Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
072945a462986b3fa288f4aa2d9e7ed5_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
072945a462986b3fa288f4aa2d9e7ed5_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
072945a462986b3fa288f4aa2d9e7ed5_JaffaCakes118.html
-
Size
90KB
-
MD5
072945a462986b3fa288f4aa2d9e7ed5
-
SHA1
9a8979126294f00c5e6b192543655483c3776dcf
-
SHA256
2c13867c2a13f59f5498e1914c8c645220acd4290dc496b11908244955dff21b
-
SHA512
8c95ac282a8e06143454074d4b4d31cda80a3e338310481134a04f7b9f9060913d8333f4a451e41a3e2d87c7ffa6d513188038f69dd9a9452c6f5f98b4d02ef7
-
SSDEEP
1536:Ma84dht4xTwQ1DZy4HZOC3zSo6GhHZX6gBr+EfZQvDnRa:E1/D6uCERt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00d985507c6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F659721-31FA-11EF-B98D-FE0070C7CB2B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000210f8b8acf4ab011db4c25b3b8e22c42cfa1be61dd2eea808c71ddaa47fa675b000000000e8000000002000020000000891e9a6fa8524c100f99f28b9f3583ae29a2c84b6bfe969020052ae15e725a3f90000000046e64ef0f049a51c80a6f0aac08b61c59fbfae6e61f6e9d6d75868a23be26d12599f5135f23ef711d1c4c2172e8c0f135b7723e0c26eb6fee0bc10ff254092b3371a2911aff218d6f52aa0a897f5639a2d405e3dc2d44c2e31ca103d1633c969515145da349be2a050e6f0bfc2fb7915810a3cc029fa8b208104cac3f215b8191c3e1e6cf1822a75c15b27e3dedba0240000000c505c7c904537093074853f9fd8c778ac4c8d3fd95ef4b13b225f889d09529381d8e5a99ca01e2e4499fcfe5f3e53e6616f1d6e29a8f99a9322bc0778435503f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425375612" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b82303bf85be4d2ca072aa4527d92901286cd7276668be2f9e0c8286ba689e2d000000000e8000000002000020000000aae1ea0ef64b32062a48a9c439b89a650e0e32bd416349e9e67d285bcc59b2c52000000089b15d4799fe35d64864afef2980f5d8b1cb2acb9d3e7275d024ebbb06596c3e400000009de6f9f933e59a145b2ecb9c6eac078c6673d9d44e2f14e27b7224a517f54b98cf5da51feee2430ada310ba4e24e79a21f38a40139948766158336cab6cd37a6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2908 2208 iexplore.exe 28 PID 2208 wrote to memory of 2908 2208 iexplore.exe 28 PID 2208 wrote to memory of 2908 2208 iexplore.exe 28 PID 2208 wrote to memory of 2908 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\072945a462986b3fa288f4aa2d9e7ed5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b831df33cfd31d1fb8ab6d439bcf79e0
SHA1e1084453f9bf92cca0f1206ca6dfe927d1beb998
SHA25625c562d213f90f6bd2b6e3e0179002e686d0ba8d38f425a84d5a28d1aa3a1bc8
SHA512ba842130f148ad469038ce5c86a0b363e96a95cb6f37eff3709cf3e8aad58d108f0f71f443366abc5f1133f5080e421540c5b156a9694abe04c6024b96517a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f242b3e50667e07861de6fdb2a1c005a
SHA15904414e4d4a94f2c242de969b452906382f83a1
SHA2563b1516ff6d2b001b2f64a6ee024934649823114b8423cad961a5473d11e41229
