Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html
-
Size
1KB
-
MD5
2dbfbc891444a26907c029f9415895e6
-
SHA1
f1781646cf13038b1fce1720bc77ce42dd5e5f1a
-
SHA256
2c9c6656e1d266b2b05afaaf054072598a3dbc5da2f494d44bf19c3b804968da
-
SHA512
e5b7d348d3e4bc77bf61f7c34cbe3db8fb4b9cfcce64c6f5c40be4385556857150e4982299338ada7f3df89bd704ad396767c8f1429c4ac06e44eae3b7d620ea
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D68B411-3DA5-11EF-BA5F-F62146527E3B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000008673af7c644338557c6e4b0b0ed26fa68c7d92d859edc5bbe0cbd36a09d2e004000000000e80000000020000200000002ffdbccb8ff456bc555fa19db784c7c8cfa7cc29e8795dba0357e55abe3e8e8090000000c292c88aba57c6aa3cc79a8ec41829339dcac4753f3fb0de0cd6a758e92838fb95795fe25160fbc514d3416adf509b2ef2004b98ec8806a0cb1649e9144251163c643925ed9809de19225a6ef55736ff02169b5269aca052ad3c7b324583079f11b13e5773b1d1b89ab1d15bebf8050ee39de0d585796b0f955054197b3336e98d016e7363e32675268f99d006c94e41400000004b7e71cdb58e18862e53a8dbf3bb2175d4ad2cc6b62143907b0489392e427900358b69af0d3f4ebf371383ad060a3e6c4978a3e603202836de7eb63a76bc9772 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426658352" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000b8693d764c72c662af77d4c7243497e3d01ad9f1cd0b6b9343a9799246d1795b000000000e80000000020000200000004aadc98f2aa30ee1dda244ef1fa27bad7fb8c30e679122a110cec5315e04c7432000000029f724e0936c39172a4f36ab5e545e650d5c75a5eae97852f44352b324b080ae400000000d3739ca4a58daae9bf3267efdecb3be30be56d8e9a874f076925bb230063f4855ef5fb698c14dc0e91b1d654ab812811cf7e9830a0aa098f9ebf961b8a49a9a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ea87f6b1d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1316 iexplore.exe 1316 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1316 wrote to memory of 2316 1316 iexplore.exe 30 PID 1316 wrote to memory of 2316 1316 iexplore.exe 30 PID 1316 wrote to memory of 2316 1316 iexplore.exe 30 PID 1316 wrote to memory of 2316 1316 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab07a60139cbb870c315a67c1ce8c70e
SHA1ecde38692e744cc4bb4bd559f00eba9e690ae729
SHA25648eb87c0d61a612f9425b3ec9e533cb9c256e41868c2312e2348572814dad45a
SHA512c8eb0277675abe58ba250e47b9275ddb759f05a16ce12badcc28747253b23a95315f5961393c4b75838935f4aff97b4ec14480c78b1356e84a5bd98a752d1e05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5824cb87677ed353386d1942485ebc8a4
SHA1e20c5b6299a136f725991ebd6b1fedbc7a46425c
SHA2561bcfd2767e7e73ce6f7ac9541f71a1bfb225dd3194dd33ad5539abb8df88af1d
SHA5122a53dce1455b644b3fb4a68d72fbd7cc3621a835157e02fb59df66699720b4c18a41aebe5fed3e2e4265ff38382c3ef332c8e330e66f6d63a4a3a49f291851b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3586b82d7ee44529e253d3f3394c2de
SHA1a3f2981e40f23eeef1dff7298f1ffc64ae674c1a
SHA256297ff016351715d9187efb730474a10158abea4ca35c2a068f4e8966cb749aba
SHA512d8b272e0148b3fe1cef5eb19a321e30584fdf0153303a3113c306d5c2279fc2b9c5f8aa0df8990602b0082482954047fe31da1478274f2890e812fe68547e280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c34bf6ab7fb2e84516f7f87544c42eb6
SHA1dce447e6264415194f41098fe34d6cc87e021009
SHA256e6131f8454b9acf3f1f12fd47a96801852bb2b78e2110f6670c87489e7ffe92d
SHA5122ec2f542cb8f46b505106389ab1ffde791067a03573e9172d1387b27e8afb95b10bef803136c4a69e40f3c4fc3904af2aa68c2ef6f25cb78323cab93b9ffb028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba52ee7a0da3205e38fb3245fda1b21c
SHA1322a22cfb22de79a83b32406104e31fd5d70d58c
SHA256cc423a2aa7e5dd1856cf953b365f25666bc4357cbbae50253f78e89b02adf4bd
SHA51244f7775e39c1a97f218e04680fc3b8799275532c61e8adb314f9f762703e6dd39c94ea9635d6ca4876b015b966f0fcebc9c4d37cbd9c920bcab432abce913389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5582e57746daa0b5235991db93b702a35
SHA1896f539df716d586ad951dfa10b46871233661cf
SHA2568cdb9118a3516bf84d73f0d68b875eab637d36783cd02fe1ac99ef7de8d29603
SHA51273f4932aaaf0933c6ad5361675754584f455ec2ac77f557e170bcf3f51876fae074c43bed3583a2ca370b8fe446a10fd848da4405e8d19767389bb05e7f82859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c54e206e33dd151b5988b54612efa09
SHA1ae9ba9d761f5c7f73747c593cc58cbcd574bbed4
SHA256b2266620dbf716bcd8127fd7ec2ca02d34240ecd28976537f52d976d4aaa0d09
