Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
36baca75e63cde68a5fde289767b6ae6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36baca75e63cde68a5fde289767b6ae6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
36baca75e63cde68a5fde289767b6ae6_JaffaCakes118.html
-
Size
7KB
-
MD5
36baca75e63cde68a5fde289767b6ae6
-
SHA1
8c5e97c8b9f9ac67c19e557820cc6f90b0321401
-
SHA256
34837d342b149097e4e8ba2fde1e23beaa44c2b2355019cb994090f0a3d0d0a9
-
SHA512
53db33fa5eafe0a97e0f3cf2671f95c94f444e6f05f10bf006b9390f86e82205863b10769ebf80ed0a43e1788c56fcdbb6d1999f2b21f0b585ff8f1ddb5db7c2
-
SSDEEP
192:t6hwEVEbO/vbSYUsR3qidR62RWMO4slVASu:tqwNaRRBzRVO4EVO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5913A631-3F0F-11EF-A4F3-F6314D1D8E10} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ad76301cd3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426813929" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000fb7fcc15316ae04426da637be0b5a78b1470c8c4d056cbbdfb2c249f66718e0e000000000e80000000020000200000008e36b550839513b4c4f104a4ef9aa8b9b330c6223e63637814c2743c9486833020000000405bfdacf444eb85ed84f54b898e6af3058ac4a84a4f84f30013a8983a21d4bb400000005c6281f2f281ce5c297366b5c36c71ade04ceb94556708dcb47ad571c7780b4019722625205c4148fe13329b0a2dfc4787c995326033b8de0d74fe423ce2d11b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000008af5c1f718947ea4eb5f1205da7febc70cfd7ba1eebd38f29dc5678d75b9c22b000000000e8000000002000020000000195194fb61120dff6c1498f2a5f5414e562ff046a0a2a78877aa61010508092d90000000388ca350c4d4502e3f82cdd11eebf1d7f163393462e90128a5ac2adfabe280ded1eac42d23561ff0c9307b1670b175da67bcffd95ef98af3217ce2024b5f8336e9bd3af9546a97ef893168a30456b1812bcd69811814da2acd9d8ff6d4f15794c4bedc7fb05bfc7cddfe8ad009b11d56d29ac7f81d6b9eb0a02acd8f76f362053f3116aa06d7e8031ef2fd4d19f05f7f4000000069040b93c9987f41c3f403d1821fa820f2c0c2fa347d1c522fcf9be7d895a79aa7ec698a9a16a3ea7ef6b765d122e780d94e762d38f7156131c867b5d9be4b09 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3068 iexplore.exe 3068 iexplore.exe 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2136 3068 iexplore.exe 30 PID 3068 wrote to memory of 2136 3068 iexplore.exe 30 PID 3068 wrote to memory of 2136 3068 iexplore.exe 30 PID 3068 wrote to memory of 2136 3068 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36baca75e63cde68a5fde289767b6ae6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508ff129e8700d4632ddec1d015dad310
SHA15849e7587f141605fccf781a5fdf2bafffefece6
SHA2561bbe069de6a9f10b1a23af5c5569c4b7d3c38731cdb065a39a8a95a6c013ba5c
SHA5121714d7c535fdf8af20767782ff0a616611ca2d7938d156642e05f1b807468b7b922b5454f8ef7c6b6aec9143b92a4b2a23714ffa7c5539a9e844562e6309bb8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510d59142c4e226301222dca15c3c632f
SHA11e26c04875e5b62dd83f0a2a7a32771688293010
SHA2568ee44f5c5173c1cffbac9f6067e9260f0923c195725c0cbe6ec6086660173893
SHA512f19d22af266d748a5cd48577e725bb305364a8a02317e43aa88abf1b3548ab42eda5ee33d6190205540c22ef6e4d767eee7fe1e7174a83416c038964797feddf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8d091c03dfcfbe729378778fe8709d2
SHA1c56a47ab838a7b8d7e60e71d32bb6811211b44c7
SHA256d7e59b8573e91e1d990702d07f186ab36b504db70f29eccb365cba55e444f121
SHA512c0110e421a46ac66af9d0c787a723a28c92acc62cf439e1beeba97908701363e7986fa942a66f6d0a3d4872c6116c43a6a0146a3d134577e1cb91e3d8927d186
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8b2ef01a4fc47934202776cad1362ff
SHA128298a7af2c8a52bbb4b67c5a567e355ac0a7172
SHA256d2d2d6a179dc0cacbfa14d66782013506f5fe7cd1ceff58e39795a05eac6cc62
SHA5121ad4ac46c6e21f34a6b8864fc7c20cefa8338b28f1f30b8cfc51c238281a43a0586f3934c6ec956ac77b2690711d70f4ddf25be437258d42cc3139dfb43c066e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514dcfdfb78e90fe3d0a103cdc8620e84
SHA1e800dd76182bd4ef3858e48b8b49ca3183fa9cff
SHA2563b132ea8e5fbbba05e69cbcb4f5396d54595c67f99eb6fc4c2be485ba816206b
SHA5128d7d4241822c4be41990aa4dd00033fd1de1456879ff4d5f953fa9fd858a2a565ca6f71ca26de2785fcccd9f57df2d81a50eb0a7be504ada827c6fa1b8385f35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5133be532d7488fa0125b8822d54baa7b
