Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
152f978b083be879b2a3cdf9c01307b3_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
152f978b083be879b2a3cdf9c01307b3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
152f978b083be879b2a3cdf9c01307b3_JaffaCakes118.html
-
Size
110B
-
MD5
152f978b083be879b2a3cdf9c01307b3
-
SHA1
0849b3e8214f4a8ce1ebc5c0e77fae0e7a8ddd5f
-
SHA256
346f277fcb2f3bffd4ea5f249b0c4993c9bbf909d1a0159988606a66d03fbb49
-
SHA512
45366b1d0a454ba3b343fd249b8307701bde28a694287ec8923a3574a8b7c7427d56a7be5d946d823c22f59de97bb995957ef8c8e63961c53e90a06d206deec4
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000234c82ba17946b40b5b14be6ad6c11890000000002000000000010660000000100002000000031fb81c4d10b187ab42ddc9025108258043bac1ed3219f313a47978a9feca683000000000e8000000002000020000000654d247657d193ac5413439e527ad2dcb76980af185592cb2852e967271a2f2e900000005c92b6725a5325231ae1fae9b6d2440c8dc90bf9cb70e23debd21727b6ba134c6ef97cc407d3ab47242c8abe20031c37a9f50b56bea8031c6b91a48c7118f1646e31d43ed234c9e5563a2fadd2f190b68bcaa1cbb7bc4a750b2f142be76963b0afdd9d377b5c96d748005fdef2067e18076a78a729e729392ed4487886db465b02708b44d00ab63b14f9a9a31d20c65740000000538d8cb0ff932d8c332e1894c25bc8962582701ae46add2324e12c926b9e9d139a4c4ab22c92921c0bd87dc6fc6e5e3dc4f7e5251022b81411cc9bf76f6867bf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{801B6C71-3458-11EF-831B-46E11F8BECEB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ea845465c8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425635886" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000234c82ba17946b40b5b14be6ad6c1189000000000200000000001066000000010000200000003d6c1e9ab3aae64b78abf9cc7f225fcc94f0ac40088320e9026db8c7cee498e3000000000e8000000002000020000000a7e6641dfab473a9f5a19eb2a216912f72c57c883cc423b89e853c24ee130186200000008d9362ef2e4e6cd233e42594d82d4df457434cf4d84a72136e655c9469efc9c140000000219c01b25f04b524165b536d80bbe0f0484affbd688b782602c50e6656bdf27591b4be7bb28830042115886386c42136a318c519583c9234430117b8f835c0fb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2988 3032 iexplore.exe 28 PID 3032 wrote to memory of 2988 3032 iexplore.exe 28 PID 3032 wrote to memory of 2988 3032 iexplore.exe 28 PID 3032 wrote to memory of 2988 3032 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\152f978b083be879b2a3cdf9c01307b3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d074684e7bfebd8594a4c1b644aa6f14
SHA1151d9bab725fdc7bda24e77087cfd819fc23d34a
SHA2562996cc277920a531c8861612462e3b706abd8fcb909bd472db38c83c9724118b
SHA5126cf0133bb624adc307a336db88ee2dd4ee578fc471033f9eb0bd456365d478fe5dbec86914750b35fc137e67b3efdfc3a1a4bf9b1d1ce6aba8bf0657f005df71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c17ae77d54bef6ca3e0376c5d62a0ae
SHA1d5560012579cb1a813a9c127183f8f22b0fbcc81
SHA2561ff2191ad06d9fd26bd16fccf15bda7317a282aee9529bff9276ad1385d7f40f
SHA5124ad8ad46229c6438fffcea2bf55300fed5c6b78017065afd261be1a1a768d5cd14c5c17917823caf22ca968a691b19a6191259630feaa9ec948b49ca91cd43ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7adcab179a6ba3543d82db3e7504451
SHA149de11d9f0828c0ceebc8918b0d9a48cf781840c
SHA256d6b54d450fd433dcfe70ab111f48d4483862ee2627d1cf859ad00e9133311c41
SHA51226d5cfc1b2e908daf06a38325e106f2db204a226cf0e7578a334c5a46864bb3effc5a5a3b8f4bae538f3281ac195193481f9b57313f1b14c706b94e2fc1303f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509514da3ceefaa62e4a40373986090a0
SHA1668fc33970920e102eee3b67af8aa88bbf43cd58
SHA256e7b290913afa6ba650fabe52c4f57afac48c3e6f0e04a391a52c6b821c341d44
SHA5123763fa2ff4ee40ee654bf22608ef44404b0ff30540c20ca48d916895826d23844cf1d1ef7a42222e92e9957fdc5bc98dc0006da7a4fae2790a6cdc8f3a69a14a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4c13d442d1a9a8197e044ed2b84e35f
SHA1f9cbafc73a0f01164a53320fb1a24279dede564c
SHA25658bbd0ed1cd8949d4feed02bccc28d7b2297ec7cf46af4e30b8c139b4e29a98f
SHA512b9ea09411a69d2693ef9d2926ffe746962dfaa19b9c1c73f6efc762da9401db956a60a1f7e39beb3492f6ccca691fec591cf722f7bec663f4c48f294d40e3372
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd33663ee00d65b6b5a78de5dc5edbdd
SHA1edc0123911bd95305f10a713e10d4a17beba4df3
SHA25635bb5660f1d259dc8bc8a1a9abee55448d8fb07d9a0a3372cd742dea3bd55255
