Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
2a89b38f7cc8c99f482c83164baef059_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2a89b38f7cc8c99f482c83164baef059_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2a89b38f7cc8c99f482c83164baef059_JaffaCakes118.html
-
Size
3KB
-
MD5
2a89b38f7cc8c99f482c83164baef059
-
SHA1
76de33efb46e13549fa94906c0a9849c3ae7d63d
-
SHA256
64df4a8ab0dd4c1d4db0b132996f242d08488f7b592c5ecea509fe94e8d6a9b0
-
SHA512
3813bc9767d02943a33960956144efb2fce464b7f4c6a9d991f872e544f61b2dc2ff5f24def3ceb002956d31df1fd301fadab091ae7c2241eee2632370032723
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E13AC71-3CF2-11EF-8D34-5A77BF4D32F0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000b567ee04ddcff486a4ceced020727764d0456a9e1b9ed1cff519712b113c8729000000000e8000000002000020000000bdd07b56202b621682593027ee9e833a430203e78e083ef6fca46be6015c0e5e9000000040f4cb3d707ff086e064e51088c2041012110c107e9a98c304c6ed6d9df4fc59ebaed5062023bb70b0adb2f6e6a360a997be4af60abff30361fd4a7b43afde1735300aab51d1e73b81753c9de8ebbfb3d2487f1cbf060951a755168c4fa8e403d547eda12c2a07141603cb824248837046271fe2dd87aee808f0d08817ebda3838461a436c47e2b57929308df2bfeda140000000df38645dcea25a56b269a077840762dfe329c9e46e0724935bd5203031b3c32dc6fe96be0b6e1fc401ce4e14b935456483df21d3db41953c0386a39f492b8612 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000003bb832f0a878026979cdd3c4e30656624f628d0cf96eca886c53fef386ee1a6b000000000e8000000002000020000000137ad60fcb39396f3c69e274558ff248b3ad9be2d943db5435f907c842226c6e20000000c98576a28533e3e9ff14292633fc82a90d09abb05209e07aed9319c3a8bb0a6140000000658e73d938698ce81e1ed11bf740aed6111d474a523c12f4ea0a2aefdff392ba909977557df1296a06fd4a24c56cf4cff9570db72a049567b139b59ea1beb1f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a043cf45ffd0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426581609" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2732 iexplore.exe 2732 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2956 2732 iexplore.exe 30 PID 2732 wrote to memory of 2956 2732 iexplore.exe 30 PID 2732 wrote to memory of 2956 2732 iexplore.exe 30 PID 2732 wrote to memory of 2956 2732 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a89b38f7cc8c99f482c83164baef059_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532857c86c96671982ea57606da28c3ca
SHA1b2cb769e16dc5e2dc96201d8c7e6fd2a0413e057
SHA2564de84397dc15b2370d9d19d0bcda062b0edb8f1c3fe757444dc92248d882c07d
SHA5123d5652ab23e0369097e3479f170df0530c58329873c81596621b27527c73b362c46bb62ec6d39ce2bb578482203df7ea4a54d58d22c85daaf6c2065a10450d9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acbb1db65ed5a5e6e0ac2d9d5bf45e95
SHA13d5c8a23729d0d544f33e8519089a07acdc34f05
SHA256fb937cc9bc4365553cfd54ad3a5f55c237ea065e7fc6169516c1debd97595bd6
SHA5125c69b145aed7bcaf1badad067864af45010c64053b8052d23610bb47b44a2fe5586cc3db59fb5d9ed9d4b485603c98e89c4d558b63041ac9667e513f6497641f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb256a664253883581d2e46535caa0d5
SHA1c1fd2bbfc1823ddd28e5df9eb58f8519d93dc92c
SHA256e87e27e13ff409b59f6e60ec19f04bd3a4debef5e53a00ff5314aeab19e3a44a
SHA51268a3716c0dcaba29e1704f183f0eaff44590b783f06b059fa67972d05120b06bfc71c6a7449c0319d90fe8163827bf039d2957ea7a50cbbd08ef721bfb5bc334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505182516cfc2b647ddc14143305627c3
SHA1fbdb7f8929405a1b799a4886146b41c73f55dd93
SHA256788402528830e24968dac384f3733eb969db97275e6cfb8c0d7675c6e1f51774
SHA5123a525fb029587508b84bc95837e0b28036edf99d6108f926d4a8eac9f14c5c2c09d1d6175810a4c29cc4e0e887bede2c4f598d986d80eda468c50bb30ac4e24d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50012fa085651847c697a725da8ff3f5f
