Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
02da865df84100bc5431345c382ed290_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
02da865df84100bc5431345c382ed290_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
02da865df84100bc5431345c382ed290_JaffaCakes118.html
-
Size
20KB
-
MD5
02da865df84100bc5431345c382ed290
-
SHA1
d1a5d2ece93a2b2a8646a7cf8811211ebcc6269e
-
SHA256
6e6ffa89d1d3be27c111d003abb8aafb2bd78845e05452e37629dcc712555d39
-
SHA512
5a21dc1548a7906c5f1a2151dff6714494bd91fafba2843ba6802ebfd341ded12a1571c06d47481c4b29a07be21d5dc00c967ffcab1459dffd97bee791a3db54
-
SSDEEP
384:aG0Kf86VBphqhhLIo8Pw9U719S69BMGZd2mdelqEhJ:d0KfvphChLIT7DNTMG/qLJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425020100" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c6f2cf967d37cb6c988f57eeaf19f22f6de27911f1965bba6486bf224d49e22d000000000e8000000002000020000000a4bc426806b14807a4a589bc1aced1b5dbb1ac5ca240c8d23d613d611c3ad047200000000cbd1e829270d6a712367d9f29fff7b297e118e390e2ff52d6d0109e9cce301a400000004db5031e7fee3211387de5576ef878f528f2d13f2cb431ea86aec942d69c0e631831eb85b2715c9ee51022db68414309838be13b777900229d41c5f8d957aae6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1F5DC11-2EBE-11EF-B98D-FE0070C7CB2B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a32c99cbc2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000cc76135f0a3919df494b0c0861dcb5223de6558f826d28041b044e044588f078000000000e8000000002000020000000fa0aa487297048d0ae9810ea2a01ae421727d989013d3c986a50bfedfd0e9450900000008a2e88b4365207d9d70b4e865a0bb4527cf056e20b3c81d95ff8640a4470930e0c2d253072f6899f8f7fab2a87ba29e18e40374a5c9aadd7750303f6f01b8d34a98218d92a6dd5b0bdc6ae2e0f587a1b5bcaa4a49e1236d1f3dc4d0dd07efa9760c201854f9abb8f94442ea6765433f7530d09ce43e2109ce2bbef8127d62b3513d8b20f7f66ce8d4b4561d84db7d6914000000009f811a2a208671973e43af02cec2f8ae846846dfe17bfb831627c028d6205b0ee1a119f281d772a811407ed7e98b445f1ae87d7841a78614d9b23463e7309be iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE 2996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2996 2208 iexplore.exe 28 PID 2208 wrote to memory of 2996 2208 iexplore.exe 28 PID 2208 wrote to memory of 2996 2208 iexplore.exe 28 PID 2208 wrote to memory of 2996 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02da865df84100bc5431345c382ed290_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5af06e53544591eb45533b668e85bf15a
SHA16150a8c4ed5cf3f2c28da86ecc536b980406fc6f
SHA25671c16ba185fafde430739bfc381a41f2a61cb538c7b9168e93afe8524ba0b547
SHA512798c179efa9f90f6d387b5545290af23e8e889a5d964cb76fc4e66d65db36f6f5af742016f6cbe6b481cfed2ff25e266ff615dae59f69aa0cd77e834c9ccda28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58de298c775e3e0ba687f0e4e636e0dd6
SHA10bf2b457413eb5be0ad7cee0489748b38b7299c5
SHA2561c49fbcf5bd795e9e9bbeea724c72590dd0f1c3487ef5964d474826fadb02d46
SHA5127ee65050e0583f87e93fba852df5ee274c3bbd65286bc166ccf7c4b1fddafe0aa6fc4738b97b41da6df3eec64415053df62da1f4d3f44a2de49cd793e844e5e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e4b14761a68eb6e72237085eab200aa
SHA112499cd7a8ff096aff5e675e9423005ece650528
SHA2566ab9b022abbeaa3be6d1ff9ef32980d66ad0f0a3a6a2b17e4b02b0595dcf661f
SHA5128793ab7cc31c617b1954f76d750f6f95629d92544122bc83b4bc2453070901a824438fe27e6daa825e4ddc3adc5e406b41bb14dad04fca722bace6142e17dac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f51c0916823053608fc38295fafedace
SHA11284c3eceb8bd5c43679810801ff44c0e1e8f196
SHA25625547e7fd60565dd05fba623201226ff1a63b41e785e792c18ff30e743943d3e
SHA51299ec3410dca529594c841fc05c499163c3b53d4b7962dcc164faa402684e2e1b4e847395772e913d145ea8ac317740d00c3c0381aedaf5831f53007643fea0c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b8e15d04fc2ed48a67a49da8680d601
SHA1d998ff8a8923123e2af572395fc48efc25b1ca55
SHA256f40f6362131d220c2459ed186eed037cece85287397e84303105e8f1b3ea58bc
SHA512734f9aad560df548df6495d6935423a98ded88444b1ab191938faecb8050c52a2c18428e707233808f98e3238aebf5cd5967cfea631bfe57c0cde1519340da1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f26463496c6e4ffc417c7087f7ed0d4
