Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
2bb0f23769fcc3d8a0df945e55b2fa93_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2bb0f23769fcc3d8a0df945e55b2fa93_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2bb0f23769fcc3d8a0df945e55b2fa93_JaffaCakes118.html
-
Size
53KB
-
MD5
2bb0f23769fcc3d8a0df945e55b2fa93
-
SHA1
e0daf5630006319e7d35f78509a7435c04d9b7aa
-
SHA256
c0120bb479f510982274315300e36649b8579020d0135c775fab643954ece1a2
-
SHA512
9ea63a66e14eb44bb6e925755d4a9ecabcc15be1d811ce52b01b2a6cabc26873613fc0c6e395715f07b1462889c9e7adaf271e82504f76f90f08925a3ac37b8b
-
SSDEEP
1536:CkgUiIakTqGivi+PyUIrunlYP63Nj+q5VyvR0w2AzTICbb+oE/t9M/dNwIUTDmD/:CkgUiIakTqGivi+PyUIrunlYP63Nj+qO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFB6A461-3D35-11EF-85CF-667598992E52} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426610603" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000035b9ae98eb73970caadc40d25ad1073286078709e2bd9fb7b21d435d6bc7a051000000000e8000000002000020000000cdd779074e9e00390a90d0e12d42934b42e9b0ee742cf22831c561c8c99392bd9000000041aef72f2bff4f20905c648fc97ec8acc7c925a7e1dcddbf3e111f395a0f94d974bb28988b581a5312336055a69d5e1c6837e74749858a422c248c2725f9a63dd56339d1323210845dd07ac3441a81b5cb6d62136b372dca25cefb372aded138d34abf19dfcb8abbeced438583112ed8f401c0426a92dbf6d37a0f81e28a9e8f5d889be03fe10ac49a137e3972e15b0340000000ed081658fe42b5e8ba2831f7f84fc66b372458a671c6f5b51f85fe6c9b1a9e7c2c76ecec452d9aa701d5717d92d4ad882b32ae02e022b91c363c6cbd2f699b6d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000075eae70046112be4d3018ce574d0c0a304b4f9cc2f3a42fbf2495c53c6ce967000000000e8000000002000020000000e754eb25cf1be3b35c044bed985878fd6e16b73d27d77f9aeaeda1a3d23a796c200000000dc5249eb48975d106d90224a867e2b388c5097981d04cfe4f219a3994f663f140000000c0fb774c26c40bac6e311310c99986f68943a4fcc6c2ff69030fdaa97e29f3c9445f48158167ab89502063d798ea6d55b42a57a9be7a242de2867cc18705629a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308fbac742d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1336 iexplore.exe 1336 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1336 wrote to memory of 3064 1336 iexplore.exe 31 PID 1336 wrote to memory of 3064 1336 iexplore.exe 31 PID 1336 wrote to memory of 3064 1336 iexplore.exe 31 PID 1336 wrote to memory of 3064 1336 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bb0f23769fcc3d8a0df945e55b2fa93_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58785f464505be26c09bebe66615163dc
SHA1c7006bd2fca9cbf5a26b11af7377a7949c567aca
SHA2561f9136b1bdf4dcfaaf714191aa8914a55b15690bb8010af3d190db50e1deaeb4
SHA512c7811d6440c1c9a25fd69a9d49c43e1e34a60554c831b1b5a066ddef95dd09444953ef8cb061218d553a0950661f005adae00f30b6b8d633ac7fd0574647daf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5540fe6a996619f2032537e2e1bfb92b9
SHA1737b6b698d0dfc020c797d6c9408a2460449cc6a
SHA256a487b34c28ceb0b4e8e817e254f9157302cf6ba84a5e67e169ee29f58f4da904
SHA51287f6cee1c1834bfd8cadf5ab2ad276dcebf3c5adbd08599fc627e0c170cc8cfd164427e9112bdd9775939b877f2d335768f2d7fea466cec29d59dd1a51a5d12c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b00d0373d2309c2a77b3d676bfda56d
SHA17b66547cbc329df29f3bcfd628b6c629fd60282c
SHA256dcd096adf4058fab08185a8ddc4f7c5c916a7f1395c5061dcf0aa2a9108ca7ea
SHA5128211ca304fad62ce3ba2aaf0cd28a3da9fa10a8f43018cb1535017bd88e3e5cd4e00db57014d7e258528d3e7b616a0daf2c7d6771842532192f4f36d79b6d913
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5321625f6cd68fe5bc5c67bddf7f44c32
SHA189472bb4719516ee7050c544dd40ae8756915af3
SHA25640c05d88fe206ac8593fca2d6b705c41718e4e3b6d055df3eb69435b93ca0163
SHA5128a1ffa7b8ff085700c3c52a382c1013dacc7e4530a1120d47cb960c8e9d57814542e98068a6f046fcda8022db8c26b097b0a4b75c1e61b3d4f57f57fcb0ce53f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6e5477a78dc7dde578eb1d59e05c266
SHA1d4387e4bce8619a6af7599f9e3b65cbb8908812a
SHA256211794f39af09aafe929413b9c4dcb279a4a58c9118961fe479fd72dee9a09ad
SHA512137101ddddec83244ddba85ca8474da1c299f9b7cf7f4ce3752a1bb5e2604317880c39b9012bf244258a588f104af7b2f85aed26010369094230df3466d0dee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d280c0de896d42e0ab63492bee90e6df
