Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
027cad3c5ce528efe07edd712a6ef557_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
027cad3c5ce528efe07edd712a6ef557_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
027cad3c5ce528efe07edd712a6ef557_JaffaCakes118.html
-
Size
6KB
-
MD5
027cad3c5ce528efe07edd712a6ef557
-
SHA1
265989b8d980f7c03dd9fa68307b35813a15c324
-
SHA256
f8e04a817d5705ea3edbfcdf569a13c43061abddc05f7ebd2ad48e2e1b5e030a
-
SHA512
b37ebd4b3dc60c217acf870990f17cd8a20141e32b46aa13ffc7a10dfced983e447f494fb7bc7d212db12f13fb4f03942d2d9d01f57fde90ac001e0dbbad9d10
-
SSDEEP
96:uzVs+ux7tyLLY1k9o84d12ef7CSTUB3/6/NcEZ7ru7f:csz7tyAYS/a4Nb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425016725" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d60240847b5466ea8b4b2ed4b1ffb52d54a370c35ece302570332e2acba38df3000000000e80000000020000200000002f80e9468cbf9909abf97615e9183f6884e82a9af830511d92684de1584869f42000000052767f90767f1bc13b3f4376c3c93b7fbceecf6653b7e27c752113ec621d46cf4000000053bfb18f911e52066461a66b964f48715d3ce9809160e439b2857329b3e4a9d06274328df200a7c8b318822ccc0ff54c78132278c829e976a865c8227200d42b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705e03d5c3c2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000581e2815ab11ed86c1387e72fe338564455324806744dc490f3286f83fe78847000000000e80000000020000200000002c263ae0472e4869d852503f8181c3daa041170e3ed8ab8abe9ef5c10759056a900000003a1c81c309ef231599a81f086cbae9ec41a7fa32d9bde1ca048dece273b7f103be930b4f48617ca7b23c3451b0e910d20de1ed632490411089c2719b0255b74ee976a4f9fd4c28fe3e8335e28a2dbff82437f0bd2d5dbe13ede5af72d3cf59d315aad9453dde5865bfda7f61a59f524b7a46975f59257beec6696c3a60f5f93e1dd85da0cb1b4ea1aadc6ce5825e75e4400000008419483f2a4fdb8aa4824bdeb87e2e9fa2a4abfb5773edb3d52227b988434be7ee5435d82c30344a0b30950f830a94138a6a840b2de5661ea1096afa5fb93e7f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E74F53E1-2EB6-11EF-B47E-DA79F2D4D836} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2392 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2392 iexplore.exe 2392 iexplore.exe 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 3028 2392 iexplore.exe 28 PID 2392 wrote to memory of 3028 2392 iexplore.exe 28 PID 2392 wrote to memory of 3028 2392 iexplore.exe 28 PID 2392 wrote to memory of 3028 2392 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\027cad3c5ce528efe07edd712a6ef557_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cca079247fa035a073832653c3e2c154
SHA13267fe15df7ac5ff5562a544c765b73618264c4e
SHA256dfac033701201709d6954a54224dd9870562de4f15711c2d13f96e7f32dd75c5
SHA512d70b800ce3d353eb67b0a16b389fb564e2cf6b01fb2ca05de8c2547a87f42060398eb86ce4f57715cfd64ba64224ae9a5ec653894ffdcf48729d0c39355857a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d9084104925a3950396a1485984ab58
SHA1874fec78176fd2386345a3e16d0516081f7c2067
SHA25680eda7ceb2c4f77f13a1a990b86971ae718dad2ed4e5f77ea9d3a5d9778db419
