Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
2f750bd81a970bbe82bc693bee9b118f_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2f750bd81a970bbe82bc693bee9b118f_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2f750bd81a970bbe82bc693bee9b118f_JaffaCakes118.html
-
Size
1KB
-
MD5
2f750bd81a970bbe82bc693bee9b118f
-
SHA1
a6c73566eb7a3b70c8c47db94b52f992197cafc3
-
SHA256
980f14a9ecb5448e73d432d1190865cf75ecc175c4459347553d65139bc0327a
-
SHA512
d4657909e9b2295d5c72460bc0dc43150e905ac78e64a0fa79dc1f3daba2679ce134e67708fe904e362784cdc65553c56909d6a39bbe0a4fd45a7479568c6bda
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000007dc4ef82653921e2920b5866af878e6ddd404507d9595d12956e9afefe50d891000000000e8000000002000020000000acd8226feff3df91e61291a702bd3c12aaa1cf4e1c8fe8a0cc638aa21882c4862000000019c6df5fadf638b95eac97dc27398bde810712e524e88f7bfa913dc32fa1dde44000000016775d71b4c953721982f13a3321ddad65b5da084595342b4e7e3540bcfbc6b90bfb6e1483f77a32bae1d6274cdc114325181ef695eeab6e291ce74bc14f660c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000000078b58958010c29acae6d57b3493f8a3a9e372e48a16cc9e4083345f461aab000000000e8000000002000020000000f1685a64753b0e55dc11d7e662e5bf7caa741db61ef9abf5b95dfe5262f00b45900000006b627a5040efae3b3985ee231de70dc7a09f4881e0d7a452d4401de460de39706be9f661791a1785b65ca8dcfb7b9d7859d87ec4cc8e92a509f2e35e45d4011c1eb7d82b174cbaec66670b406a1413df66461312ed52e9fd25eca8dec60b9723e62747c1411ad070f64d42dafec71d69fda60990a0bea69acd58844c35796dcaa2d31122fd549f057bd4c0e0630e12184000000099087166e33cb05edba3097352e52e35a8f9ec44d11b7568e65c51287817f001c449357253d36b1393224c0dc615b362ff2ceaa7f63c4926abd09b92c2187ceb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426685782" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB7D6681-3DE4-11EF-90E9-F64010A3169C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03760d4f1d1da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2960 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2960 iexplore.exe 2960 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2488 2960 iexplore.exe 31 PID 2960 wrote to memory of 2488 2960 iexplore.exe 31 PID 2960 wrote to memory of 2488 2960 iexplore.exe 31 PID 2960 wrote to memory of 2488 2960 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f750bd81a970bbe82bc693bee9b118f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c5a970d788abebff7ad11fa09845e9f
SHA11f55e2e461738e1284243e392885a7962a8e86ab
SHA2563a7e2d728fa81bec77a44f0746cc57e90ba28cc956c0fab5c92d337431db823d
SHA512ece1c23528842ac7ba3004b3468aace49ae69c9c4ba9973400047e59a6f203c1554fef97b65824e597216761e9bc98cca24caeec0299d839c604c10c6e08c311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51784e7dc9369a0a39478feac3bfa8b97
SHA120895232d7d0d89ddc0f2fc60d97315124bc2bca
SHA2568ef5b07e01613462a598c8411c8b7af66088c1cde2ec1345eda6a3ccde13dcaf
