Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 05:22
Static task
static1
Behavioral task
behavioral1
Sample
0cc2bc6f9355c56bc613b04bccbf2cb2_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0cc2bc6f9355c56bc613b04bccbf2cb2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0cc2bc6f9355c56bc613b04bccbf2cb2_JaffaCakes118.html
-
Size
162B
-
MD5
0cc2bc6f9355c56bc613b04bccbf2cb2
-
SHA1
cb93ef296de03292ac56a791b3dd20a27f333c60
-
SHA256
c4757432ee770d55cc23de7fa6e1b34f66c8ff7ed39a8e614af0d3f574996193
-
SHA512
1815141e16e5b2a4ef3ff087b935a5e83c078731049a3cb931875824eaedb050927892ea0e09e9f9e2c1621e0467df866ba735142528686cf18be7ef1952efe9
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9009a6b2bfc6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000036c35b31ce678d539d3174af168c0b84610593a831d29d97ad2a27688889f73e000000000e80000000020000200000000d2eacefcaa447006d9bcf3802d34456d9e2d4d135bbbc0ceaa922adcfa38f9420000000b1ee101d00cdd726c8d9ab2f0bc534068d0911072ab5e1ee57162fb23030ea97400000007a1562ed2933ae531c686215920d82d6264d80620177481ead9f08f96733ae5fad2f8b920d7eb5aa31a33d1bbbb4a9c9ad6b77069ef647f005d6ef38447e01df iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425454799" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE107251-32B2-11EF-8721-FEBBC6272832} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000e68553d4dfeab41f49a55a4ceaa64fd2a0c2d549201cdf6b7aa24223c2d0f88d000000000e8000000002000020000000b7a831328d95a2cbc87f5c8e5918f5da64934bbc854af5a5be29dda8b03a29e990000000c14b885ceef058edf9eec54a4b16d50d120f619b4eecb14bbdad75dd28dec3e5a87776d05e907632a80d73d1753e3b405645567af25212da981029080f5946441170dd5c63319237fc1b831c0e2264b491cdc1851d0377d06e254f4b344ad2500e87a8161e3d772bfa2117ba78616d42893b3a290d7fb7346238a25a1c634ed5a1d1e37024ad0165837ea2881153161140000000da6d765915dfc00efa138347a9b622adb9a23205cdcaa372b4cf690c8baa1cfa3151128c1a9795b7d38f6b9ce844b136c92724a38814d0ac00fbe12cd743a970 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2560 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2560 iexplore.exe 2560 iexplore.exe 884 IEXPLORE.EXE 884 IEXPLORE.EXE 884 IEXPLORE.EXE 884 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2560 wrote to memory of 884 2560 iexplore.exe 28 PID 2560 wrote to memory of 884 2560 iexplore.exe 28 PID 2560 wrote to memory of 884 2560 iexplore.exe 28 PID 2560 wrote to memory of 884 2560 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0cc2bc6f9355c56bc613b04bccbf2cb2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6c16925b7aa416de4c193a0a4993857
SHA1e570fba9b2687893ccf2630ff2e3428bfa1f2992
SHA25611fd1993cd585436914f9e70f4dd40041a6f2dddbea216e330817a3bce4ee7d3
SHA5129dad773b2ed0a44076688638698a00190d0f122ea98b9f2589964b6b8fbfb0bfab8c7cd014489fedadbcde42fec7c46aacca6d5382a3863881d0776415295346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fb8f4c75a6e9c0b44688afce0bfd04d
SHA1888bfde2e44e162231be7624a129e30cbef194dd
