Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 21:55
Static task
static1
Behavioral task
behavioral1
Sample
0fabb11e5524c822b7317da6ea86b908_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0fabb11e5524c822b7317da6ea86b908_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
0fabb11e5524c822b7317da6ea86b908_JaffaCakes118.html
-
Size
1KB
-
MD5
0fabb11e5524c822b7317da6ea86b908
-
SHA1
d2d62050210bd83286fe9e00776411a57137d740
-
SHA256
3ca2a03ccb70bfab1fe66885a236036857acf0015ff06d2f4bcee0b124ab93de
-
SHA512
6ede714e1325fe606c416ade3bfa7888600182fe4ba54277d6993e75de8977518503810cd7e88de368550559b351986b8efa9b3266ceadfe797d75f71eaa41fe
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425514372" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000004a3ec16e40808daea600f48f484757a4bc13f67ee281c28791b0ca434fe4e490000000000e8000000002000020000000bcf9f481e7d0be88425e1a602d06c2a432d7ed9226acde7755c49c09760673e790000000d1b6a199c2792a83e57134b59db311b3060f4cf9f21d9f9fb621b30b398defaa57f0b090c7cbe8d3f888945e1a6b04003676961fa9fe4016065dc84af2c3b05a21adacdf0a51093bd3ac6646df89aac17e7a2b9e62303ff3f59b70acb2ddf6c9c3bee51c2a43e2fe47bd1c5d2a8b503c1b1a5ac71f6c82d5971b723b3cd5d8eb92c255de7c05b81790041542821ec1e340000000bcd1c48700fb3639ee84d04e29ff64d5eb85b8228f9373558101f99eb3e2c6aedd1eb6c220756dc70e1f447cad2ef32e65593f60d12814e1d6efe262f2a9cabc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000004682fcbc97818bcd86ce4335946fbcd27fcc32d94a4ba8178e800ac0d364010f000000000e8000000002000020000000fc2af6c8a974d8e7e2c44d216c9f7622375baa0a38dd5eb981185e9d35dfd5302000000087d29ffe166b193b2494ea4505f38499c1d596e4d49780b78b82ac586f008a06400000006229c8f4884fe1013ad6f386de96a6374fb79b35cbd76262cdac90a3a84a1c15395f52ddd101144d140398991967da9869fe4c593770b69bd61a67af5632654a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0fb079b4ac7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94235D71-333D-11EF-A05A-CE80800B5EC6} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 iexplore.exe 2336 iexplore.exe 2288 IEXPLORE.EXE 2288 IEXPLORE.EXE 2288 IEXPLORE.EXE 2288 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2288 2336 iexplore.exe 28 PID 2336 wrote to memory of 2288 2336 iexplore.exe 28 PID 2336 wrote to memory of 2288 2336 iexplore.exe 28 PID 2336 wrote to memory of 2288 2336 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fabb11e5524c822b7317da6ea86b908_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c619697ea9e458180d79c79ba837a449
SHA1f886d1f9eb8161654f3bc7d1b85f5196bfbb17b6
SHA256e7693869dbf987158e734c0c22ee03264c1ce58eeca9e0cedf369452bb7e0c0f
SHA5122f948426c0c0ca03f22d47bdcbaa3db7632b96c7a09f3627d406c27907e7730472a3ecba963f4888439c639202a0b7ede02fd862f11effa2690494fffcc0a348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c16be76da08b33a10f698b370d1b521d
SHA144dbdced35991e9010cf4a64ef132bdb83c617bd
SHA256e7ab4c3be59aac812b677bcaf4b2db98cef03e7e433f9230a5074760bb8dc778