SHA1dded50c496162b6ed0845b78d2c9450b636d953c
SHA2565261fd1671f333b6ec16136d4bcde7b15bef8cceb8880f5132ae594c619d235c
SHA51272de830bf96fac29fba6073d69d025113baf72e2dd50625d5040e1a862dc685e252bed8a4ebe42608c473f0dafb794d5a239dcc8cb300d2da4d071b3fffe2104
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576404a99eae6f3f385e45d76f0b6a8e8
SHA153c035024404c2008a1947e85660407489166392
SHA25671dda30ad8cc1697aae125776122c740943f20dd98d2a0db3666ae5674bcffb2
SHA5128e83f7b1413da873bce72ebfc4fa6757583b39f074e33d9bb312c44eb161103958dafad97d752d55ee77875065a556bb9ee498ab2a845b9958d3e5c1a9ea35e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5951802c0841695c29404d2dc81e86dd1
SHA1bc1fd925855592ff105a5271a69d130a62676d63
SHA256ce1796dabb37b9b1a67db3e8604ce6682a4e3ce2746b14151895a56f7c849bd9
SHA512ea9797a263b661e6935f085281ec7e66f1d91a17a319a99a0a9a4aca51b893e8ed5168d501838f090d3c6bf07ec51eb49c73b2785a073ce726abd9835ad718d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f9803791c2e19178ca95d19da91fc6f
SHA159ce47e3ba5b4e4811b7485bb0cb2a497fd5e6a0
SHA256ced9ee69400979d74db0466fd6e1166131084f13be34438994d6abc779992d7e
SHA51283af0a30f4e00a5bfa5cd2f416e36b53196f73a86d6a2b3a6b98f66f1a39778be2298b6559e3ddee04531f47defcbd9c25db1902c7d46b37e26a61de9d35878c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c491d011e927ca566ea910e13a70672
SHA1cb1ae77bd52b4ea0cbf352486e648069ff6a7ab4
SHA256644b1c66a4cf21e9a853e563a29ae70ebaefd1e6c32063d57d1d0eefd3c95497
SHA51299112aa5b977c7777e57797f4694882754ac7fd39f961990704b6a0de0592a017ede568ad52153312ae25f15a6589bdbfdbd9422709c137d9d075cc943fd3642
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bcdc3c2466a7bf586f3e212624e5d75
SHA1c0e8bfa5e54b19ad2f4310d6581bcaa005e78ebb
SHA2569179f30e0b62ee0206e479fdf694e91c9a51608a0179513f1f9fd041e647bf85
SHA512e4f765ef2c2ffdbdb81cae918a65b4ea8639cf28672964090cd3378a19b3ac7d9b71540e587b9085188bfbf8e4a236846a96f6d25e8a3956519b0f873569d842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4d76f9b01ba62da466e85bfa287111c
SHA1ab3d94bb81b985755c618520120f9e500de2b680
SHA256dd9516dd31635c22ef3e954afe43838eff16c1eb40db2c711849b23172d035ad
SHA512116764df6fbd824bd15842c4bf93e55fdfda768e96e614f78748cd479ac2228da115c6a4cd3f02d7f1de8fa8a585542980cb30d7422f3bae5e2e7a6d43a247bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584b08089ba922643f1d65150eb3eb17e
SHA1daf03db445edb7c6ff20504169609bef036e9b29
SHA256bb8bf9b8761b6d2caa792a5b406583ac297069e2ae7d652078e88d4a22394216
SHA512c7c28788bed07f914514e8bee64c45e954785463e051b9560fba7207e73544440fd44e6209a10e14fabaa26aadc1b4f65632e46959c671d5cfbc37be95bad59d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f16eec8c59c7400a5a768cf2900cea48
SHA130b70b64b6d94855228f4b550401ddcd6128f4de
SHA256194c10b91128328197750da7cdf8e9735e8d93534ce9aad8c646f8019274d522
SHA512b70152469467cd47b421d16736c60e9a9981c68ff1fc1ae3e766d15ce2a6b11411b84f110fe0e6a37fab6b786d0cb2c74ec46bdd851fe466ed3d50b14f7db9bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55409e62f2e1888d88ea4efcb3e7267ee
SHA1d5116880701bcd882f93dac6c9a2323805b3b640
SHA2563acf19874c5ebcd256b5d0ebf900c7c15f4b85e11028ef9536f8b5ff9b0707cc
SHA5123266e52c465c9e634053c0ae91c32f5cd2e62cc470c7c8cacb849eb3ac2baacc08eee3c0b3488312b5e2b77cf64c948bbbba0f12442c352b89aa4abe47a02791
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2bdddad96844d6ba8a7a301e3c7328b
SHA110a275c7c0c11e6af38e86a56f013de1876c5595
SHA25618e38e5b2c9d72a856d308e403f58236a4040b8eec6e37fc8eeba11866c0f23f
SHA5120e3f6f3bc34e33d3905ae9cefb42993442a11c64a056ac74e6c30956af7ea07a14246084e6b046aacb43a7ac371166430d03965c601e4fab1358fb88b6b6c9aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b