Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
0f7231c677810527717379c7b6879425_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0f7231c677810527717379c7b6879425_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
0f7231c677810527717379c7b6879425_JaffaCakes118.html
-
Size
6KB
-
MD5
0f7231c677810527717379c7b6879425
-
SHA1
f352cf886bbcfd5d9044540eb9c808abeefab74a
-
SHA256
cf329e95222b0482173275a488019774ab45e6d4dea7167d2c545fc76330e238
-
SHA512
1f1bb4a953e5010589a915fa523e41a4a5c9b08c96480fe0322a5197d57f2370ffb68b60a8d4a814afbb6f3ee74b3aa0a301e54ec22ced5de0fe2cb8a4985678
-
SSDEEP
96:uzVs+ux75v+LLY1k9o84d12ef7CSTUxZcEZ7ru7f:csz75v+AYS/Ub76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000055f8f381e18fea4d0191a996b10a301cc235e819be93005d96792ce0eee31fbd000000000e80000000020000200000004fb28c0a9542610183108fd8f37737894cb1eb8de0ccd12f3cc9de48445398cb20000000f2677f663ef3aa9e0ac1b5a92c7c9d98ee940151cec477655c250fe2c341b45540000000a89231badd47710307c181ddc029c550e0100b4222fbbf43aef26a42b039a35047ba5affdeb557166b43150da0d8a581204a44a9503117b5e7ab38f92996721f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000173f09081e209c539c5cafbdc3c61444573944db57227b143c3d7ddb5e89a1b6000000000e80000000020000200000009085ffc91fc4decdcea99a99652aa88544217d1465c37099575b78913945623090000000abb8e10e1ca877919b85979fe73da9c4802f8c96eab6bf4abae17160eed1ed99ea2e8948eff033c2356c76ef72e6d2871273d909219fb99169c8518839d06f26e8682036a6314880247d7c6f0f9696e29e0f7fde9fb1744bb2f5b8c020b74817526cc01d890c99929b39e5791444073d09768f4b83f012f48b11d6de17b04a2002e8d494c238a60d933ed4713cbf586040000000b264cc6b2724ae876aac00c382394f53c66b642094fa594c5065640e0b359095232910be084d71ad9996223b82d778416b5a2338c6a83ed257eb810403dbeb7f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425509721" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFF46121-3332-11EF-91CF-DA79F2D4D836} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d616953fc7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1832 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1832 iexplore.exe 1832 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2716 1832 iexplore.exe 28 PID 1832 wrote to memory of 2716 1832 iexplore.exe 28 PID 1832 wrote to memory of 2716 1832 iexplore.exe 28 PID 1832 wrote to memory of 2716 1832 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f7231c677810527717379c7b6879425_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e3e14c6a6c320c29d366f8f73a502d9
SHA1cc2b438f56733bab87c24b2bf30d8e878774b8ff
SHA256eb6c308ad29cfa14f83f7a0269a9e9f3bf396ede7959a8c1f96faa610ef8b92e
SHA5128798a01b473002229b64bb61d09b8ddace7ba01a5aefc9c7887da569624e46b996b3e08607fd1eb8f6e585eb85dc4eb9a9e4ff52f602ab65da569c5d179e1dbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1480a9c9c043dee151a8160d974bcb3
SHA15a3e7ee5047d8ca689c82ff7ac66166cca3b74b4
SHA2566fd0fbb60f9f5e0479f1715af34fd303d86b64c1ba5f523715647fd42b03a82c
