf23eb3406364f514ff1769d296e89b7b9ee3155ebeaec821beb54a7da57eaaf950824ef80ae46da274f5196173b8a348ceddd260980c4ab6eb0abf150ca43cfd57769b3f351040000000e14e2a583bcc1e9e7dcc5e17e406489dd99e6bc0a8cf402377fb8261e5ab4d77258950938dc6fd964ca9ce6807c9c8be8dd6ed892b10ca1bef9c8ca74087583a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003876551a3aaa124f21d0475e1a897195d58401f598074695d86bc2f03b7db384000000000e80000000020000200000006b9e777e9ae966f68db5fd05f333c765493a9d890d39a94d43981ac9c935efb62000000074661de3769f24c4cb303b9cd5954d2d5d0520d9ffc5bd3ee5018a910bd9f837400000008b7e610a2cc4a9ffd133413e8dd1f1549fe8295cd2e1e93920095412feedd28d865d3f924022ec3e1e402d71cb87107495bdd634f6471ea857af2982111d089b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f087253f64bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A6F0301-2B57-11EF-8F1B-D62A3499FE36} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 840 iexplore.exe 840 iexplore.exe 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 840 wrote to memory of 1344 840 iexplore.exe 28 PID 840 wrote to memory of 1344 840 iexplore.exe 28 PID 840 wrote to memory of 1344 840 iexplore.exe 28 PID 840 wrote to memory of 1344 840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af2ec0288babb851c8500af82eef01e1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567cf4a207d0003d8b99757750a398975
SHA1ee6ab9112b748bcce4f02b8bc4bad4fc06a62ea6
SHA256fe9f937d24478ffbb8c8309155a8a0ab68dca16c30f6c1f4e8f861351b511d49
SHA512ee670b401a23d37ad6ae8b1bc6121758bfc46216ee9d249239aaa3c45095f9642d244906c3953932b2a45ba30b1fa3a178d0e9342896d256320b39c3c95e3a44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518ca597a88238d5c58e84d5290437e0f
SHA1b63d16ac5650ebfb07270b4d3d36ae9f84deecbf
SHA256231ef1b80e4796997bd3050531049e309659dec1f5f2372dc26c6fc93de722eb
SHA5126bf90304aa5c58f946ba972da6c6b4f4e0440e0bf1b1e2e4de564a249cff93bf161fb6df9fdb0247bf2c73df7bb080890e76c2dba2e79dd6f2c1768868cecd0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da308d1b7d8d1a92dbfbfb919695df66
SHA19b55ce8951f611385e473939ab819c4e0bc66edd
SHA2568f831de61e83ff8c929acc706defea8acccd89c603be575f724b761ec26bb793
SHA51286f350efa1f5107d2178112f82ac0702eab7a0a5db941de5178aeba8ae02a53fbed495b79d20f8e0509056ec293a68b4e77663453e0e5e96ae5abfe429b9f163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0cda09b862f2b2c72b76c80228d5719
SHA177ea671967ab6c9470803801b69b08ede96a0d9c
SHA256af4bcfd67bc608774e77396901a4c018e46f051ef980e72625f12a32f6af517a
SHA51256b464224bf45bc1b075faef0c07ea45e6a3d182ad2e058a70d307dd05f6f1f2e469997cd96c5a0990b84541ce3fd12a16fe57a40bcc859ffe37c8ada66d08e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533e03a457c64fb0574cf40a4f676ae65
SHA1704cb8ad8bfce58f7dcc454e3089ee97b328b434
SHA2565a00b98c4c9c9462bd091e876f2e1a530b26c9628e0a651eabffb6aae0f6a678
SHA51267aebd31c18b4282ca452cad2ca3155e002324ddfcf58238c120333accb6546b5bdf92b80b33e4ad0b0cf51589af9c34474e956e3836911e63e524ad964edd35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b96d3092b5b86d4fe10a79b09f9cf05b
SHA17e02c4f6f7da00cf464f60b62b7f96f253135fd2
SHA256c274127bd8d95670f99bf79b64ed57cf75bd0c244747fc357a0e7bd8350cd537
SHA512b0a36d3baad121dd3c29c37c9f5c861cc4f15ddeb5f2eba6601ddb15015fc83d33f41b9894663da3231408d390463198b0c96fcdd9260b492551337219a9f3d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd86720f947d2ccd639dc86fc397cde3
SHA19597f48ee84d524db9ec1ee6f439950cce1ab43b
SHA2568f7f405c802e73069ec68caf2488be7701ff261e77fdff2b3a8f7745e4f902a9
SHA512429436d9c2d9b0997152d695768b3dbe2cdd7984d24497f16de44e2741b575e304878bed9cdc062764c96821e7343b6bcd03a52174de7346c1d6ae16cd753765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daa7e57c1972f2e050a9cd5cc0d2cb33
SHA1ff268cbaa6e89759e76d09e52e6f92176a969072
SHA2561d2b5a9eb1c60e925084baedd8acf058f34aa38477e08a863f57cda7e56cc118