SHA125b394b9b8c77d875002d8347ded618d92043d08
SHA2569abe648083d944cc7ba7e7533138b6f46ca271c6daa8ae76043040fad0aa3525
SHA512ebc6c23acd91d1f91159b96f5c979eb3ad669a7d05e5be1cf829a51fd996a01adadf12ad40f63260a60f3dbdf3646536d45b466e21ef9db8e9dc780a0a512a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567966f4e2d7030f39b87965bb55b44a5
SHA154b84110ebdc2c9e8f25b2c8ff74b94c09883e9d
SHA2568c390767e9eb6a172443b730c2d3c991444d738d29e95e0352f80816505a9b1b
SHA512bd79b7bed6feccba031605c283a7975470b6896115c9df2643cec54593be8f7ea7c5bd7d9cdf8c5404e8a6ce13c4c668f16f49a8c9b8b5d1c18f47b34efeaa94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd75415511abb3c4200a4d1065f07333
SHA1e26f007930030b49e4f75831c7bb25603dbd6dfc
SHA256e3ed474214c9d61150fd904b7418d3344c1af5cdb35da3d6d41ebc0c84cd6a95
SHA512f6f52a8cf0b8487654109320d3dd9b4660503a1c2be771f5887a9fc7e29a88f7854438fa9cecc111fc99ab51b48d617b877c1084e6dfad6a45107b2f8253cc90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b13538807c9572d932dd7c91147b69d
SHA1492562487e52975158aadd0375f74a42ff414426
SHA2562b752d2b22578b17bf35393187a20177b198ac6350dd1e0f30b01d6ee4d36b98
SHA51288e9fe1a8c9461700addaf52b5fab0f29c04b65d55c84b98adebb731a0bb5075dcb22f91b8444f52f67efe5fc6c50e220f5913799c9b3ff2672ce09204cfccae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531021bf3cbfe154579e63de109e50721
SHA190caa32b18cea2b91b42494d072e90720a86a81c
SHA256bf0bbfae799c16e443ff056a455eeb341051de9ff69ea3b563aa75efb9cd70bf
SHA512d5cfab60b580b2e4d49202f627c0509244d153e7b4f623d26167bd6090e67fd9e6cfc9177d526697a46d38c10d0382e8913a3bb7318cc98510854a58657fad0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b81a09bfac08c80a019196a0012fa8
SHA1884ca4426bb1db282415c201e84dd828b215c347
SHA2567c231e0d660ae7402ba084cf3dee6e2949ed528be25eb078fdcfeb47b6131719
SHA512f33ef540cffe328cf24571f174dc6500c887319008f118040b358e8ef84e48430ed0fa991bb93addb55539d11088c37e8d12bfe29dea443453665d66a3fac449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d50e2487306f179e179633c39bfafaa2
SHA1b22609e624a8a222e195a72c230b37a226f9e4d1
SHA25699095d554664c64bd1f3a93e3c2870e5e287fa76f7178636bd7f6f59b9faecad
SHA512afe7eeda18706889d9e731cd002b41718a8f16405b8b3cc1c1bdc1c017d0cb4772eeced9c6d4fca692a67bcee93beac8f7961444dfda70af63bb0150b54bb32a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d0de6a3d80ea399ee449413ef712c16
SHA1e8a2402e9a9226341cbd4217893c68fcfdf140b5
SHA256a11fef45d89295569e8e80364fffb52b01f1d0d8cdbd8fe99642595782ae1183
SHA512d4a67ab1b2bb7d33e83c98a6f2a1d2e6da10396667c6c7045e167d696618ee11c8150769d6921ba674159b0f60b093c4be602282b27fff1326293385e0c233d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bf30dfcaeade553e80eb50fba5fe8d5
SHA1fbc40ed5eea46d5237c58c41b354315bda258587
SHA256b426de908d849d5e518c2e43cbda7b797f112fd5322ddcf441e897a043475dac
SHA512757ea4a11970dfc57798b071eaf924ef89005701cddaaaee4519da82094e39c47fac686909e277740d51e4826709f9c08c76a296c35e9a1d1fb2eb542293e8c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5330b1155f44d06aa023dbbe49a29f0e3
SHA12b1490094958ef9187115a037811efacc1b78002
SHA256b3536b4c3a3f453af65f44ee6a06e8672e44b5f70294f912629ae27ae3f3e859
SHA512322a791ccd02dc9f218ad5340f1c382a87743312ff7feac8025495ece52e17a5f6ef7b6e3b4ef46103a4d35178a20d805b905cc763e461a5315a44a16d9e1124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0291543741be2c02734a640634a3eb5
SHA14c928e4e4abb1e102b7bcc3a4fc6fa65ca718660
SHA2561814075f50519b6cf6f3ecf4e677a20c6ae43da02cb4c0833c98483b85ec6171
SHA512e8175a0a9787d31ef7f42e069e25539cd5d31b417e7fbef3e5dfe68fdd14b7b2465ac6a018045cebb1ac2942df202eeb492478866a8dc81e2ab30b7a39452c68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5053c16f9d6fcf98eca0d61e941e43108
SHA199bf0b540609a1fa12e8fcb222df5af6aaf91361
SHA25606698b14a8c0d272c3763532e25eff06bbb336d57b7e5efa1a68d1ea7c48fd89
SHA512b36249971156c750c904fa8ad122bb349868725c3d641fab60809a7ef5889807c8396b97bd561f2652a17d9bb6c11b56e790210dc958d3f4df174403e23cdca2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\post[1].htm
Filesize162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b