SHA5120ab4c8195f4ca1a1ff96f6b4987717b2c8f999219c8a475257fe2adfc10119b2cd99c7783c806f760e7473dc3454be5fc5cc253535c471189e6bb9a7f7ea9f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570da5879961ed3c268932566a695614a
SHA14a89e76161c16057eaa15c5579538536250c8495
SHA256d52d055ed8f86484a4d8659cd4fa2a240708909b01c46767133eb7046d2174aa
SHA512f5722a0c51fa54fc1e88d55466afd6f4d61942d4baa15b485461f80663d14071a56719e302f427d18ad84cdc431549ce5f3ac81237e9859188b8956561f95590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543524acf24c9b6157bbf0064fc9a57ba
SHA1e08f8fbe1e33f1c7e67eb59df834e30952d7c37d
SHA256a60417a39dfe8622d4a986f82988944dc54280822ab9225b01f5630415246e19
SHA5125302435668e6423135e2a828910a18a9319827f8ec5127b74ae22d4c26e851f32aa6fae5fe1e4ae551794577b94261f1591c6a814e5cd0a84dd955cdf40aceac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eed5bd8f03daea7e9ffc868d32dc3986
SHA1c33e932a05bedf448cf1e1e013772a876abe5156
SHA256e1609a15277c625361f8b9e4c6fba0248a0ace7331f92727a05dfa6d33729e88
SHA512a2b9fbb7b6ca39fdef357ccc9b93d89e388ab46749463b0fdd13cc3da6402dd31ee5e5a3a2e5c087027462afc4f9ce93b259cb57cdd26d0dd2389a51968b614d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5281eef4f11e3033e52a2c4486731c411
SHA12ea8c1d89e12ba007dd42e43eb8f8023d7e156d9
SHA2565e903ca2148852cc12668c81a6ecdfcb610897ce1b80dc6ab72e0bf9b2cf17cc
SHA512ab75ed37e905f29fb457348ae7a820fe9aacd376568732b56797b22f93d0d8f8cf0ea85499bcd6c1f982ea994c7e798f5a9f6b87696e7a95631f6728020fee2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e70b536698df7a61429f5e040aa935b7
SHA1b3602461d0b5ca026e7010c0b00ff8bb3b256ae0
SHA256f80a709ac16722da666d205535868647ec02ce6d9a86f13ef284da0a20f1023e
SHA51293fbc9049195bb349872f507ffa2cafde1395c962cf3b3430545933b49420227014ab7c60ee613411cb41e3c9a9d0b70c07c738104806ebcbbbf088c379ba029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbd860d9feb25d18d86c99336e14fe3a
SHA16af9739afb5847013424a39a0118dc87ce8da182
SHA2566e2ea7d16dfce0468a760d0f16f0d8570ba569862f05ba4e406b291255edc8c9
SHA51230169c6177979369cc54e864a27f4e3a0f8ecb4dffd2e3ef62e41d4d66991bbcc829886e5788238904afbac936aa555c936c1d03d67bd6dab1ed136a3a44079d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534aaa61ee0ad902eb0c888dca23e520e
SHA16dd1de1c1f2ec2cf1701ea0ff671cb754b5178d8
SHA256b7ccda10737f8396fd2757c295875bb4f34a640b06a20be79e29a8266c2a1ca9
SHA5127831cab0e73948fa3b97270125cc53e0e53b20caabede166a4a2e477c9e1f10af43cc033f18475f2ecc6902b381be2bafead6ebc93187e5d7f24d0eaca9b6470
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8a7720a9469dfaeb62d109d1460015e
SHA110c4225bd75d1826467e6edb832111f834bde5ac
SHA2564d3942d73d2b63933835149fe54162110d660d09b36768599a166813493cd6d4
SHA5123172e7174ac3ed570e74ca77979ea9299208031d080ab7cbf51fd4507a7c7d15edcb88bf6c6ea5a12424027b4cce68e7bebf54871ba0c66480139556ba8240d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548d54aea5c0fd717c45f64db096d14e6
SHA1ff6b29446a105f60faea42829e1979abaae98eb3
