Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
22b674162cee45308c101f92b183f6f3_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
22b674162cee45308c101f92b183f6f3_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
22b674162cee45308c101f92b183f6f3_JaffaCakes118.html
-
Size
3KB
-
MD5
22b674162cee45308c101f92b183f6f3
-
SHA1
d9ac860f07c02f2ec33bcfa3befd99fff8ae3297
-
SHA256
09a730620201504e59f4d89bb0198a60a2b7ff045ed830f1052ebeed111b08de
-
SHA512
805526100cc22fee7f04ba8aca26e9154c334f9a2b15ed7b0134d6a76f01ece03ff0dcbb9994af5c556da7e9aef85040a6f6e500bf059f9257107ff156d33dd5
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000065d8631ef7245f7b10cea5c13b7f083fc8bda7f9f9a2cc159cded3f5fc09c477000000000e8000000002000020000000956ad8ceefb2aebc80766a640b41df5f7de1a14d1f260d367b5410d089cc439e200000008b6c91d4804174a973089de14c0506611c009a189bbc27cc71d1e184211b331d400000009b7562dd88d4d80a3565a06bb9630324e90d4babe140ab64b1fdbfd0c464a10f9d0a9d1501fd8d74e4dab6049404d061b14a6728d8f803abd4c536d05e26b80b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426179457" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b635ee56cdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000df2ad68d7a1dff5e4a2f82695417550410b1dc9bd9851a5fc91b553d79f4db87000000000e800000000200002000000000a532d115423a1d44248342cb8dac1404803aeb9dec03f4202bf628f197830d90000000aee7f50e365465fc01d5adbc977cf4f24704cb4fd9727b514d31b0734ea753be673d2a04c2519565250a2b113dbc7f17b0c2c53d5fa15ed56a2d5da3b12c942ac378bda3077438fd2bf1b3a5a9d33dd086e20dbe424a3dbf7bfa721b7fd862ecfb999e9bbb6b27212e957c00d4d7c0b172b8b5db61010173b2d3cfa6229c214fc5b0223a5eada7fb7c35839ef11244084000000081b5df1af574b11a8590589e1ea9bdf4284dab2d92ec63f3925c4cd490f762f50094b871a0fe3e453998c80aaa7a56e368b14ebb0d45fd8a7a125f858650bace iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18E28BF1-394A-11EF-B98D-FE0070C7CB2B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE 2908 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2908 2208 iexplore.exe 28 PID 2208 wrote to memory of 2908 2208 iexplore.exe 28 PID 2208 wrote to memory of 2908 2208 iexplore.exe 28 PID 2208 wrote to memory of 2908 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\22b674162cee45308c101f92b183f6f3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e56ab52376278c5ea9d497b71ab856ae
SHA1b5fa36379aede867eb1a946aa01a4cf83107889c
SHA25694e1b751b73871d292f216f049408d58a9068d088fd6e8f45867f1dbf75737f9
SHA5123d28633a1432f8038262297d796cde1c1323c21178705ff1e9437954985a22916ed75cf6f2d584fe46ceab52370caacb2019d2978dd5cf840faa0b9bbe71fb9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56822e699a89b4eea8f524fcbd7275476
SHA1c24c49c2a7007e711eab7ba20336bcb6eed5be39
SHA256e6b9d3a5f957b5c45b90e0fd5a939e556ebc24706e4c60b2a874867e1aa38715
SHA5126cf2e7bdd5ae5a45dc00b6818c1059bdb87a6cd06cdb34076c88093842cc9dc0a2e46f41ee67743bace8763dfb713665d10fa3edbe8efed5a77601459c75a5c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558f91e5e88e2aac8a9014f0eb9bdfcbd
SHA1e9b79b011c3903176bfbc97483a4ee16b4a1e53c
SHA2560f5566477f3b8e0a17372e7e6820af1b9c8f500ceb9161a707a9ab3e2b8fc865
SHA51224d9213389fa32f5feb194e722016a5515b3fb522a246f87e51187ead74212f9780e347438e70a388f7c2984731e2f042656b5cb905385018dd8b0decfbdf8ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578bbdf2f5c264d4259f3ea1194c111d8
SHA1cefa51f4f308b2524c53acff7be512e0feca8d80
SHA2568d25c2ea28a65b0fb1f467508a3972540b75b626aa8027bbaa23381343414ea4
SHA512ee1528deb613b7a775448b97a7e6eb515f13eb56bf3e4295bdfee2894130d793dce4ae4072dd8aa9f31e686d1af03edbb1c1b7ccdcad43fb2d073399c32b8d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558ae6401891fe69eba94aa184edac5e6
SHA1d58d1af681957d90b215985205c2d7ef49c19cd7
SHA2569b871b99e1a6c452bf87f8d99011b305e6fd5a95b622cda342679ec0f0e52f68
SHA5127d45aed92a2001276fcc562eddacad6cb5551a1911e31c85c54962e977fb75b311a87143f1bc080396b19e59953edb73a585f347747156ec5a1df963e2aa724b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8da351e6eaacb27fed68fa7db183239
SHA1d088bcb0183c817a72a095ef52010ded8a08158f
SHA256860c78ac1abf8febca5400a26bd2d6aab0bcda4c911083c73710acaf767cd0fd
SHA512ea8e078e4e59a0e3d2bc4a5648faeee88fafb657c6efe262847258281b7cacb26f77348d5005e7f72be08454111721c99fbe941d935634ec9db1a910fce039d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cd9742b301e67ba2969aa15c0b4cc42