SHA512b5c26c1296a4edafcc9fdc086dc7c4feba1b67b8e13068651f89193686a524ab7e94d5b655759140ce841b8c94f95ed88d36e979a72ea548a5f981ba2bbc8e9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532575781ee80db881352903b50988c17
SHA1fb591bb60fe279bf5e8b443409f5c7e1f73b09d8
SHA256824a433dfc5da2234befb9e256e147565ed6bc77682189f9492f8e418b837bf5
SHA51242dd89eaf4b439a11ae2050977554e2df15a79cdb499b1798600d119f58863743250dce4b439eaafa86f523fb57610f17005a53b2652e342eff0d8834c765c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578db1135964f2aad2e46b884595f91e2
SHA18aa242407028538b0fb7064c2baa3145db7a7fbe
SHA25654279a4a141cffc8d8e64f5116a6dac249b24f652ca0accf01ae0555225d0ffc
SHA512e8e499c4c3db0cc1aa770875850a5c577b6f7658224370c32792e1cd03b21e1c0e92453a3f18c265ca1eb18de01a8f7ceebcdaa5b4f05b24ac7d0a6cc30ace6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcb8c992401c30c8b50552f400d2bcaa
SHA11285776c4e9e02d583285ee9c4e277a0ec5ced9d
SHA256d1b692329daea1cd69d1fa8a755256d66b1f37648a14611c9605cc15e03cf87d
SHA5123493ed0d5f931272a87f4dc27e57d33a4e57fe3764c8563d7827c12bb6f968c3ec5f459efab231a7e64ac73a5e9f12c1cf2705c2efaf8d57ba8fca79165e6b36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e2eb88684290c07654d2f3ea4c69be5
SHA1f4145042e8e0c40726273c9b5bb5d6e2a4aa983f
SHA2568d30a19daf4212fb6a29e1084a723b3a5b6766d2efddc0f469e5325c53fcb19b
SHA51256356941ccb9e7c9f9d93b0a001307ce2eaa12cfb6f0a95dc95eecc56989e86fc62b8856947555ff42395097e828193f72bbb254c485d3f0dab791601a3306c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac987bc6dfcfc0d2de2d9d9aa8d48315
SHA1f12e4f09f8fd4c757e0687d350649226cdac9bb6
SHA256a1ed8e9a12228d6420b956ab8cb4ce16e78276ad9ec68929a152ac2de7bce503
SHA512bcae8493c1cf5e6006cd4e6608eefa9bdf827bc57888b88b9d7cfc0d6ce1d8e53d1c7c2ffdc71448d0860ab0ffc082cb2330733b618efa678afe16a0934085d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b7e2786a672715b7ffd00f5e5824269
SHA112bb605951b5feb58935be3d42c1b74b834de029
SHA25649d8d75b8e4c7bb4f52d31959b8f7f73b080ad263c9ad598023e11a62d3b4640
SHA5123660248988b118ee1eab5977196195e1718397619bb87fd733ed6cfb7b01d7d4f70f2f388ead03d12530560ec02f4dd4b1adca8a6f8bca725226515f6328f314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d7818cddb77ebf65d72cfcb52de8b60
SHA1ca623fa203017605d2ed1edaf88e9ec522ecdc80
SHA2569f0c9cb69be76c96f041a44c01225d0fdbe946390f8c992fb7b565cd0a1405e9
SHA512b124a94c0b3004a381be4453df1c5a70ea907367654ad8a193c9e3444cab307b591034f39167d87d21a43361c1331d5cb0f725b69fd3bda4da1bda194cdb6491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2fb76824b0f4d269cb2b01b638f6a33
SHA179c51053d54203578199f679a37799acb6c5f8c1
SHA256c93d01bafc89110d31c8dcbab2af6b5610335c5d9f43b49ff0ed1f2008daef36
SHA512698ba16137bec63b7ee9d6e8a787dd6cff731ad10e32e2cadea13d5b9bb8a7df6208356afb1af0143f4206d566d798ed7b7d7d3e6780159ace6f33100b220efc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52857aa83f8f4153262f11d3cd6bf9b0d
SHA1a81b6870a4833cec8344952445b3270494868867
