Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
b44c6d362690c556694e7420991e181d_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b44c6d362690c556694e7420991e181d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b44c6d362690c556694e7420991e181d_JaffaCakes118.html
-
Size
4KB
-
MD5
b44c6d362690c556694e7420991e181d
-
SHA1
20a76c6b37bc6ceb81848cb4b563afde3268b5c8
-
SHA256
2c131c40f7792cf020a162020804b63e658051d873c5624517b7590e3bbcba42
-
SHA512
1c23ef47858545f8daf82f3331e9206f52fc12c09b932a8a261ed181c84642ad2425a3811ee3a06ab0b1fe1c5579b6f1997fc361f8acf6c8964e78067e3495fd
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ob2nd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000006080d488f8012fe4e6cc772d2340cb3edbbd0af11e76542644074ab5bfaaf86000000000e80000000020000200000004b9aca1ed5208a8194eb37860edd1275c9ee916a950b95b741cef44a35b93c8890000000c0b3819be405eddb5b73ad79d0b6980c2b8105882f4c2eedd0a3cd203d281b5331917330291dda960ade83fc576e6197046e3c4692e9330721859eab6f0eb1a17980882cb396a6d7cc0d031a68556baff7f13363a50a1e49f6b799c0aae51c180e1c3cfdc9509501e1e6e688f367ecf64bc511fc3114cfb11a96b01833496f9bb88dd147abf239f225a997428e76cc4e40000000484d6c4c9ce618b0c8eb34f326f6fb6a6309d2593aeb10dbbefa14c98bbb017e7199dbc447dc1fbbac51e74415dce0edc7da19bade459eab1ded28ed4403ee8e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CD2C131-2BF7-11EF-9266-767D26DA5D32} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ff4a5204c0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424714612" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000cb94afd82fcf8bcba07f4c0fc33332b6e7ffc1abc095f66ec1c9409422fa7e00000000000e800000000200002000000052993582ab963aeb8d26df2409e1166ab093ba465429faaf35ccc9a7f7beddf1200000003a94bbdac0ce4e12a817c98a3e32f371e69d69cbdc17489008d91b67e9222d0f400000003b976aaabd9c83d909d176f22c80f7a70ed9b45eb2901c22f2a07979f44a9359ab07effea67b7cfc8af3221536529b65fe668c55ef7b894569367eb856e28cf9 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2840 iexplore.exe 2840 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2684 2840 iexplore.exe 28 PID 2840 wrote to memory of 2684 2840 iexplore.exe 28 PID 2840 wrote to memory of 2684 2840 iexplore.exe 28 PID 2840 wrote to memory of 2684 2840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b44c6d362690c556694e7420991e181d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecbfd53848390a63c3aee9e4a80f8530
SHA13f441488e237c96163f7423e8badb1391245fdd0
SHA256585e3e01d5df4b861c8c74410428549decedd34d929772c66eff7a2e79e10e8f
SHA51222d76538bd6fcdec1b14f2eb6ef9f3f5fc29a3b5761d275315b3f5d05586183a1e6327575e0b723a830982858d16e21d6392e305fc2c52ed95f9b52d5fe2dfa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c95df153e6a773a2ebccb5fc4802c4e9
SHA14eecb05f30bacfe53ea972358eb4de694cda58c2
SHA2565d87741754219e1d3353286e2803aecd5d379a787fd650157894dee343d1fabd