SHA5128ba3c54527be67b798ac7ab56589085f34b906fc7caded210591fda12cba27318f46b36f5927ffab6e94f343d887344e03428a4d1e8bd0e6a7d3f697053d7bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c7b73a17fd5d8fd89b7de7f19bb4b9c
SHA182419cd1b3dbb13c72d7a4ed9ebedd81957ad02b
SHA256c568bfaab39099422512cc7d30c0fca6d9c8f6d0758aea9f8b3b331ee03162ec
SHA5123936b4e425fcf80927231adf9dc37a0ebc88b6370b108c16175a6a9ef5dc9ebe90a0ce39725b23909e3f9fe77f53fe83765915e3dc9913ad35901a442a2236fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b22313928ac7d957e146e20cbc6fef3e
SHA142e49f0b3c192cc0bbafbf4a4bc87022b971250c
SHA25654a97e03dfa5051e3cb43154ad792473e585d5594b09cc9135b24d0bb5d9fb04
SHA5125c108c56f9a03f6f5ea7216ecedb133e78a080bf78a4e40a8e347cd352c329518c8529b64741deb1b3f78ac3d5557aea2b56a559ce4442eb46aa52fdc7067248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c8385fd62a647d4218bf6a41e19b7c8
SHA16c5ba284e39504684e5ab0228a29a7a7bcaa64c1
SHA256f7ded9b3531ffab83ce1742be7f6d28b4c44556ce77c33bf737eeb42bb3ff07a
SHA512b8cdedd2ac94a77277db092666b39928a43dbc04cf880e823456117bb1ab752acc4f1dda6b03da446304e185d508621632e9cca26ace2ebbd7ad5c2416323e22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5c11bfddf0b359250de8396798cc6fa
SHA16a2935edd4311c635b15a71457bdb1a37ba94bd9
SHA256510e90c37f64180badce4e0de74a63addbeaf4943aae82209a29c4c5cb274d07
SHA51255f2d19f769322e11a0e545f113d1486d981c1b06ca372bdf8f0d3b66bc8b295cb4ad17609c21ca6ea9ba5e004f7db4b3c3b315240c62057f12d025e6c56872f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559d11506d2b0130c7f939692ceff0fae
SHA12034fc655f00710a8a4bad5392e493f715907974
SHA2566af6ed92a5f6480e98f25a381c87cc667740915ad62e3896f2724341e347cd50
SHA512f69dc67d48e3f8a741c95262eb9dfa5708120d507018996785115d4b8dcec793715bff1a02cc9fa20248593d2a389a3cd18864635616e5d9da4a565000bb88df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567731dfe6bbf004eb9b77606a2cbdc23
SHA122c21b527e973cff38043563d2eedfddd357826a
SHA2563b1b2f93578e3d11ec20ae974b6630eddc72b3009183695ae75947edb7c548e1
SHA512adf6322ede25f0d97583816afc04b0d19bf53c4feb3f83d9f862f0fdb2a6a6cb541aa3f22f96a5549764067659a8292f864c4888d67c63cbf86ad353261f52a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b952462d4b5f0f79ffe8d0608f13401
SHA11c4fce67f939a4c0d00e172aefc4a9d863e3d2d8
SHA25630549dea411f444f159b168e2802d4ca1ba325e9cf4136dd86684ebdfdb4afaa
SHA512774d8470dce6c7a6701a83e811e3671ecd36df78dce3e1c727465fc2d09bf7de36491c0e28e45f359be06556fa1b50631e98a6eef1c2735c7c3eed1a9fb7df97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559c4865ca975231c239aa5f60b41ca99
SHA13a0e7e9591553bb1936deafb222b44a90dd81a06
SHA256406c501924ed3bbf495bef7bcd2491661eda0be5135ef945850127571e65599c
SHA51251acf9d42bf4539899204916c45ee324a40245fbcd60c2a14c978293896a901aa68b746b2f8c12d4d1cad1da4a2c7c497c315f3d0b15656dd712a2c306f014f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eecf2c31a355ec100b9e7c047d7d0418
SHA1d1d4a417fc33f498643b047e390b88521f4c021b
SHA25628cb0117230f1b7b7e7e7a96ed21339e4da0d78e7ab35cf1cfbb2adae96a9d24
SHA51215780bdc6652b67ef1633103dec2c7fa806ef3991d47697672617e3a1826ff772813ef620dd89dda4ab040b8d7c8cbc20b934cfe3c0ebabb6eba870f1d0df759
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580d3403f176416249992a4ab9a88d537
SHA1288108aed9fcd7397627a33846d5997773c1d9c3
SHA256d6905351549a2d7bb1b2b358448938d549ccd1736b9fae46b27032c443abf849
SHA512fa32498a155766a696cd2f442f701b86d036d9ebde64b432175e0e37c8bc2a8577d4925e3eef36f913cded39079e71c30dd068caa49c4eeb06b7a648bf57a528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5280e3e0a59e35835b2b54e98e1404184
SHA171dafc74eb01290fb94f316a956449014993e460
SHA2565ffc994c054d3a558812a04ce2712023d871a9ece7b645698049bc6727038e26
SHA5121a2bfc86a72d6459e4d70a1b8a8f74932468df178ff6fd3a135ce256122f2f99909c534c892e5863c7cff2582eebe3037a4f5fd8b21afec6b8a70b2ef08dd5da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58191dd1d4dcd9bd992ba2be6cb5041ad
SHA1526e1f495d739e85b9e7cb49bc032e6794db04e5
SHA256e1625ad7a3aed93234998011862e6304457bbb6da1fdb82d11794481d4cd430d
SHA5124d5e21ca4690b79817b71ff6430bd82ce387cbbc53a00a39d521e78aeb721c134f89338a7ab273406bf06867a06d7be221303388f42a025baad2fc34aea55858
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b