Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
2ce25f1e74340fef522c5acb04f37c00_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2ce25f1e74340fef522c5acb04f37c00_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2ce25f1e74340fef522c5acb04f37c00_JaffaCakes118.html
-
Size
254B
-
MD5
2ce25f1e74340fef522c5acb04f37c00
-
SHA1
8c21b604f66b158705eb96e864de56aaaaac920b
-
SHA256
9b3f0408d92462ede4168e0e0840c0376d2f5a98ee62186b9e18f71504c384f2
-
SHA512
b2b4aa542efcb1e2dbe3eba4f967bafffd8305673e1b872e6ae2617974cdf2f53556285939c6f812838dde7e07cb60dddb3c0165de74f8fcd849ab82efe50846
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000048e3748d632d9e04f0be72965c0c3306d19b2d23c981a3b50e59219a8eed15b4000000000e800000000200002000000067685ecd551abed93ad497713e3fcdbb30f1ca66fd444daa4fc4fb6ee8b4f39290000000f9783d53f57afacdccfa6727361e183ebceea06a90ae30094e7472aeff1742db683d938dac07426b039e9da6dcd32ec3300384a9de163e378d3f97fec035e5433df7ea4b475d15a07a4c5e72c4d73c9955f02a8c331aa9cb2b5f1fe8a804f2db6a0093d66bf0117c865ee454e8c95af0e5c00c8afaf427046d26f4665cd528c7022ee6025ad32fa4a33d74939334b5ff400000005639d38c5f7900784fb6f903e137db7362edb5ca0db15301943b973048b2eeb9e543e55cb211d619ace0af37525c9865d1fda6dda697945b6203bfcd9007e87a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC844F81-3D83-11EF-A372-5E92D6109A20} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000737f8340a10bc1b2f32fdfdd78f423d5ff0265535fead74c54d4470597fc3101000000000e8000000002000020000000b20664cc1926ad2f65f8e2aa2f859d773834f2ba9e07d4a27021b70015185f612000000074e98087842061bdc9081d62fc7bc046e925773e67babc4143d699b63582797b400000007daa4a2f1e53d1173cb4100a1339e7e1dc54bf422bb70c8daff31af90bf4e53c2c77d93e3ef0851168d94374a280ca55a763316c0680807d9dc44f55abdc1f9b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5012faa090d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426644043" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1984 2352 iexplore.exe 30 PID 2352 wrote to memory of 1984 2352 iexplore.exe 30 PID 2352 wrote to memory of 1984 2352 iexplore.exe 30 PID 2352 wrote to memory of 1984 2352 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ce25f1e74340fef522c5acb04f37c00_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f294c3a2d268a46c42029a8c4b72c6a7
SHA1942d039ea12001f1e1bdca6918fac4c1b26e5969
SHA2566ea9189ddeee37720c3b396718266139f91ee87d16d2af38dce54ffa8eb87414
SHA512339dfcd47162f07992990c7dd7d2915fdad79f619bee11061841db0d84eaa19d57f04197b4b5fca1162dc7771828abbdb22cb594f955080f468ddbceaea67765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dc617229eef324a212965b9b2533749
SHA1c52ab0eded0e820ce49ad4870609be7b960e90b2
SHA256ed95c1b6f20a3103ced8c2d251cdff19f082401b02f7ee866e49c301389de01d
SHA512556b16e68be293d3ae371e6aae12f5d18047788f0d32517ab3765dbc2e4e58801f5201b04a07d6ef5bc83550b386c0bc793ec18c27c1d36721c439834ed3aea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560e8e170d7fec77d4082033e45ef75ce
SHA1be0a172d136772884310b202fbfa1fac47486969
SHA2568bb9657527f1adebf126195169b251af08bbc946c691f63acd02cd7bbe485241
SHA51289c32db06b1596a33c7b6c6e56c78a05da67f43a8a9f2d9a1e3aed291b6ba3ad30709851133b709f387f7b6b0d38adc558aa82edeeddb6e0fa0ec4f6630d3184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f1269f8d5d0e9973c8ea0d9c998ec3a
SHA1149cdcc12c11d52d00b6180d2e1196b4b7e16353
SHA2560f36e4095900b9ad48a4c478fb8b8bc430dd5267467998422b8bf7912edcfb56
SHA512575197317fe4c789009bb4656897c1a3aa253340866e05a0f57e94759d9f1c876924e031c04fe9f7afd3699806240d7f76fd951733aaf8217d8c3d4a58220d07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0339f59c897e8db771b9ff3718844d3
SHA160945a0608a50636607d10a8d8fc341ce6cf340c
SHA25635fa47f87611c44ad630ec444c59a6e13617244bf2f4cf622f20c92ec0292e71
SHA5129843d534c3f313e1bdc3f905cb4aef13235f3bd89b6b2698e4d4ceda82082e18ce6b433022a86fc175afb5a506647cab32e1866321a6a19e4dc6302289a6133e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1ba0bdf460e80646b5f89320fd02f42
SHA1d3491e06e78495cb001ac03565b3cb68b76c38af
SHA256a9c4651d7e50ea7089dae69f5b97bc229665e004c8a7d96310eb371b7e3c8353
SHA5120938575c09cfc27b1d4251392b972ec088d5c464325a0517faf9b9d7a6daf5086ba980eb070675f2d2f4e7598d014bcc77c3af969f2d19480158c27f1cbb2827
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5422c86b87bc3e47dfdf1f34e270f26d6