SHA1fdf036f740c14aefcdce432586a4e2c7349dcc95
SHA256e30cef0e90b720641e0dee05802962b3f058b0f710a8b6654596d3e710412818
SHA5128aece7ea737c13cd0c372bceee778d8905f4781f91c5277fc00164ddabd6da077aa196d24e9b378902bcbbe1adfa8a27220aa1ce770e76f0057e2b92a73ab770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9871a0fc84345fca65f15d85a9be2ba
SHA1206b9e33ed9b79e58cb81514fa2d8dcb023785c5
SHA2569b314ed86409df31fd50f1ca4cd806c29770fcfd2f90ed3343ad0e5c0791f716
SHA512d500d88ec845b69fd692a773f70ef741b95198c10c4707eca80440bac914b9a4751b90d2424574e027188e2e2868968b6f3738ebb81834c4bd85442218b25abe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597e2eb2851bc470e4aa6d1392f81c958
SHA169f2568484aa55dccd23d8adedbc38a29d597f80
SHA256a012b66b4d025b9325304dbec25d4d2950b8cccb86fd45d8780e500de1dbc5ef
SHA5123d64d15e088e0c26d904d9ea8c3f41858b42b2a8f585222fb42aa71f4cb7f8a79df0017bb9b53289c1f1ebd1be72e661b715c0e75660c4f06cc1ae17c0328dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9749dadb0d2d9b3e616820c4cca6edd
SHA1e1dcca227ec4d0ebdf34658fa843bcae999c2b32
SHA256b080ac0f33d5b4fe1ebe3562f38f22fd527cea171e2f1fd69291e3f84870bf0b
SHA51260d5bbe052ed18aa8c726f3e49e5ea2a535ee9d7a9853503b6aaf09dc5bb0f129f4a5a0a38b0ec41d20eec92781350f35cf01aa41e740e6116bf4e88e1abd45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4e5475c14e06ec6ccd4a57629023ab1
SHA1be2e17ac0bf5197ea7d99dbfbfa97b506f65c187
SHA2566bf876b8102b9ae6efdf4580a824880b8bed9d366d633a128c123fc071a55780
SHA512db43cc00e0a4af8ecb533238dd1d5fda576e8dfbd824b2b9330070c0d43332f596906a1aca15e4ad00cc91a29a9f4b61c5f36e93cbc4d55c0c4dc923e5d59d76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c200b4c791be89a1942d3d8a6c4684ab
SHA198d4d19d6464c90ff9b078ea7e3b039ed7b1917c
SHA256db87e53f2a45fabab6a80914645d0c9f5f753edbdd9214d546374cd6b42fba55
SHA512e928f9499ca6e34a7c74e009c07158f8ef3da92be95fe80129368dec6db7351635c950827e120cf1b189d696380f86a1ff28cb4646eba9ed36926a663e3e3ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5422a85d3e7185c828b8477a45e171ce3
SHA10e4b1d4c4e23536ecbf3df1d18c55e95307e2c0b
SHA2560f7a4927da2909951cedee96228d3240d52ef2084b66118df6d4fed366e82cf0
SHA51297d3a6efd9d17a9ee3d13f0c3a7729ded694784100e42c55c55a0a86b96a3e63502b9cb4b5fe45befc8619291599e0251f582319208b902e0a52ab4a7ecab88c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f156d9e28d8abce4c0921301e81385a9
SHA167b7aed1a1ffd5d990b26e5fab95a378a55a7822
SHA256d22ff44a4e4b419165e22824e949cbfb9e8f92034a4a1ff10490043b964af914
SHA512c1b8bf9d8e9f7bbf48fc1c70b6bcc0d75e67c79adcc61dac4b4f14e13a4b4dc444d40c1c3e04c7010f240d1f3086cfb051f00bcc2d1dbc30083a67cc7fd1e9dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6958b9ea019a08c4c8bcf61d69bf5ba
SHA1c17e7e1d35744216ecb72c7747958af4de33df92
SHA2565c3ba2fc8976df0c97cd0c87f12da116379dd064eed8322dd1397651ebc86ab7
SHA5121a808c60b2f3fb73fc002a599c8fe94e71d6d14990d48b7c5731bfaee0584ab1130f1efb3da8a11838441f1dd042844707e0461f8ac4c0b307a0a9e183bfe4d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5242ed22351041f5e6a5eb2faae7c0480
SHA14fd55de250130874f4698a92e320e4fa99e86318
SHA256370aa9e5b77801bfcecad5b4f6a8196f4c62f8dd53f9c85f2f4bc93b2bc4fc84
SHA512c1e037aeda6fee0e40d948b3e4b72158dfcc5b5a44499e99a26a7d3f9e33145c2484a3afc0b993f32bd604e870a38e3d7415237f0147a09089693daab1474716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ab6b43e07ae190a84ee6feaad62eacd
SHA11d6c554c9f681a6f6f9f89e66b9f7647d5cbeed2
SHA25656a221dc5e6048fecd189ded6e0dc31fad53783556adce6a85381f137c06e591
SHA51288afb4fe1a100cf4487fa45fa2b3e8d61f883ee4dc1ee2b9236fae3310add1e39d54bc3ede027fce8cfc96e3d23e992c42d0be27499afc9e919584813f6a124a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2f7a39942bf081378c5fa13d126a9df
SHA15a628620fb4fdbc712d65aaae9d1074a2ccc9ad6
SHA256e1543b10abb09364727b8122c5c720017af5109b73b001ac0933d77ee6b35ef5
SHA512a0c11f8b08d2fa6cdcf8e74fa9750bedde6f081b637cff216e88ad999d45bd2fe7edd7497d50a91eb335ee6139b703ffc2c54992796ecc3c47be1a8e3af18bf5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\wt-logo[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b