SHA51224e2933998050fbb3b0050ca0c70b0e37bd572a63bf6217b2662d7ee0435a71f0830385bae402a4e62fa4dde2b7b66cd7ee1f8b6f6a60446aee60f30b8269d5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ceff9d0efcc52c67aa367a3aea4b4df
SHA151132b4ffa4224af4fef4f2cf2248ceed58f22b6
SHA256a11634c9670ffe94d80e0dd21f13abed598df3722b23ab7fd38852f390ffaa61
SHA5123f4c2c83e80db7ab1b68a29951e89a2f42c4d814faab643ea00c31aa84bbe30a6247fd4254d907491b083e1ced9c5a0f731722caf6ba95234e3239dea0a6255e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58953331a8b461e4bf63acdb3a3abfb74
SHA1397d65a2f3ec8d990caa2a782cb7c00bb4ed09fc
SHA256d93096b40452ae518bf70acc8ed53f654d8584ef9be969f783185730e43b77db
SHA51204c10ca62a3a2b7181b3d1ebb7c18bd8c0590542d4230281889b5eaca916aa1cb181054ac18ad8230edd33e34decc70bfa04a6f13389d1d75aae8709efa99b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536c19b3558b355151e7680cb4a3b2afe
SHA1f4d391a55669ad0c0a7085a5b949f96785fc25a0
SHA256adf5f66448356ee499b2543639c7e2fe0482e482465191c35a6a523e7686bfaf
SHA51228d89393aa6d9feaf00217694313eaba928034665ed4e1650bddfae06728f21bd2bff5eafc05d8015a91a6071606ebc49afe510c42870239266ffce8f89e7210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c912d99e5587359e2eacdddaea97c2b4
SHA1baf9546b6f5a16218c986a47046f578c2b6ea2fc
SHA2568d9d032bc3184867508b89140ef487c4532f8dab1950755e87d1f8bb41784fd3
SHA512c3600482a3f282bb70bbb873e2311369b7df997411dde5411e3b277cbd19372fb8ad7c389c14630dd4c9e158119a3c2072fe014edee68e13719c4ea0b23fb0de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591577e4cc704b0086a85c3733e81ae88
SHA11c242e53dec68fca32e1321ccff8096b5d869be6
SHA25605476ec946d242e396504ce721dc992a12d9eed688bda547f0a2a9e2c9563cab
SHA512aa948a8f255c6500e06de1b1e36f8ff3be6aacf15391f0f674d22b7d2432424fd28cd4700dca7c8367a0f6746caa25e6202cb16cda3706e3e8900933ac434fcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585a07fc5d9f74b71576620c2e58f6ef5
SHA1840d971ace7b07eccf14236c853581a8329c24b6
SHA2569bfe3fd110650a7f625600c1a0ee5d64cbdbe234b555c882c6cc3421ebee0438
SHA512990747e68ddfc7f0b315c6f724615012dc0f6e9550cbfb44ecab63edee6f53598813a84ff0c02fcaddbd68198cc02546117b75d03b6d71cbfacf10b0cc9bedcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510a634500b9d1f7c5345ae38f3a218d6
SHA1b895989a74a1d3dcce9be5119de94442f86ec812
SHA256ac84d398ae2c01b227f251f7843d2a6353735ee17231efdceb36a4e7d7f7b97f
SHA512ac89963b10f5ed14b86b54adb02d7ad60293b93237a5d975c56f961471fb71394ecb2e37892aae23fd796b261f794abcaab11c746cc4cd4f4e48438d2ca9b30b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aedacdf14d976415365675a2f08c3610
SHA1980993dd09feaf7ebc40d208add1a736b3462a78
SHA256378d97f9320bdefff5cd118f2f590033c5fed92d9306b481cec0703032243784
SHA5124b94e0f6a2547619632dfaaf8ba8343108b9de4ab9566eedab807f4ba47c6a085fe6c2327ab27a9446228af635c1133d2d75fcdc50b63da8abaa70f43f30aeb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d092c72266f5fc812c5da3723070c723
SHA11691673845939c59f6ab803ef95918e4a8644eb0
SHA256bf90dc19a94b3eb76b64d8b635bf5cbd0f4b9cb937c7a012e8213795a2cd6fe4