SHA25645cb031d88b77c2f31006e1c13c3f6f5edabd5f11dd3d7061c247d7cb47a83fd
SHA5124e401796b280c0451bf46d0551565b2e66a391a2e1b7c49e298611302de80f10134953d3a3c8a2cbf6e6292351f3f0e5e800eb3802cde5b99a858c517bb78027
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503553261983ec29819fb53584e0147b0
SHA105dfb8e15158dcc69583223ed1aa8bd40358e6e1
SHA256e2bc8df16d33c75696e4a90605c1708c87195f65b500e1d46f73d4a78d706029
SHA512a4bc339cffe21bec621a0b00efd873fdb23051622c66047c9b1234a60d83357c884e7036457dcdfe627376ef2d4a6dbfa40820c7dce9a9f46b5a545ecd70dab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c03b2d02763551b107147f1b86561220
SHA1c107272445846390a467882c2f741dbf0282d5e0
SHA256b22d26f3bf3ee577baa7ef0a6d2c20b7097dac15a6da99b9b40748a8771e971d
SHA51258a9d66ade12b67b7cac9e2b3baae45cc0c105085af44f1c2d1e2acc9317b7d4524407c60f60f327c4f5d7a3a18272272946ee9043a720d61f8e5483f727363b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5186484841f4c86063510488da4ff81b3
SHA1fd2a08f48932ccd4efb53fbdbb0aca0152dec19b
SHA256bc1a3df38ab8dbddabdf00f5879e689775eaf8e5f5c7669c99a47e1b01c4bd77
SHA512c067a196eda92a8da51b0f2668be81b20d16f73de5e581c57820b47783fad37bbe3877e546a2e1c864f97de3fc3248372787e68fd8cd9fdae6922ba6955c6255
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4bb1d5e576cc1f81f4133d7a42903e9
SHA1ba4f944d33b6749f545f207f3613cc97cd028ca9
SHA2560e21f6104d19daa02cf7c7671fc92a30f53b184e08bbf36314dbac65b8d81b72
SHA512566ebeb6ad36073a7e67ee2a0c477c12d971e287038faacb7ff341500afe8df5de863a444ce12a7275027d73ff6d7065818b8cecd552de2e4d108c75d5d9932f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555267741b1f3319af27ddae21cf27c3c
SHA1316d2eff5ad3c6717146cd5d14b4d459d79756e4
SHA256e7d2b114e0ac770b65ec73e6042588845df27e0789eed8dd416edf3bbe53e0eb
SHA512a596cf6565604d2e6679c25d4636ced4d3eef662701fc9378f486a415d5abbed56e6577979bf895b3463360944a03751029e2b3dfc1103caaf20f9eeaee8f9c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564c055eb1527516f89ed6d559beb0ccc
SHA140ddcd10131720150638a8a9f71ac638dafdbc45
SHA25670105adbda57d0812baca1f783d3b76b2916b821f0d456eeb5fa04e71fdf9ab9
SHA512d907b3b9772228003c2feed7814a9c34607d23f98c92ddc286db5cb531234826c9422eece474f45fcbaf5a55a3d6af51f561537ecec5120dff85e56e09b285cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8a67091e994de0f5c734323476f2154
SHA1a0c4f06c9c190a1a40dc68cb0b40660afbfa7eae
SHA25661ba2baaa99d1e7ecdeb5fc6103522fde68c924f1ea56363e35794c83517ae1a
SHA512026e7bdbf2c0d63a86fc783114e517d0e772ed135c3c5009ed1b728debd3c02223facf217420800861c2ca467174fa58b16cf1a9b0a1b24a5c18b2d1a31bb75e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a130245f81ed5c000ea150c7d45ecef
SHA133122c55085b59fecb5342c1a9c45aac99e5717a
SHA256881162d2754dc3dd93f9979707469d8f64ccafdbba81840a7361be166a0ad8f2
SHA512e9cdf1c7bc0f0caf33c2a8b83b0c83dab2e1f383de29914729fcf166fe8c05a1ff63a22fdf7430e09f6d07c255701ecfe588229c8244c7629f3302b017437b14
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b