SHA512bf99aa15ab4ca1953e00faeaeaf509755dc96b0f7f99490f4c1222d5d55275f521317caf2177903cd9c45f3f2f5c3ce0febd3e48af58a26bb07ca6f86bb4aa48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b44bb6b30da4244c2dd124ceeb5d1c94
SHA1b460c997dd79663bad42162bbb8f6f8a7b5364d5
SHA256bf235b4267432145a0763aad11943a52beb02ca315b13b4d93725acdd891f94a
SHA512454208fe8dfe53ac60601c0dbe47730522d4c62ca4458b9b768e494e94176a59de219afc37cab6e277282e9d403983bb74dd25b89d4255b6e5fe47e576fcf11a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561d82f522e1c564abcd9de4214f749a2
SHA1ede0775fbfa92a8c5418ccf28b92510ecab4f6af
SHA256f657c4114f84da57d53def7f5947029f4995be2f24225fccac2fa84026a4ae50
SHA512cdbda69ba4abf97996fda866469eb6a47809ccba2ac9444bfccb6fc1914fd80d77e49c10cc2c4ef7bf0ff4d8f9384c046238e15299850849c57bb28ac36ad5d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537b89732909cc386fac9b568b79c90bf
SHA14155eebb0b1d6c6af8d0638f593bd47f6e13bdab
SHA256627555f7e6b8136152868cf09d153bad90c66a9f64a56db5c2a52eb7444c54b5
SHA512946f9884d0eb1d5fd8dfad7989dc1cf9c61f828253a3b618136ba79efc853daacae35d753e6c87dbf2d29417ce6597c16f7dc493047a17ecbbbbfcb1b6f4f4fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520e13d7b36f6421edb666376a59aca35
SHA1818529ceb51d52da2460d30dd7508f8972da514a
SHA2565262e574b4511003ae3044405092c8c4cc38f906d094fae1603eae08b340e803
SHA512d257cb39fc3da42e4d1aa91422d8f4a40843df918ff2b092a87fd654300e778f82183db20e838ed1bf37ffea11b401554cbee3b57472270f13d53c69a9e56e74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff20e4cdcc92838ffafd60c61d6f00fb
SHA1afb5d065be117fab601de191860476e86baa61d7
SHA256d0772175eaa6d83c6c637c6b6a67ff02ded32574bf68bd4d8f5b63ca6d4faa86
SHA512c3442cd76db773352ea90d4b845463372b2b49022f9c9a8d9a85642e908c3d2d1f50da287310957ff9733571a9916da49120a6ee442ca69ca95cecf7df1c5e57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5894fc3bd83005f93ddda6944b41397c0
SHA1004b4c5f432a1cd931a39774cb89881c91ea3035
SHA256a1239cb5a009897b1f6a4ea8570c9c41d465b116975808fb690a20b07a724317
SHA51267efad8d37ad32fb2ea591e504d36f64baec94fa88fd97234d105d864f4d8aac6a1cc9c68e005b287a98567daa41034ad829012c6774d69a6907096d20cf76e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572e4ef24b1b1db30105511a44f6d5062
SHA18606fae2d9d9e3433cbf71265bf79196acce16d3
SHA2565df50d5f7b3c92680b6d24b3497452b5a80dbfb055e1b2c3cc34671cc531f670
SHA51202bb9b309ee48ffa9e5474140f52525548c226a8542ea7b83c2f0ac0b07cd874bdb1a441cbb86928ce7be33a4729e8814fe2c298e8c8cfb372b4bff07853fd9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fbd68c1449bc712d91b8e37fb14767a
SHA1f699e2beb5a5dd78d1aa8329af157e84d611337c
SHA256b04894a4a2d7ff6e515120b621c17d82b720400268c8749e08d78179723783f2
SHA512b369cddd36373ab2e2f167c41f6f3bdfa73e01e3ef959d8e8908deaa0544efccdf8982ac813f63b8d8de1a49551d584f6b97fac236ffde4907c7c1d6ec20a91b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5017a4516c7c277c09c6e6e0cfcee84d9
SHA1ed8baee74000f9ec3a4f061f7091295250672245
