Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 23:52
Static task
static1
Behavioral task
behavioral1
Sample
0ffd5195d56189e26c34c4493d9b09f8_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0ffd5195d56189e26c34c4493d9b09f8_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
0ffd5195d56189e26c34c4493d9b09f8_JaffaCakes118.html
-
Size
1KB
-
MD5
0ffd5195d56189e26c34c4493d9b09f8
-
SHA1
1e72ac6579d9fb187b826928efec19ad0cd620ee
-
SHA256
97bea6f25b552265607db2230013af5eeecda0478b3a2213ef9c7e442b4f28ea
-
SHA512
890d40117f1f625fd1cbafa45b974c8d2ffcb60f44b689a8fe0b33900142526588ba87649d312f14b93711fefca26dd9e256732cb795ed4b1b8044bcd3f1deb5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000bf1b42b93e1f07909077620d6a2213c6e92f10ba5d80f47fdffa70ecdafe7804000000000e8000000002000020000000664fd3d7d4ff7aac3747d215e8a48a6ae3b4bbda9eff7645221e91e44741c8579000000027691c21f8eed5e39fefe8b8663712a36d56d6d08269f1db1766ff68ea7396f7d01b756dd383471cc6e6d13e5f7c17f46d9132ff0cb2c027ae85b7cd086be0ff53dea35f4b521433b18f7958e2ff5338207ea0cef7e5931ba3c01fbcfc1ca7f1a4f7c958f367ae843c25312ee1ac9d17c650a4254100ad040dd1d192c966845f8fbc45699bed521f2eec48382dfd11a7400000001e04b6c582dbe018addaa7b1a81c56e8a58cb43b40053c41fe4069c0bf708867a06339b8c3d4d76256cedb8bc6d19b24cb882e18fe7ed18d12ec7caf7ffae738 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09ce6c55ac7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F13CF101-334D-11EF-B477-E6415F422194} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000017288b117a914415a9aac41c11cbebab2ceceace3320aa2b9cb5bf2bcef0fa8000000000e80000000020000200000009ec07444e1ff874d86dad1440a848850e21c2287b488113da3f56e67a8eaf7c0200000005ffcf70ff84689d4c620a07c3c6d335de2b24477e696fbdc85d060441d4198ce400000002a5196e9483fdcea36ed980a724f5267d292eb58cd61e1c52843a13ad71916269a7e2fbbbb7da80d165f2b1023831643904172d987245af3de07d0dd5538c50f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425521400" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2340 2108 iexplore.exe 28 PID 2108 wrote to memory of 2340 2108 iexplore.exe 28 PID 2108 wrote to memory of 2340 2108 iexplore.exe 28 PID 2108 wrote to memory of 2340 2108 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ffd5195d56189e26c34c4493d9b09f8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd23d264b5c6dd23e48546680a22fc4a
SHA15d76d0714d4ddaa8561d336ba97c668c778685a0
SHA256fc9e64923a94ae335b0bdd2d6ffc9990508cdaad2ed148c07f0539d276bd2b28
SHA51213f17e714f4558d87caebb8f93b5f242530d1a45007f12b73428fcffa405ce1ecd82a941069919376710e818834795cc2a8ce7eb89580c3cda2ddd8376e4abb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0791517f5385df0428e860a507e7951
SHA1a1b907dedbb7ebeb9ef361c93abc05a519145ec9
SHA256244bc0a060b338aae5d45d7c9448bf4481bb5b39175a8ca5ca36747bf5ae2ac3