SHA2565c558fe2de61cab2440633eb673bc899ed0658975cf0201d3221af646c60f0a8
SHA5125c6ff7c878e148e2a760e63419711e1eb2d32ec8a5895da8fce6cbc80c5181d20bf8284bcf3669a67808c5b1e06ae8ad9ffbb0c6fe04218794afe4dc244239b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502475183abb49d86d1f7cc3d9f87ddbc
SHA1a972c11f72603ee13794543002779e6a8d2726ed
SHA2562839a7ce5ca7d58ae6e58a580a665317a679bcaa676b79676c3be57b22f11cde
SHA5124257f18c63ed22fc5d75d4580ef63d48d4266c57c26778a03ad0d72dbf3e3cbe6daa1f81971c17da47e900693250301c41d8138fdbefcc167838d21364cec25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bbd9ee5841510810bf75ba8436a8bcd
SHA13a81489b10873abd3af3962719c57e9165ed501a
SHA256f88b32fa810a604e354e7884fec4bc9456786cbbccfaea1ba9c1a9bd423c0ad3
SHA5129f05cf53dc59e1ef19e84bb4fbb5bf78ffe17dc49afdfc4f3711fa5309c2c646837b9190d16c1a763e92b76501b5aa142187ca0ce8e703eacee46bcc1da5ecc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bbc4976a1c41f3d5031982b147f0ef8
SHA1569bc46871999a1ef1939da68405b47a4f997d93
SHA25679f5eaf55b81ad50e1f1121a1605291e4fe2a790e028bc627716f7965506b5bd
SHA51287d6404b4b816f1c456ae3dc7d2f083e4c68f15562f9d90c065b15d7ce80caa3ade0c57767ade1d0f62d37bd19636df9306048b46a5b5c0cdabda77f1200fde4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df7adc729a7b0c344ddc6d63a11b73c1
SHA16ac394a48832e807428c669a6671673c958250ac
SHA2563c8c87c105cf1050ef14b7cce45694c34e7f1c99fd8153831ef2ac103f96d4a0
SHA512243e079162db4e838227daaed6fb9625092fc23fb9a3f199b357242987fd654b3a004de7fc42269ee0da97fb2dea01f5c8dbfcf48e8df02e3c2e74a33941c00d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bd1bff073bba3370e20aa79166a7a1c
SHA104237b834c2778fe48efef094a51feeb9b28fc75
SHA256ff0994985a1b9751fe1d53b30ea9a9d5ec153d4c7eff1c6c0528c79e4b659f84
SHA51241e0b95c8145ddfc7cf96310e37e917eb9cbf292113f6d3caff5a95ad0011a87cb7991fbdb8fab92150ed543e84d6aa3ffe4a4becbe378a1122840fc6929461c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da85e19122bdbf2d54bbe7377bacd485
SHA1f9157d1683b7b4cf5b9c926fa3da17b715031dee
SHA256b72d0122f8868cb83b59baa48ea8a46e7b818314c6238b9ce02c439d7f282de9
SHA512603b9d1d9e036e264eadea4e247c2f4b3e04a51c2c01bfd7c44b89034934355e4d997a97382c66f7044a9d7fb9ee8f16cc1e395bfee489f96a37cef19d0b9ea0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ea1d39cd7a4e6eca6f2573ef4dcf314
SHA19f6697854edbd53794c86bb7ba82bbbdd0145682
SHA256cc361dae312d362a40d4882dda558c8aa2d9bb6dbeb5d1ec3e4acfc65894926d
SHA512f9b8e177ef87c50c258bdc49c59cdc97181ef8b15bdca4551a3ba4fa1aa4e9215236771c487adcae65020c922e4f790e470b6510a463d46733cdd3ac63277c7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ac05aab13f6341d9d6f5573328bc96d
SHA17a86d791e27bf325f076bdc7b538600adf3525f3
SHA25669a7f26ab122c4e57f26404e670fd97ee993c788b6d11070fef1e3138fffac36
SHA512d167805afbc92de9e63ef97f39fd73a7da2245c2070099f131ff05fed9b393dae36b14c68f9dd0f499e71388fd0aeda7433dddace583af50b5a545fe0642846c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b