SHA17d270f9bac6b8ccf21ed30719a9db3bfd7783b64
SHA256ffecafdf60a416cd70ef3f2d21096f2bc1e06d3a8a4231382c0caddabf705ee9
SHA512eb952f56bbc9ef3c179f3f19dafa46e0643b484b508b16e44159eec184c28ae067bbab7a6d87f1a6ef6f8436656a07cb8762157cc2bad187378cde83157b21f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f40a953be29fc086b6a90ad78d2a845c
SHA1395cf8baa87b207af422d5e5744e26df9a6cfb5d
SHA2563d4354f6242ede223a60e0615b97f8b92623ef8243c2592fcd6a5ecedc8cbf36
SHA5128108cbd4df091fd7a6a717380d2f4c358fb645aa610cd4be4ae0ae9c958d3f1151855d6d0458daadec3aa14f253abb628179e9d34371ae6114d9219051132174
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597ed062d554bb3de72809fd32c830dfc
SHA12f3577122d050673ba705558903a0364d3321dc4
SHA2569356e92cff66728324e935a7ecd2b77b8babcea4f05119f0fc692b3089c467d3
SHA512914b0ac268d33d5fc0c9b765edf274213ddf51d63d065c71029c1dee9ac2961d7641f1a0660a30b8c8e0b9180ed6bf71567cce5c7458e05db955acfe7c1239a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3d329e1b735f9734b86f69ba6ecc05f
SHA1281fe13c66a481a3f15a18072b15ca0a77167908
SHA256df76aad70149c1db21dba339ea62979828c4d431b528c374e8afcfac1f006daa
SHA5120d326057017c057680ed9225517a321cc1d12634a6306398af30c89353c35d8d06244d8e4f113ca4e67e9c018fbb6fde709ce2f4aeabce606e00abd6e25af9de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d35cb0019a623035ffbf3b49669e5f2
SHA1ce168bb93297b7c5a48d5f38c3923686b2a2b1ab
SHA25694dcfee2e0b4235bf198ac00fb069da4267ce8367452e99df9a1a2ad6db77b33
SHA51284e5283c838166491e43cfb438baf74ce61d429f3d193fe7e4d3a8b113d69e5c57462fd0a6ada205b3e477c26b6de606aa6384790a677f065797915149116258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555c14a6c799d24ee7e1378d94462ea29
SHA1fa8366485a0fc4b84e1090871842ed638b208390
SHA2569c9438f674f74a3fdd2d4f39f7ceaa2b06ebe32720cd285e885c54e83b12ef49
SHA512c4f7b14923821fd0d48df058f410b7fd4238f700a6e21b34bd1a42885dcb3522a1b8d789a23c19987a4bffeecf5855b12546753ba254f69a4c9e19c22b743b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568a19894222bfda0c83199906013651f
SHA1f1e504f2b951c2a271902f4d3bd46c74c7a17d0f
SHA25659dd67b866fec5ee15545fcb18257b1b84d478f7578db728db8283ec8883337b
SHA512d7ba6c43260e94a266af87df911a679f730dbacbe9978e0aa75f1f8f0ee6604ecad1623b4dcddf6c84afa854370a94416bebbc477175a7644ef2def3979b302c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55eb02d415a6930bf214f8c4454fc0949
SHA1e62e01fee7deb5bba32065e43f84049910d4afb3
SHA256651ea33811542773204d66c6b05f5231a7d94a44d8753bdd4867fb859006a122
SHA51236d588792b826bedd68895e665d4fe84f0e2c8a81eb2eae3eb0d1366af4f486ea04a0279ddc92c45a78cc8d337e5b254823b2faf4c22a248b0cef89cbf32f163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e321673cf059f5643bd56c574d686ad
SHA1a2529f6ca259348b7842bb3f184f8e6c12b6fd8d
SHA256cd8f78cc4190de49f210710bac0d248133b09a41cf47a7fddedd49e7d292ebf8
SHA512e998224a60ae1cf2e554e6a3c0327764e64bf8f41bcf5e22439250da0b0948dd64a30e6213d04e9d747c892003c8cd94bd5d5922163eccd18333b1d1c85243f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a1923f2ded5e47bfadb1b7ff703b0a1
SHA16ca0a935b3d8b7f01df778b58ddf556f9ca7b829
SHA2565c1de35e7a11d351d59ccfcacf874c48dc5f53bc29989e86fb8247a6edb47bea
SHA5127acb30d67f30acc3a8c8ee57e81d4290a6a8d215c488e69fed45f6bc50025d5e862e32257669e3ff0b897991cdf8ec386e79c1fae4db5ca4f99d5b923917fa2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddee968f7cdae234620d764742258378
SHA14f1213be477163e1a00ff211ce02aeb10b81d087
SHA256be9a158878c2ed6145e0aa71b9d8c4215d6fedb43d3960334c4286962712bf1a
SHA51225181180025ebe8e4bbc5da98dea4fdcb4cf4b52883b8909ffba18a0f8b40901a6a087bd256abd9d592e4e1f98218f48bcf33875bd35a5eb156ba538503ceced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560346930cd1cf62c6fed2bb4c73c2005
SHA1746c3acdf87ea1434a6f25d9a90fbf075c3f73ed
SHA2568b2c98aa7633c21860d82c08faa806cf8b30abf3708eaa4c43ac709e52c88151
SHA512796f4ed3021fc49ffcb1be77937eaa4633ce1f3ddaa2990ee13b57096d7a96d95d85b7cfc8ce18f910feba0627ffe15e736735a6b49dda28a1e5f8f5683d23ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ceddc3b35401a9967bd3fc30b5666667
SHA17a81a48a83a41f11d3ec34f8411fda780293c070
SHA256a8a32e969cdae4b5c0deabebbd7c79e243afbe15379dd34cc7fa931dea470a5a
SHA51230288f594a371b99a445762c28ce22b6d2bcc632ae1fab65e56ec1f91c872d4091d1a323471b09f367daef4e1d33cc2743af187459c0bc40f58eef8e8e23d344
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b