SHA51286c585fe1bab394137c6a03a9cfba42555f872c5017a844b49725f06d2b40a50184de6de9ced1def60d89cc67f28d181e8c792a86d678c8f43e105587552e591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538f8f4357bdb260adc68eceb0f5a5a92
SHA1abe4012c39848c13a86a7a1fde53bbecab8389c7
SHA256bd8b4c70947c5c57512316bdf85e1205a639fb164c707ae09302bd2b7acb6af3
SHA512a74232584f4edfc8e5dc4c183781b973e0e38fd2ad6f470add8e516ed3d4675ee90ef8de5d12abdcccd2ae85f74fd98d18bb8598bfea36b88881e53bd79c0ecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2acba592cebe8edf240339efbc74c9d
SHA1f37e0c8d1f9f9412589c96bb800ebcfbaeef18b3
SHA2561139b555cbf16a2dfd0828128efbdcbaa58ae50c346c1fcbbc6034fbfd96b927
SHA512de7aa512c44820b4325ba7c6e8011e54b31958bf7b1803991f8ea03d1c33ab0e0118902c20eb37f3f4288e1f5f55f174f483e6015831ecdac2df5137d9ac6260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b425b55646f9e3bd0dfba1d06e03b33
SHA128aa284161ba3c3956ac8077e2b74b2153dbd3d3
SHA256b83af1107d353b4f9ccc2a1cb632e234ee92e8ac326e4b1d5edbd9d634557549
SHA51271147c6b01f7302c941967d02f7dcd373ca4dd12be45273ee16013a9c7122c694f80b73b5e32657202270f84069ade2fa0eb512cc8aca6c4edc17b627e8e5a9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b10254e79638200fa71b124e2813d6f1
SHA1664622c5e5cc63ccaccf47896f395b331d779c88
SHA256be721d149978fc0b3fd97f9223d3d76513fb442b0e7d83542a96218a831bffb9
SHA5121771da029df0413639c9caf7ef6404c4168a59fb8fa287fcc3756d6144426f141ae7dc78197cc62e7352622e75192e2bee173d1695fbab80c501d51722f104d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b47f381302e2c7620f55ee0c8da5f30
SHA1a921adb32fc22dcce0ec5b7c6c79dbe48502227a
SHA25659f124051e7cc20210310c08b51a892a655191f5e1050bc821e9e6263a0e90f6
SHA512c6cf117c8a620e18abff439cbe48ff4f559ae1f37ea210f819a97f2f6a8b3fb851fe3ea4c3833e7f9de0bbd7bd2f54947d854bd049b617e3a744e7a1a60148ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efe3847590145b9da4ab96414ce6b7aa
SHA1b92fbc02ab484ab707f0b684a6151f112508d21e
SHA256480a968dac36c65a362d79697aadd25ecda416e556d1380b6023b50eac80b5f6
SHA512937e491ef1b4dbe6ef300e8190ac82355ea0c4d4fcfd1fb9a6ddbd17952a41ff1a818c1c16d696dc0d0206eca8d44984077e17ed0ae8103a3f414571806e95f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544ce6e5c8a7eef6732b1f3026953aec0
SHA1b7dc93ae08aa30b0825ee9c178d4b67b48f86bfb
SHA25687af20ee5aa3a53789034f473d947cfe0e628ca6ea8b4652fcc5606f574d79a3
SHA512350d0626a96e6f4aef36dd4693c1f45545f324085b5c2c4d67be0643bdcdc875957a8cbea717dc06abf2b6fed0f4ff3f4d899e9b8f1d47399934e554551d4b28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c7b14d36d04e03e93d4d943f3f48460
SHA158c47a8674d24a3e5318065058190cb283890bec
SHA256c0758b61cd21d932ef6cb1779ea2da7c16634592b15a2eaf7a472a957723740e
SHA5120c78aa77cc27e4aebdaab49328235f23a1fac980543eba382aaca221a0fc0d7165f824a5ee1c3623d6722d2ee8703c7dc31edd797ebfd2420165bce564cd4830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d940f952bb7151a9cfaf708a81f19ea
SHA11fa34fc56cea6042898ab5ec6f8bfd3bb0aa4a1d