SHA5127a0dc271e27d8a0d046405c0cd8382b189ca1b64a33681629c8ae7577eccd53e720e06fddaab407c3abc960f1e52297faeb10784c48fdc5c1a4a42c8b9e48ed9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9c8c25a83db97815f316b55884cd44f
SHA1a81c082a638c7a6a87cf9c37ea5101cd69b6ecfb
SHA2568b0ee9b672c2b1e0b5b25595fd97b18fd81eaea8dd6d6fa0f0276304cbc5333d
SHA512ebc3850507fd05bb4622c19bbb28a60f14484de5ca112cc11e3fc80ea36c13b9e6a2f56e5fa7ccf021730bef1a2afcbf14ba7a90df804fc92976a432827f8feb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6af98e4a57721a80957e9cd58b7c51d
SHA11ef8e1ee8be5a5c1263d39a7d01342b743afc606
SHA256f23292f78609ad5a28eacbc39f2d524dacd6b9294470e4ddae70dee51624a0ee
SHA512784fd3500a8e04eaa734e7c5f056c6376594a7e9e686d1e58bda7c49eeb312191386efa10b0778edb9c9fd2c45085eb8ff14c5b6e68ac3793462f15850a09101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50557afa394097de772fb8e350d1b5ae7
SHA19d4b71d406c421001470e6c1b4428957aadd00a4
SHA2563427e4affe8a17fd0aa37466ee5f29f69c3c3b90852cf93cb9e5125cbf8cc45a
SHA51263435d090925e55b698e7aa85f076709b06fd314f500e8b09f55776aa22243f5cf3cd5ba7d11c50e48fb99e6b2a8286f59c6f540e3a7a59051a75b82dcf6c513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537bc97816cf81b1741c98ebccbc23613
SHA1ae1bcd0497054197ec2faf9753059de614ed55af
SHA25603b32dfbeeab3806bac31259e4404f3a27e7019bb2ddcda166e4a47081138deb
SHA512a27dcd61e65c9fc46f2c53c88ff3c5934651d13c55d9feb4b1f19c98813d29091d8fb2d8920d31d1139b2e6b0949f725004dc860b5e1535f4c769abc07098e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e46405f68afd44e37aa44d68131d006
SHA1182726e79ed9066c04ed44c36e426ed2ba99b8f5
SHA256d5aba9b6fb2b900b3b1d11c50748b0b36f8e2e1fd9afbfe49a9d5ab93b9952d0
SHA5123bece3afa1aa3e37ca10c86af30f9256d3ec6c04cacf0b9981c7bc1c5bbca20d2899fcb534213a13f3e8b3ee7c73973c84eca3e380b7a9ab7cdfa55b7a474ccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6c004baa7507464224b1eaf7c756b54
SHA10d0a7b76f16c960db364dc59d043125a3ebb33be
SHA256b846d21ce6f14604fd49a86c722022c5eeb45d15b649e3c1e8f029a2ccd6b880
SHA512420b57c9237f6cde8b1a0d8d475d324b852dab566f7cebb9f8307d44408e16eb25356a970ea51b993ed0020d3cb7de37dc7d29f7a85d72f91482ea0eaff692b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d65c81bec82ac49eb539117fba658c
SHA1eaaae78ae40452e999864179ee8588c884c50e4b
SHA256f48a64554ae2ebd98aa0f90b67271fc3fd407ea8b196d1a8f673e5e70e3a332f
SHA512eedf1e5388a8376edea1bcf48d5482f97f9ddb97f07f4daa61737f69821c12965e1876263b498571e46547f316b51a707620d7f303f29354738526e31803d0df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f4118df22ee002947be5dca12ecb308
SHA107e03fce2a5a868b7a47d2cea8207179dcff1d8d
SHA2564792cdef73600d2029c50798f51b2de96bfa9dc9fb64f9cb8a4dc0fa60ae9b5c
SHA512bf9eef3f12bda8a63625abcb76358b73b965db05090612234fc34cc1176676c60a60bf54efb77541fa354aeeabc0ff9ea336119a98ed8ba1e3ee98e8814609c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cb2fa70a965a790a17446aa9c544e01
SHA18218f0fe5fd3f46755b6e24c59b448f0c5770eb1