SHA1d27f47dbae0bc7f2eb2708b355cd4e743e01775d
SHA25692f5fe0018f7ea5bb537ce44a3df340816aa77641c3e8f5c3c01ccf2fdac961a
SHA512fed723328118bc45daeac1308d7c443ec8ced67d19e0cf24f8348346b6bc5ccca831dfb549ecc95472d152c0b27b13ed9147dc4ab587a86b55748487c2b6af71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549ce04c385bc68e97d6b7e8da804cf6e
SHA16bc70c08ef659ac709ea9b513900e8f413c9ac5d
SHA25606e66a9b4d1fe9aea26e95207a44f7a7949a122fead43d1edd925d5c4bcd09d7
SHA5125d3d87f86b9c55e09465278dae0b48e5301504ed430546a77993eba815ddbf112175b0db05272a446b149fdd2c6eabb8d9c3b562ab76d4ec6e6eda9f132cdf32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de684964a3ba6b181563c1b65d5288ce
SHA144cb04a6a016ef305268c1b44ad3e3ee985bee7e
SHA25631432befdfdecce5275b9f0738f3f2698249a573864323aa1c978b1f878c68fa
SHA512c19916accdb25e89b204051a3a85c29a5b72e5cca56855abdb1211444b12a1e2ec0e13cf979d02db512b728e2b7b21a605eaa15d72072ca4d5b3e10bf2e68427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba61f639e524aa0e3b21f1372f36f6d1
SHA11cf5c2d54878e0a61eba8225f0e4de8ff549d0d8
SHA256de9142995a7607c20473802932c0e41f108965ce437792718bb49037dccbf328
SHA512d35cdfcd11ad43ffaaa1df6d36962729dc6586925d312899ef00336c8951c8162d3396c6eded2f74e43a5823790c4673b5fbb3ae1d4e0f40cf3c00357b48b449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d5b577325d1250a33be1b6294bc5b8a
SHA159c686e771c79156957cc71653d8e1e464be9a9c
SHA2561a7f1ff2cc50422344d26f81531be2ef6b70cbba4c30f80e220a770c9701e33a
SHA51291ab5d1a850455058b6bb424f0f1a89b71f16c295360619a945bd4e5ef7e1773ba8f45ff3bf86ba6123476df5c87115a40b848df9570a7ad28eeaec614785e71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ddd2b52e43604f48bbc048ad1a8b893
SHA1c550e0303aa1168b3bb6629ce478e862016f52be
SHA256b9a4546cc156f67a125b49c5719f019b220928becd70312b380a56784a1b13f3
SHA512d8498a2927dc2e575b572170470903d75b67a7224eee09e5613294fe59f357612eda6f0e51672413e8e06412b88be19bd2e305a42b663cd0212079e6a02eaf66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a29cb7ee22b0c314474aa51d687d58e
SHA190953b67a3b3b25e11a8c58b1560301a80914f56
SHA25632404ab7b79e0dcde7c25347b163c25470d61f6cd07aeeed890274abb7281105
SHA51229f3ff45b8448986d68b405107b980bc8a475b27d195ac4df607008e39776ea89931dbc2ccedb5e2492ccc08a53de56834fa1054db73fc0d936914ff7f39bd6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587f8f0e4079498fa1aa88b21d6388784
SHA173b03053f00c16f9c51593300dac27ba7fcd5b72
SHA2568eaa3569cc4672132230f084582477a44550e452c569c52ed1f0817b239310db
SHA5125adc07ef4e3a8369d1b5b891ea66fafced9dd0b42b32e14abd67d4fece2c46b04f141dc8d535321535e133aea234586f45234424bc8ecef740f37af98854d8e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddcb88f4c040b52d63a1a8ce8381ca83
SHA16198664df47452aeb30032f5c0d552aee74f0a92
SHA2567e7f053b2cf4ce8738f327eb9747f608697097d4152a630144684d27b6f73e25
SHA5122f6dbf06fab8f1b6ada085736fc7be557d16ee722fdc2c78db877aeeafceb582f339a83a682615424dba06974fff7cc3d8e4d98663e1d3e5505b525e7ca9e419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514e6c3d7cdd69b57a66b96e3b975c002
SHA13c7a02e8fdffb522c18fe6d88bfdc48de5cdb191
SHA2560d4e8654f98c98a982c03a05cb291d958d626cba48fc86aecbdc6e9ea55d9c9a
SHA512a23de8695b7a140aff7ed5aed690bc111d967ba8755d11043d0223ce5941c78e1eddecc3c968b6db5f7ee7fc797fefb6e349eb860fb7ff68cc1c55a6c20e44b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f59efbc2f261029b9df42c91692ad090
SHA14cb36a2cb622fe31d75363f5c7fdeb4c2651a771
SHA256539093570a694c7204abf436555a653559f5185093d8578a064ef639725a81dc
SHA512b6f08c6dd2bce11a622ee5a088f484e5fff31269a14d3c6452a72962b17f7a079917e9086a8f09ea08998edeabf095ec28d8957adb37aa35b34c49f829ab7216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a878099f431bfa83739ddd79bc66450
SHA1f814af04d6386d0561962524050374673b11871f
SHA256b8e99eda633c457a81dcb3fb536370d28559b5b5faf32d671f6625b13d53dd5e
SHA512052b50c466aa983b1bc33b3b0c083196bf218179e10f0fccf27497e07288f08dfb7dcae0eaf5122db3525b08dcd0895561626e53c7af69039e243f7886f9e90f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5268244834514bb81182fae2b78178107
SHA1dbb7fd614523eb7b60a59c6a1e8d5f5aa3421955
SHA256a90ea03555f3c2f9932b496b5b3e3be5a70d506b8f0eaebbba51ad96aba9cf45
SHA51230c11e971f93933f20edcc199472cd9689973e8279c6848170a665a1c74aee85ecc4bd715135db3fd6d31688c7d7e98cf217dfd66748526a99092c38ba2408d3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b