SHA25609b208779dd559a120fca3168cd005e95852f3c33a0a1ddcfbb0945bc8455f99
SHA51293a65d061c21e482ec4960840eb427247f399af0d7fdb7d12c190457e883fda521a703fa6c56c02ac8969555aafdf9cd3bea012fd60b4caa68fd4cbbf858eb19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5926caaa3a9102dca0d9d135747286480
SHA1983b736a248965406ae6301b7656d11e067d1dae
SHA256e42ab0d6e8acc127c56c3fb7d7c2063dcf186ca9edea03314c68741d180037a9
SHA512e8e455cdfbbabaa9a13bcf6d1e3e93059564699a5a7109e651df4ef3e3476700edd631f37871a423c17fb0907199cbfd60fc33078f47968573822f35c6408e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6a7ff7bb2ece298d215ff1a91ce6473
SHA12909acefeba4fcb528fb677ecbdf40d776e0a00b
SHA2563fd18e1e2dbccf40b764a5285bfd075342f1d294afa612610d537f53993daccf
SHA512dc8bb6d55db99868179f83b730dd3038da574b0e17db6722794b7b1937266c4fb9945bbf6015f3ea008b236d61f46c6597d8674caffa2537d0fc5f7359da8a95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534e4b4aaef35cf180c111052d6278f5c
SHA1377ce173d35ea5312e3715fe6fc4891264784cf1
SHA25660b84b9bd01e49f9f8ecbd4dbc2f02c8a82bc7848283e16cc6b3b404a6143f02
SHA5120797459ee296b8e6df70f0a0d01d496d3d156d6f2caa678694e1d5a28fb7ba09a13aeda29b06c4692c203084cf6c94fe69ac8f369886426b81d2235d6b97b357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534fd6d3be9f0a0f50c06c85a50e21895
SHA160c85db75563267756c38a4a56abf5b7b05c56dd
SHA2563912d087777e610c6e4e0bb7f463213798bc93cd8c400fed78d1c1a6a758199a
SHA51216799311d3a0f85a12efd4bab6c280dcb4b407ba63d92bb2c66721b701dd10dcf73ff1961a1bb007b1eb06453e96a2fdc9df3916093162fbe6350a4ee2a8bcfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524ec2a940d955916e65a2235ebd31857
SHA10b56b0ca1a03ccaee6b208f4d847b09cfcc54eae
SHA256e5f867c1f1b4aea6b586fcf01f4765120da685370db9e36f0a413bfdf3fc1c9c
SHA51273c35ff0605b63dcf6d4ce9190b361a3737621e19116a56dadf6b58b407e2dc18a3a022ad51bf6a0a3c528dbc469e5f186651a275567b9b88ff755daa7178f07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545ac35f2c878e1418d4fcb23326ee3d7
SHA1852e1aeab3f2b168b96d3872c97dafdb926cab24
SHA256a0cda3236ed2d5e8922596507dd94e2bc9b72043baa419c3ef80ccf059369fa5
SHA5122da561fff7620b35005a3b9c3b8b5df7f70ccf0477c6454c4e2195ad268ad09ed3d27411b5c3e2c9a5faacfdf4bda6a180eef46052457d94862a9c2534b85373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fb9f636d09a06d8073cff3909dd8fd3
SHA12d7eb69161b7632b31739164ba7d68138f8ddea4
SHA256b7e80a5e386a164a17c92b73e256796062fff0da01e5d46bb5a4d508fa5ea46a
SHA512ae86842b4a542fd72d00b55254981101ab883215aeeeb1785dde29494353fbbb16ad2cc53e5d0b79f8a84890d7c0521f4cf51403d4082acd8ef41da30a82c744
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e9621d0d4a8a252b94971599afcb7cc
SHA1a14ae22caa504c55092ee131b0bb524c42eb23eb
SHA256cb01e80346c5c29556871e18ce747651c031f418b6358c09c7f3c98938550316
SHA512821cd9361122dd4a7aee86794886f83218116a2260969c6b0e292f8c8eab9f39a1a35da016fcbdcfbeea3c4fd17985060e61b77fe5cc58c989034f212f362a6a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b