SHA256fcdb96e277cf3791d9523dbe90d5d150bb7ac06ecdabbaddb5686ee4c8f0091b
SHA5123dcd90f81b7490ce658d3ee91e4e1d3e36210de030359d69926b4c73386a9a019dc47ca4a462ca7b5066f098c60a5aba3ddf533be1032c1ef4e0f7cc605d0135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521214db8ddafd4a548c9e7e33ebc29c5
SHA15937219bac0640e9b2174e52570f3c49af994415
SHA256e4974f6502553d9530aeb1b9ad219766805590f0f1027c0abbb17cd8bf3822cf
SHA512a4703c063cb69dcba6a53f10ec537a7dbfdbadc8a534a6725dcc92d4de986e88826270c43ce858283d9e7e6aa44de844f2e80bdb04dbd638837e8eebca5288a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596460ea68c092cbd33fcf4c4509b6fba
SHA1367a29abef6d0b29008ed4f25bc38f0b4110f584
SHA25643dc0f054ce3a71708c36d878dc3500a8659e482600399891a53b1f0a8812c93
SHA51299cc169c69ee199848a61d9e95566336163a87721ce7dbaa3b669b8078c90de8fd92a599c56d6349ce6266cd9c1bee29069b73c2512b01aa596deda720365101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c84ad778e8827c32226b0b10578aab20
SHA1c8eba5fb63d2051c9e19443dbe41a17cc014cc8c
SHA256f74c5adede8d7b66abbee60b5fe0437204c73c27c1caa44b8c730ea9d7544911
SHA51209a8ae950e914cf6531d60f60aaee04926c3d93380d2b57e8c53aa18df022e93bfb33b9aaf3067f5bfd197327157c9fcd4e4a185c1c9213550ab8d7838d1c94b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5410abe709b92b699e13c303ce6ac41bb
SHA19a607f0356aa91cc2b112f7705addf7ff6593a79
SHA2564e72f321ab27229b985f4e83ee4c3f5c0ae08abfd43c74187fdfbc8f46a52c9e
SHA512923127560401b52ea94efcb74dcb27801f8ea2bc0c6687eeaf4d0cfddac9f7f77125c823d95ebf239a3fadf0608a37b66bbd1c86a8784d743a3f1a44f1cd6678
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e9831698b0d5fb7b454a33728d1e14f
SHA15271eaa0661dc95669e7a61740afe1d9a615e584
SHA25699f8c3d31b577235cb47b56fbc1460c3db12ef6896e225c65d96f2143e5d6f1a
SHA5126970901af5c6d47231724e7978109b8c33a6ab64d3330c5555f939b9a4c2e6f97f45a0cbf8fce20a643b6ab4dd1e1d4691f228baa406c60b5a3620ed006cb5d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5841e1b09cafa2faa9b550f626510605f
SHA1bf6a28e337c7eefe976510a418b1bcacebc5ad72
SHA256d06472ed000f593e880065d3e8e7b5465df5c9ae91297a46eb3bd6785daedab7
SHA512df57debf08344fa40d91f6d06c70dbb14f1d6ef999f75a0c851f7ceacadb8aeb0212c0991de73ee5ab5663278e60c4f3a84088b6183a65b403f5908499c5a700
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521a3cb98b13dc7ab92ddca5029d6eb62
SHA1309c83c58c61f5e93ae1652c34c9793d1dce94f9
SHA256588f8ec1a935352e9002ab87cbe3944330024a4b943b6a88edd02213d189255b
SHA5126a7711b40c0d1aadd7b3f307104056315d9652b09f33262ca6f6e254c0199dd988ee002297a6d731b011158120c8e70581acdccd35a3022ddbf62fa17bad403b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54795b8a21f5e888b8f65b950b0df1b01
SHA1e935d5fc8100c79e0db3436263a39ed8e01cd248
SHA256e1e1b146732246dd1d2a94ce26ead2811939ff6dcda0082717ce41863b84ba4a
SHA51233d54426b121cf1788d561a6205e361b81e80afaaee885cfdf35798fe8eb2cb30c7b05d043877f7f54d3b1946fdde9af6a2ff64cb7df594d35a0af707dfd0aeb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b