SHA512205f00940f5828c07fb6c92bf6a8a2ecf238c0388929575aee193522552bbe5ddb2bbf72028b33e7fa098a8fcc83fc05e0397bba0a5c0c1af65dafecedfbcddb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542c025289f413fe3b2d940c02a4c1f96
SHA18977bf49ee003283f7d0d69b3930facd80f697d1
SHA256c26676d40e6359103e200e30536d9d4a043c1e72bef69a14c5f4b6112883aedd
SHA51221b5497621afc1cbd3468c0c249ac8b70a85eb177f2a7f8a4fe8017c29666b440169804855047a15d71dea7e33ff049e7f4f564db3bb8ff11a9335f198a26122
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc2d2ac2c9fd010358ec0ecf726f66fc
SHA1b17927b1bef12c6f84d3a040b0365efd539a89bf
SHA2561513ad09bbb45e3edf89192e8c20876a085fd2d87c800666859125016678e4a0
SHA512ee5a267c2bf171dec643c3bb93c3f6b9466f9c352b1b572ce6a17964a1cf5dce554d4bac7697a43a234a60cc90ee5fdea7ad472be4fbc4e9c2497c981aed22da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb7b0b8181a0c6372505472e3b112d82
SHA189f8814a397fca493b5ded7d393bba118efc7316
SHA2561b0f31195d78e04c74b39888f1da747d20a75ae14408d6939c62cef1d810c4f4
SHA5126e0e3c813bb5ccf86be6512049445f683fdf79080e9754bf0fcaccefe9e3980afef20571d45c8f4eef670ae5398540955d4d70e1e9013664f2a4d907feb7e6b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5fb3d2118b279850afbeb5962c7e569
SHA118ad90af5bbb91e79eea0d632b5b5971f41e210a
SHA2564bf7027e937947235b5bab8a0ef13f24763ad5c893b4ae3c62e50256482cc67a
SHA5122d64ad1d6d8dba49109c85195ec16b5bbbe4d8ef4de31b2e4f9ded0cf0fd46cfbf83d02fe1abd27f2de704593d548d79969ea0f5c22fe5594c0ff37ac7ef4a6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54939dad50fe50f5a8bff792418b2ee0d
SHA1fc0cc53fd892926b5af774a24aed290cdbf6c4f0
SHA256607f734c497afec6c59ca516adece4782f70141b7ff56c52bffba7299dfa69f0
SHA512bd6a513e0f288508664196160684d60cc881b1fcd8f19fa3f58fe3cc83e6a86a89e338fe60c27041acb4b61c42a5ddf8f40f2595a2e65f8cab2885730ebef8dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532370930573a3337e1f9568a3ea66a79
SHA1e68ae7f25e8855cb4b6f9e464dc425b53c9adf35
SHA256b3479e7a137dd7d77563d3271ae5b0358bd3f47f50eeab244cb886ff9f11adf1
SHA512be9700cf322c846b285a1cd2b73a4e73a6ee00e5c3dd9718b439229fccf69991b1b43ff406acee7a986991ea2d6191437c1c4b7e128590fe03965396b3516c18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a122dc3435cade8fd6c1fd39587acf64
SHA10730bb8e7467e4183da4caad360b9ae9380c4fc8
SHA25681aa21715f6ec50910555fb2e1c9eedc355a1daece489e59ff1a6aa3065d8955
SHA512e64699bc91adacc07d49fe5f9d61253b63b4aede075bcd2afb28b6ae5c470ba480d53718615c687e1fec3fbb0bd093618a3e56e5a1a2a9b3068691b5138b7ae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d654322067c69c2fbd5d66a07d727e9
SHA1803c257b250d55dcb01cc50798b88458db9524de
SHA256c05b27d2efc5c39b5274bc28bc14f7c1a5188b001e96bc9571eb8254b2791aa1
SHA5123af2c00a21cfabf1b14d70505d63c2c8117a60d8e09d2709915e43a7741e7d9db3b99f91fae78017eb851ed1ad06289da7f13911069f00e4d3db40601be6cb7d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b