SHA256515ba2445a30eba21dc1805d6fd9a4690b8ddbf46c4c27a34323ed8c6af019e3
SHA5126929cf8913d509cef08e4995e55d8a58561efc7a12fc186215fcf5a562b347615d19177bee518d62ebb319f925fc7aafcc86914e06a2d64383471c6a3561c348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f592914b5bb5375c18e039b05fbfd135
SHA1951a6d647edc6723556830ad06ed241326527c13
SHA256d63704c2c406ed2b2542f0c4ce5fd0d1768817402da84533471c210e381bce43
SHA5122a405f5ebb00293d014df303a7227f98ace1420193c4362db635f13dbb416c3ddcfc569fe5f510d4448022084ddf36e15ec6e7d3e2af8a8c3e39dc5b6097f43a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5202e13d564a71281eefa5c8bc7d47bf3
SHA199ad6950174b8bdd1e81f3cfd1a2b8e6184c2560
SHA2566f92fff10b201e7c492a6a2f51f466fde9c6becb165d0e1be30706d7aff3050a
SHA5121d7fd96e30c094ec95c007cb47ecd60b5d936ec757ffacd39be00de972c61066d258b2263de0cd8b862bba91f86cc014a5ae07bcc52c5201718fef92b8653e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512a6e0dfee00146a0f9a6a8699b7ff68
SHA10a447abc46bdae242a7f2f489226741059428195
SHA2568d08706969ac0caa46d603d74789dc3be2b6b380b683e428dfdc23b7ee6c3a3a
SHA51251193b7a623a254c2d24ff6c436770225650608d96d2fdd281dba911425d0267fb2b732ffd2617728f6a3c4f853dc6f03327ea0e873c802d8f0ee96e443bd20c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5af10522dc0124620813f231912b300
SHA12bb7d5218b6c9ee1a66674287e8a434ae0c64cf0
SHA256a662fb3b4db31143ea616b5cfccea4d6811a07187283f461ea0e1b3f8415604e
SHA5121de32c11028476a925792993e75c9caa50482a78d9ed2f7eccae51ebbfc0cc6c64849a207ade12e701836657bff960d0b3f0581754717bfbc06f98272a8fe1fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570e0c7f04c43163dfc6fe7e772f7b012
SHA10ce5354abffe2e4388886cab567e1d69e9ec66d6
SHA25614f39391320b025ffdd8c518b79a1bd416bc2406f93daccdc26671dfce25e1b4
SHA512e91123eb90fc915858db91eb16351be04a5830b44c9dd8517e0ab25c33c1b0ed4b2ff54c2c580ed84cb9b2aa9c68f5e88791b57c934de3c085b13204849382f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e31a7abae97add7a6c5738467d9fabd
SHA131aa4feb305b434275d62046bdecc44b51b18199
SHA25636d5f7941d38574a617862cbf19e75cd4bafa5112b1d328b5d3ec9386d079ad8
SHA512c3f5a6d43f0948139a06e3bac532ed972465f4718790897377e4627ab0e586e3174f38dcffc6aea5df6ecc46ee7975f946e35dcedf65f585d0865e4fe6c17b77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5157915ac0ed429e7957e383a71f25a6a
SHA1a6837d8adbbabcf6531c2b803fb5c31eb87fc705
SHA256981776cd47ed7c82b43bbaf191524fe65173dc1488150deefb4b486c7b437378
SHA512b398c3ccf3a391e2464567d002bcc68091e45d8a535bb610c6b3589f6cd5b17b5dbb0ae64e38bff216f9522fdbc1d88c75d6e69198412b77c3e817daff8cfc18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5521aba169ef56ff9b3b3bc74c84b3947
SHA1f7eb76f0b91365f517ef07b5901ba4e2ca8e1889
SHA2569fa077a20ac7bdf487fffa4ef0478c9a1e06dfd7cef81d1c0895a736518e2bd7
SHA512d2d9c50716f498c1dbf3384077765f03de28a3aa4fc5749270aafb6ecc56454eade4ac337e48cfbefc354dd90347cdfe33f7960c859cc6360473dad0e8f1dcfd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b