SHA512f002d6d8e19b436c58414078b47d5fb6dc69067450957190efa33def977b4f2664a0bb6a378046a53afa25d3fa6747b4e9f8740cf52ef7b925567e4c6bab8a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511b656eb82b59ca039f8e5d1e82bb23c
SHA1f154ae524e6c551e4c2b53a239967e1de1497bcf
SHA2564f888ad72a48424da655ebb343e444c9b80fcab13fb31f31abc46d288753da59
SHA512ffba805cea07eaf10cf28f91544474a6c56c3b63dc87518fc732eb5b6dfe2584791e63a6f654697753853797693929868384e663654f443a56be8414eab402ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5584b519856823c9812c480f1b36c7c16
SHA1f9e526464e0a3a859b727813dedad955a7ae543d
SHA256dd235fc87033fca630d74a7d5687cb5790a393c393c0383c68f78b10f087c52e
SHA51210f0928c55a2de347810a93cdbb474d4c60e81df0664ec127dfc91fc7a1f6e3fe10fa2bf1f0e0aa13b3ec3fc05ff9df5636ff33344f164a5275d2c1baf5a3b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51617a67e4e882e8191336a6b497b2503
SHA18384387af4bb8a250319ba4644e91a63e69ece2d
SHA2568e4cb405bb2d9a820d8738e43a37cf1779642ac73432b8a1371f68a3453fdb05
SHA51211bdeb7054a1af5c2644f75e969e3668310fec5a1036119e85776d4a4935dcc9b33f3c1f06c4c4aed1f1224e0fbad5c24181b17cb095c6291a75df58a18fced8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58de1f321b2d8316c21713cfca48bdfe5
SHA1a6a056548c56918e3a3231c7d648c2e8bc70df42
SHA256d35678bd6b96d250e34425e584c57b5aa490e0436c684d592855a767cff7cf66
SHA5122ec241b9f6857ef1f0e9b6b71ac6876e169bf866c5377f1e988e52161b34a12d3702601609c106ca70b846d6740fc2cb68a30cbf23d448d7451dbd1342c94728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb11df225b16c685ace2c7345c0235be
SHA12505724d9a34c0b2e495f1042d84dcfea2f263c1
SHA25658f69123be60162eab724db7b0766b7917d814131747e41106ef148f5f08ce5a
SHA51291e048092876605119306f06790fe21b4eef77b8fcfeb27d251785b37f7122adbebefcac1d4c85c296c0af034dfa01b758e52adf5ce0c426f8121d05255d1d51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be108b68425a5a15b1b6b5cfe11d1668
SHA18c0c03377182cf7d917c716ad367c2ff017ae4f8
SHA256cc0c9c50cbc18655ef1b440820288bc01a89e93433b5ef147b5cfc62c4ecfc41
SHA512e78b04041ec0beda614eb982e1a25a77897ca5a73ffc9d13012a08331f82304f5b41c424177622735eb4992150534ff142e6fc32a5ca74588ae740e09cc827bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57176b6e7b2dc2d7d29d663b5d3e296f4
SHA17da84eae5daa754d014218f8c79af55c82057f13
SHA2565437d3375b1a1050de0eb5d3748062565fe59b4e99080f6d1a30f58ee4bf02d7
SHA512ee1a048ec521251aba60196dfbcf0a76a220c1dabdfa6810c984e15b129c3e8af4c7150a48fb346edb0e8ddb5894d2fa832ffaae7294bd042ea17ce30a6b5d72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b50a7a94acdaa907961d54062a3f80a
SHA1dd9f1c6f9778b6dbc539e47228cdb608f44614ff
SHA256d27762c1e6d3a7ddd9693d8645003eaf8e6f3b70fa9ef67e2427bb7a1c9209ae
SHA51229b1138de2cf67a80a6a7eb4fc46da03614696ab1516e5c0a81976dc33ece88eee08f5a5c1c032643074b1caf9e736381a8d06a1428b171a72ba9aa4869da8cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4eab0fd0f7b1cd5109a25afc5406dfd
SHA19ab451af262b4a494c257325a3052cc2682c42e7
SHA2567483b2c3f4408f7e9299300463b13ebbf1de22ec57d67c58cea9e042a22b03bc