SHA19ce105040a5908c9802a7751e6bedcfcda7151dc
SHA25694a838d9897842544259a2599b3ba13782a0787cd0517bf0d3c824374cfa1812
SHA51209bfa7a56f61cf4f400242cf4fb6d9b280c3ca8a8adde1e85201fc07b022c780f53d646f942d49fb84ecb9719d4deb05370c0b62e407e080aab764a4f3088a47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5836e30222681242062ab8912798eb089
SHA10105d10fdc98706138c0c0c54ad4bb3ff777448f
SHA256d17494dbc0c99232cd1f82501ea3da14a9e6e66b886cbdae67d1ec8a584eeece
SHA512cc16dd9cd722c6f836005528c29e1d1ab5d4396372972bb2baa8acdbe7783e9563dc17015e84169798c71a24202f20b6a6ded44773eb6368a22abb6f49ee9f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54860cdce503698ec2576b7852473a21d
SHA1bbe2cc39b0b97aa72596611ea94210b77c843027
SHA2567ceb802776b33e05dd8554a4a7629a887b88606f57e3dba31af6b11c1c2e6ef2
SHA5128fe03f92037407bbd61cce6cb3ed3adbad313202bf91676a19be3b4ba8c243a21c10e72b9b712c83111db264c3cfc221fb50a71b10643bcd9381ec302fc58f4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef15508b62b448b689e261b5d2da4031
SHA1d4eb9872f2e9f0276b4e59d4eda4e918edfd6631
SHA25611c84715934fe86701d3800e3d41735d5549e22bce8a0a608ec13b2f0546935c
SHA51276c8ebeb08d0ae5ce7260a946a5b5d4b39b86c7ac57188ee1e46c8dd593b97e4549d7bae481368071036ae8bb5b83ddf6b7386a883063739e91c5f0ece520889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d530a596f2e6ced21ef31b72897a2d39
SHA1c967b4ea18e20c26d67409cb8e0d845bd4429285
SHA25608621238537cc54ce42e0ee8f2d9a1cf757a49ea6cd57e7cd1350510d83e57bf
SHA512dae3bc01dde59fd9bc7911b0cea6e77bc5a5245ba17eb1217046ad7ec011644c8226ef0705ec5a835327b9d4f33cd9784ffa7c7e9c08b7146925ae9dc4f8ba5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5618c43524804a95e49ab278d434fb542
SHA15c8d29ceb6546575f2daeb34e087ee71683f0c7b
SHA256a0455ae9540853c360defd8db39133672864e91947c94b78b46a27a9f4193842
SHA5129930a4a76dad92c57c53bc47fdd0e8eeb355a9fdadc00560a9fd9c6493a43336092cd413a93c7acb13f1f1b192bfd035bfecc8df261d192dbee6339ea9fd4146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6643b9120a3a827218917e5e6cca596
SHA10649f48fd3833684e6f5dfedcec548b45295a304
SHA256cda454fdd5a6c1901cd1d846a60ef7ae10c792f97043ee80c93ec43e57c5f618
SHA512e6ece8202442c81602c1465f025a4088ec9732eda35f1a4e0fe43d7e9baf6e76086d621f1911f4d81fa31e25f2c342c96641e47cc5bf5bd03d30478eb8e8f3f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c20e0815d22aabe1b1deaa230968df34
SHA1423f72ba8a4d898c744ee02e4ac2cf048159cd6c
SHA256338c0318990d176a598df84250e18da00a0b44e5b09ec1886017eb450a54b463
SHA512b5a6c3bb2e722757e8ad2aabe64daaaf0c819c9ae9b1b167d5b8c6e4231ab7aa0cc2b0b8ecb149294dbf52be0ea7bfd66a46b3b150d94b9cd896cef79d4c094c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fabac68b9aae6667251cf3e432b7b4e4
SHA13098525e4fbbb0454c3783bc923cf20dc8e73a22
SHA2565c9ee65099da263af5f098520cfa67081970e1b20146e27c7fa2abb91276e4d9
SHA512786ba4562356dae2f7aee790324df44857d40ecbea6f788dab43b74b08835de7815c90e6da9cfc761dae91676144c79c8b84ec7e406d0e95f114ee86a7c5ce90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de358d22d0d9214d13cece60947e6fea
SHA165cc0123a73caef7b2006dd0f174f11af2e9e534
SHA256d8f8a3404e4a9fb28100c195d27e5e477fef5f55986d0deea055240d02b40076
SHA512159332efc80ec62205e863ec654906ca981ff7424f5a3f089d1db0e403bc45d80a6f2ad2752038bd09010718baf1109edf8da4c7a550bd01522fda161782d3ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d86ff5d54493297e28268f191a1123c6
SHA192296281bb2af313d2e01f2175ab6d457f703ab7
SHA256fe01fc0daedc86bcb709d47f88bb75e061c77187493a04369396a7b408718c9f
SHA512db503db01f9294665a8050c12f0bda7edce1465c359d93e8839b1b19fbdd360d88739172fbccf2624133c4237dcb54731a6375b5f6b14fbd2f2b5062fefd19fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dab70745e4f2047045a6a262471c32c
SHA1011f5f1aea35f73f783f70f8246ef64eefbf3dea
SHA2567da4af36da631f3211b9c1164d02bc5b8d91f05bfa97e11e17a2e1a9f96ed583
SHA51275d467d4ea37ce4dce793c6f62cd0709d7515d0bc016e8755e51b348cbe26c33f8d1712eaa964edbd86da78e5775fa6859aec2f47a23b103f2593a9f4f49dc68
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b