SHA5126105117f486d50e2a0d2905d97411122ee23f4b6d7b658eacf461545a3cd7863aff25ec79292a3daa43dcb49679884077dd3ef81af8917e327e2f0131b1a068b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d1fe2312877407200fa55abe48b1a86
SHA14be15cc3f4d7b4733217b6dca461afd582fe5e3d
SHA2569dbf9ed73fa66cca26831a8cc1f01087353a755a4f5f3a7a1f80ae0d8a043ffb
SHA512352d5de505585bd3ffe640ff7e46e2526cf4cfba80ba467aeeef2d4fe78db3043178a8e3a809bdcea75d3e4cec3d38a6aa186c64a9f9553683019bcec68e4f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54395df48e0c7957da9027ec19dd49366
SHA1133d8db63c28cf1629a870bc1f59a939dd905413
SHA25667d0ecaae7dd7d0f99d488893d828f4721bc850ec0f6b903fcda502ad3b37f81
SHA512038e941f30cd2b2977b4d6964dae79d2decc1c8dc42b1fdb8e2d10c0657a0d129ddddb4c0733d85314053eebf84c30c017704c017b56c3723c797ecef031e614
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567353526acb8e9e42f5b13488c0ade3b
SHA19a03b90a6001fa4537851bec264e777c004ae826
SHA256f5bc92b279eec4a2f16d3083bdf0d16f02655a4ca8c4da3ae48cc01143143fc5
SHA51268556e4654bda7c84dad04b39cb432841c9858e473ee86e560fc1778afa2ddcf5bf2416b489d54d196faa222b91a16f16f2cfa4809ee000d72fa4b3ac3664ea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a223b1957c1edcf56e70a2d11f120644
SHA126287a2a80394a2e7a5b0c340cacf4aa198adc41
SHA2567b664de52e486d5fd77737a24043cde5369a7f4eb9acbcfd3f4544711e06f8bd
SHA512014114009420fda743947153f60554c337f689c681e31f71a1437259ffe8aaabb9347fda030c20175eaae21f35b0df68586be0537105bcdaf064fd01a5100f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3f35c7814a29f5742d3a693982b0888
SHA18e9092991bc58dce7def725b466e22386bdef05f
SHA256848fe180dad83e3fc8e1ee9046edf8e32962399b6fa78ee3e35ae8c456b3d61e
SHA5121a7633f93471c295b1aefa64d23d1537ac8e4fa53dd877aa6f76008202f93e2e809f3b0fc8fc7f3b95dfd3c9d9229836e3f10b5564e72303d92b2d1df8426a62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531c55fa0558ac70b674e4f562d72c14a
SHA1801b3d5cce9544c05f64e5970f165f9ddfbaa1f0
SHA256ed902f4097b545e7fe38a434a6311a0f02b3b7a9f5940fa06974e1781f829e5a
SHA512b6c4fd84a49059671caf5cb1be20bcaa8ff131824498d63e29160a558027ab369f2ec96afd6f7d460dc98cb839417afea993c1120cfeb835eb0dcc14f16827a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5907bb6390bc759b8e76978a5e8f9bbbb
SHA1766facc923b91df06c6e840beeb4d30739d36e90
SHA2560c6436c35aeede501b1ec3c9397da3eb19087b124b1feb02013d0e88df82480c
SHA51240ddfbec4a524f9bba7f1e22470679d3db082f0be2f8de9e98d16d8c876bb2f0eb93db64b1540e183779ed1a288ca7f14105dd2bb9eea37676cbe0537df92e6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53353e8bad458f7214e381097537a5966
SHA1e719ef985bea6fe42755ebb4022770ffa806b820
SHA256e7772ba14dd1644947a108b0914525e41a0f65af7e8d8acd65a070e1cda0460b
SHA512eacbf865b71934604945f93d0906d55618b7c9255fc5d208769ce548d297c36599212047af16b8fec62f22e637491a4f4f60f01b4f9d65dbc107f0868b45a62f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fc8571cbb88467e32962437d6eed894
SHA1a9f60067bffd406f5bfb8ebd0ca5eed6fc1e14ba
SHA256e1ce30ba2aae61db7f059219e98cc7a3b795ffac3b4d212cb53c96f9c8839700
SHA512d00cd23335d5bba67fd253354ab9b2aaedf5f1baca033e7839831aace90cc00bdd0da9e4fa361e19571a12c39425bda03572ce654500f2edd4de540055c87f00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562767a10da0cf0c36e9994c62f67b082
SHA1077606ca99c0c8521937c844e95b167f47a54da4
SHA2569a07e3b92ec405f0fb4efc2a097c8548e59465a4b1d4f2dd9bb84a9d800c6ebf
SHA5123ade3e3eaafd34c0852aea84412ba377dd5cbc51927996962cf1747d3d055d0f2dfd0af7b00b430cb7ae5756d62b02a76be5fc442c4d9831f07977ec482569b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9ce8c1c538f6143f7c9665b9c907b4c
SHA1ed4cc474b33a69c852f49a7e12c38526eddd05fd
SHA2566aee8b4584c50e9627e7625316e9617539d4e6281f79c24251b1486c14bd26ec
SHA512d7b3cc3e456822310be5640ab37e10edf3074c4a0f6b85b81e9666fb3a9b671d7a4d1a06d28a4d7c8bbadb3d9b9080a64d535dcb2bf659f94142cf4fdb9605d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b62c58dd45f743d2348436f42a3db8a
SHA1d737cea7fb905e4127f1dbaf56c03d3cb1099408
SHA256479b6ced7edfe01409ac1d762814ad6fcd28ab182c09d9b2519bab1902b16a25
SHA512998b08e71d57f3ed26a190e3b0bb530501aef18d7ac8649a2571affd395e58ada5519813dbdba35f01bb88b2376d4900c757ff92f12d63347f4d0f48c3c79ca3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b