SHA512bf8049f086a633465fbba532cc8497b9cc94f37cb0159050f76c7772cd604cecea63b09484626ea5b7c528d325b8f5d191e4cd9ed4bca411e061e03d4c4dea96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b27ef24c05b5a25a44431e0e3c0c9850
SHA114f966c2f1dadb116fab99bd37b5753c99c098f3
SHA2562837e799168b2a610b1ea56725a6ff71f7304c15e2cdeb331635ca3ed28405ff
SHA512437ae2f2087e403c403d71845dfb8273451fb27073897ce378d74e7eac7e6a16bbc95c57a66182ba2c4fb33db14020ac8b0cd96162e0ea48cb5b6d563c382e02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542bfd21808e9cb747c4609ebf4b498d2
SHA1fdd59f415d30b742e7ce716d49e9614f9d8a2023
SHA256bffd8d4153dd572a201d020c9a21973fe3d0f5d8cc83e4205aa474b4c95b803d
SHA512d329f81907213c417d17cd7652ded9a10ba2d1091e577199d179ac58d6684aee470a1db8ad5c67fa48abf3659093a6f1be541cd2884464afb1e27cee88635347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5ffc5eb6c6a29eb839079369b7b129c
SHA12b1904d3f2a6708f15cf7001a63aa79b8fd60121
SHA256507e64a99afe0f945772cfd9039236647191e1114095d57e3e8b84523fdc71ba
SHA512dae7cafb42ee6bf9904c06779b371739fc04dbbc0d7422438aa661465fdad347373797302bfa5627065e71b62ee76c9f75adc88303620d362a0582e174463e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fd583ac3f4ea4358b6d1b0f4efb763c
SHA1e2fd4382c6c76011c7f94c6c254d02340db6e711
SHA256012baee9e38c666a5beede605c218f140d6196d3b421933e3ff7a9095b4d87a9
SHA5129bfd1926e89c5c96dfb993825103ab41d4304d26b6529795a14a4cdc74e147e29c5adbe08210b41ae57f926fccdcc1fad016688d88b5800a32a9bef69c96b6f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e680cb986dfe629b9c215b4732eaef47
SHA10dcbfb888a2c364712d9e284fe2f3c0a908ced5b
SHA256a7110670b4a84acd77581c81c6bdc22c2f2dbd8c734a3bc24208e3816a341a4d
SHA5128ead87c5f72a0168d0214b6cf267c39e5075cebaa83042195b3ed533dad5bb79be01115f3500b39e8c91208ac0ba0996f01861b8d98fa55317fc211188d26989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c6f1415ae41e727d9caba8bfac90733
SHA193e5997217cdeec0abdf77a3ed55e643815e86bb
SHA256fd380400ce9fe0a3a70a6e4f5c08b7f57ceffae656695a553463b210b6af953e
SHA512842d3139aefe452af5f3db91abde3cadaaa0a8da6fb0162cbf21b3264af506dce3311f91b9990b78aa6e509fccec6c581375a332771c20c32baf62b0a054bfce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbddc8aad262cc6487829ea8644295fa
SHA1ea11d1accbba00998e8126bd5f680eb56c18a082
SHA256c04e7c86bc43a54305e91360310cc406c2e0916d799cfa7a5a4aa0941e87ad75
SHA51219a240d832c31f09895356939cb31428bc89f63bca8d751346599490e66af5678da77617421a0801dac94bd1690ad701a2f4bea8e224fc218450c67f168cf959
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5236cfe6af8661b7cc0d58e2ab2a463ba
SHA19c04c6b60df987ec876544a31d7d03481cda2cf0
SHA256ff0eb401ba87d31b40ba908cbd505657b0367e89aaf24ddedd242dd73afc8bf0
SHA512933dbadca504785bdc1165f535e54d28c764540593df5d2629d4d092b31d6313cf470c42f0a5d117a526b6649d73a99d4198e3ddc3effaf5d428dc1ce5d8a3c4
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b