SHA256dcde555a59104ddd76c4a1f62d61e12cb20f28a68277d94f3a3b552fb41b5cef
SHA512c970b2bbbb61def989d6660439f188e1b92e81f502918d77d27069cb90a9f2e5220d948b3ab3520f594b9e13996647e0c1bfdd587f3122e504b4194a4561d7e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578c2a3ebad62dca15861c16fb9182cbc
SHA1f719442ed2c2ebc648b63d0ad21f0e9c4439507a
SHA256dca4daed94f3b94d1cb525b1594983ae7e44e9db5816eea28ae92746b5e8371e
SHA5125a5bcb8943c1392559b1d1e1a8f226defc67932a22946ca38e80cdf21ac66e85e34c2537b0c2aef6d98f63e7b96b6a4ddef94033cd6f88bfe7b5ef9841c85a9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a9507b23029b28d7548d4af1bf1df84
SHA148d6b80c4ad91908a4789e3a4df138a14fb12baa
SHA256e23f96168e0dcef26d572ae1bd8e12c32ad17700e94d7b94357ca5426a1ae347
SHA5124038dd5212b4ca596bb864d90e647db588e4161ed9036b29cc33d8c97cc9437bbeacd9e32768a11e6b675b77619db2c27ea270af4c16fc35811b6a561ae75d7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c207caa7c58eaec6f15b7a275c26dc7
SHA1727ea5478ec0fcf8d0fb2c980a8857dabc0bdd1d
SHA256cd778d6be5728a9c01ca92dafc84bf272b88a290f0f79bb391166edefea3cb48
SHA51207f3fa9bfab927057e9ec97512b1fa92013d09382884f102755dac84fe7552538aed209c9e69a2ec2c0f63ee91618b7df14534d19940c1fbe8f8376f7ac38de7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c25e397bc87855d1b43e1ec1cc4ade5
SHA1b5d38ec8c78b2749411fb96d98a3191e1083091c
SHA2562d9a1dc91210468d3378b8f99c3382b1eda1240cec2b50814dacafd29de3d913
SHA512636342ec8aeafe12206a5ce3a3b7d2946dc008bf944f30b8ab8ef7ba5861c2a402b68a9e7c716d516dd9f582a6170b1acc5307b725fc2620740249c311d8f6c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54735b62468c18b880dfde23307f32a6b
SHA1c42686ae5a9a767289e2ffc68acec06f54892f8d
SHA256b3f9da8818feec7c78b40823ea3dbfa7d283cf219c970f5bdedbb0192c5b68a3
SHA51246bfc5f9145fad49602a2420867402aeef700c938ea3ded001792392759faa7d1853d771a268144761edbe81ea4c13aaa5ef721b97e81e1e5189718240365d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b094c86b86a1cbf29b03722d2bc0a19
SHA1a255395805da2f47b74b8814bd27e52748786482
SHA256b0826d9a5a8a7303265a1f4cbfcebfabbac9ed8a7250a2fad91612966642da61
SHA512956633c93ef41ea16f0a14749808c759698674da29bf607c8a9bf857bcdc68e4d8d0bc035e51072d96225e4b2c15c2424cd68726ad0f0015d579ad0a111e4d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536bcc30e2e18991f80c1e0740ed4fe52
SHA1107b878341da986ee67cbb77f7d6b90f50bc71b7
SHA256ecfadc46b9be5d99ec8b7de46bdcb78962eab22ecb4ef719ea0545004a6cefe6
SHA5127267bdb80d2237d4b02fe06d5d09ba007141736db84ecb6a6dbcea483b5a65c7499745150dd2da31917581fa93fee4279d62f6129756db7695695de1ecde179a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acba066af585332940a13b7c2a9cc1c4
SHA1ced1c597bedfc34e400866c025c94672ec2a41f7
SHA256416737823cab86b754355936a60b4e163319d6a6d3e6abdf2b64cece241673c4
SHA5123ad2b36571c5564b2bb1d514f6317e2db2eb090bd41ec7fce26c1bb244fb3422d76292fc2a400ad4b6c98263c7ecf716b096e6381db4f97169b655bec7a111b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd2af51ff3386a37ab3d322bf9e18f78
SHA14698d6bc4d4c2ac027e13efabd34acefe8606efc