SHA512d1f9f6df3ace6749830ba64f66485def6cf188a48007e3dfd30fa22cb2b60b860667dfefb67ce651c45e42b0d1c147fc6e13510e0eb52173ae8922ccf79245e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55384442aa21ef6550fc1f255fb6e3a93
SHA130892b4ba2bb53a38665652f0b570c5b2cf7efa0
SHA256b166173e978fa2f75bdff37c0d9417a382671b5b194ff6bef56b87f0235b09bc
SHA512900d8195198f98876b9859e58abdb3a981f825b71b3d17d4ebe826566275a0d7374f9e62884e583255fb89e55b45d20dd24dd5f385a2a93fd326f82fd3a8256c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ebb842b8ec2e0a0bd15af490ce3a079
SHA15896f69bc84d099293fe997c4593991b595544d5
SHA256e8bc0a8961221a116e26594d842d5d6cdec74ea3f3abfdf064c8216c43538395
SHA512cb134cc9ebf2e4e89d9f377f6b2e8a77ff3af4337ba9cbeba1e837ecb83f9617798ce5a19eeb8db1788b8d422ad17ad64b81a237efefdfe0f52e144b6b03d607
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5491aec88c46a8baa74bc1b7b3f884954
SHA19d4df780bba953700fcb5760494b2b45463ed1c7
SHA256aaa1f0234c8f86363fc7afba42c36593d17eb2a94bba7a0eb676910750743eb7
SHA512621f643df1fd790a754b6e1f0d6d95fbdc25c0a4ded726290d44b085c27c559300e659ec307db08eae05f8896c550d45cfd704f638034daaee1f669479866eb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5205f2b2dfb2cffe3664fc5f682305aa6
SHA101e775a57279fa1f91a8d8d22e7befa62665ae55
SHA256459c74e9f954b7ff359445673edc5aa9de02bd954ed411086e520e83f5fae32a
SHA5123693a6b5a0d571b14e54ae3b9a31f9f3b4cc9c7fe6f0e7df9e0ed4ee070b203d51ea52c66a380b8a688283b05a700b5329c0332e7f944ffbeb8e83ce7dddee7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f04b92d55ddf86e7435e1ed589b92359
SHA19ded8898a91628425d17aa5b9b0bb46440bfd0f5
SHA256692b16605ea48129ffdeb9a5de69d23ef715405b6fb8f251b7ebea2dec0adb52
SHA512da60226ab8bdb15da9ce55936e710a1909d86dab9e56a916a2752faec345f42c0e5c48cdeceb439fd5c7f45eb5fe1eb697d0c9bbcd8fcabf5ed647b297745bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d83c3be981f18ff8264cc02f13c9c131
SHA17533dfafa045aa116993ab6cc28500a800cd45e2
SHA2561d7a0004b3a18e7c95bee93eb73b75c58a7c9d7ba199a7f981cb7a9d891ccd06
SHA5129ea3c5926d797b081fd0d602aa8838676ee56fd16029ce6d974caad410a13398bcc57af2efeabdc1cb0ca818a032472ff946e35720e20efbd549b0653e3b86eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a110c555f447cace67006bec30a4cc24
SHA1cc52bf6bce45403012f9374547491472c0fa792d
SHA2568978620211b24e6161ee30c7bef98ee742c5d58c97a6055431a230177e896941
SHA5121e80aacd081f21963c65f440da87e17f0dca448cc40e730ae3f2c4b60958c3cda6720404187b53a8324f5cb5380cee5517ea46b6c7d78e17a2979a20fc78343a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548f54e6068259f9c6bf0d1c53231e779
SHA18e4ab5b4a6f6eb863120f3c7a85520fbca23272d
SHA2562274e528c6c58bf180c52a63578fa388b4f27950de77b06d9de7eb464851d7bf
SHA512c37ce26d96bcc2cff0acbb58310bd7a26be9651993e7c5f3409364a8fa0e613f21ed3dc864240e645ea6b34b1b07d320b30a867b2c068d7b2982971c4a1f7aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ff3eaed13a0f266a121dfdac7bc0663
SHA13f45422ebdf04f51585da93b8c9fcd4386603426
SHA2569647388f9c4645703fa861b29a60ada44d7e299d4d54c8d1df7ffcdaa0f65004
SHA512eba3d87421ee6ea4b1ca89c40ffaaf6dc3b96fb23f02d1f32e277338b68101b11cf2b502c3ea916adc8a32f8cae1882cf0c943af94e07cd53b514f8cbc868866
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f06933b8c9945a54c844c97d9bee5ee3
SHA1d0fa2ea077ba93f4235844162c80836413f30424
SHA256ff9168e9012a39b1aec7ccf02f838a0ae2c5f4958a14e7e34274fd6d79042802
SHA5123c51ab3790573130cdaf8d8a0a2e3a67f81829bd7caf9ec2be2a52ae72e0a3aa38bea2497adf7d3139c850f6e0fa26541f13bd36cd13935c10b7e30523d9b440
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcffb7a472f81bec52bdbe1cebca5758
SHA111666116733b516e820719ea3320ecb5ee4356ca
SHA25616c32814eaf5469677d8bc94f43f8aa510df6a98927b505774eb679e6b95a245
SHA512449bc39a82d2743ea023c91202c6a66ab3ed5b2793cd79c02d7a45fe40014854d01b38d0f132be1ee113c6219279afe51549529c8881a0c998fe3c8a78b92d52
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b