SHA25616f60e35f2d0f2ab174f9e15c40e9e0454a55d6299633f99cf6a42ac6b172c49
SHA5121d87b0a190decd9624af19cc2485a5abc220cde892a4e3bbb44333cc0db03daf27e259791ce9987bb800b9a1e6cfd94c37a649902082f3d3b36cbd6b83620870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c39853ae105a9d39d5ad24c883c560f2
SHA1f16d088090263c15187c455a3bf25cbb6f2ab527
SHA2569e35dc3c2ddf96dc2cf3bd02cc1c009060b42b072539384382dab51b08c9579b
SHA5121d830a3ed1c1757628adc1b45331a75ee3e678ffe62d77d2e1020da88ac79848b7cad2c8dea81c3481aa0cc2b3bc2c05f5e5a62c545c0485fe7e08dd26f05df8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54df05297ae73856ac7f83331f7a43770
SHA1ff6d664653e6326cbc9f0a5610085cfc078947f2
SHA256f500138e5f4c2395dcdb8929c59bc73d08c5fee895f4768505c06e544cb38305
SHA512b1bc3687b77710d837d32964e255ba86938d098e816c4bc625eff54af3814a717016e0ad72d387f9453f3c9cf3b9fe9be5b4824bd55c8ca0a4a38934f8a58fa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa11ad44a79fa130355e015a93713ce9
SHA1fac0c9708de99fe846641005289d290b96d921c7
SHA256d6b3604e09f7b91e3553ebefa84f2b5c5769c607e84e3193556615326f236549
SHA5124329d731fd9b5e91295f2088469e55ba2f6ff5345be87b423567f8eb819c43e0548218f966cb41324bb66c3e3aa3ddc6b10deed9ef3b6dc15cdbff1505c5854b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f71b9e6023610d26da18caf13ff0148b
SHA12c9e616ac18817ae3e2aa96b596acdbc301d4e88
SHA2560e33e6e772418176159438c74953bca3fdc1c7a7e1f7215eb8a727bebab77ba2
SHA5128cc0bf88a14cf3693b260d96e3449496285c0088f51f3cb2dc1860f48b03ab986c49bb2681b7e21ba73f33d7aedd7e09977020f44ba235311a608c5f21836142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c18771b61e9bb3ca6c45690c86b3c555
SHA15a1f9216e03e9138959961a952b75ae8e0feced7
SHA25631a0bdcab592274caa62bea945a075bc4fab4e4a94d38f954f3879de74fafd19
SHA5120457d5afb4ea853e5add501ed1d08e9ccdae3b48fd3b765b2260c9fb65d2926b5694616ad8b510970151ad3ffcb4f5bfcec89e419f5176150752aff30958e3f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea89db66c2d6ddae1e9dc0715b06279a
SHA1d698abff57f199ffa4e026d88e6c10bfe0b68dae
SHA256d701b1e6171796f3fd105cc3a1a5e5297cd7478f50cd20770442a45e035e5de2
SHA51221dfcdfba899af3ae4378eaed4e3dd7750cfdd06da5920ee2c40582cbd71fc655f0ee7692f43a4c3b50453da33a3d2302726033bc50f086c21959cf794eb2f4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561ff1d383036369db77ed44d2d8446e4
SHA16445b82fb6c3340a2ec80695241ed4d00beaa53c
SHA256c3a38bdc0fd7357b1cf87de130cea0a871fcff08fdd36a72315fa1aa3640c0b5
SHA5129439dc145be1816feaa22e2feead6f3a5a56ffb188af9c29d44438f26badf32f32efbc17c478a9f980a9b0532a056d11bd86ab3c7e11c18e63f813cd0b7bbe69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5054644d8ad7441d63d91ca97df74d2a5
SHA1495f44b4ed7a0e8484cd41f031858e14de8e9af3
SHA256cdb31342c502bf236766fd4fb5401ddee6a7b85612441dcf5771c1a0151cce06
SHA5127700a16e8c8bfc30ff41e19849121079ed34690723be8bcd8c579eec404244fd3857fb0fba7d83b787b660919c8f44bfff4062f2a5a521a317b503f1878ecf55
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b