Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
33c5b082fe9f8f64798b31fdf0cf480b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
33c5b082fe9f8f64798b31fdf0cf480b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
33c5b082fe9f8f64798b31fdf0cf480b_JaffaCakes118.html
-
Size
1KB
-
MD5
33c5b082fe9f8f64798b31fdf0cf480b
-
SHA1
e69860a6156ecbf11c16aa5382f97867ece0a640
-
SHA256
2b619ccd586d02f6edce90227fdbdf003ef68b8665971a197833cacc6dbc7cbc
-
SHA512
3360aabbc9d2c613b80553f22c3aa957ff1044e9c20f32248bf4b68b6634f0911102457fb52857d7d9a39a5f50401ed1f2a283e8582fcf8b8d3aca695bfbb81d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f478fe99d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426758012" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{276E8CD1-3E8D-11EF-91DA-667598992E52} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000a12c181b2478d2a92e94ae26791d88322bdf2cf3aa131fda26849eb2b7a66a39000000000e8000000002000020000000f551d29ef526834238614f466661b8023d879fc66bf6c4f258160bce7b8d5db490000000c84c5d9dd5f3dbc814e8ad1d5936d6747d16dc0f8d9775c0fe52958e744386a56ce95a839e6a76bb9f4814639372515b27d02604e8d0544dfcf7a2611cc380bce3db9a67f68ab9dc48105a02f0af67b86177b5f7e52def09523594754777bb0e44ec106b59f9708d77538635b5e92159f4a0d2a4ebddf4c0ca160b73e97595fd1f26823cfa74f06f85781d31813c2a4640000000c25546e66aac8cc59c6100a3bed4aaac836d1fe86fe4c58622a2222ed95f31e7b7ca9892018b57be7cadcfeeabf28679ff69079d6c2b76d0cadac15cad2cc379 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007c8ed6cc07d7412f4c9f3b7227c4a9e862d4fce89c2878e84d5747339490c38f000000000e80000000020000200000007a63375f01b70761cdd30049b3d2f2536746bec493bd73b0605e37c2b8e3277c20000000223399b06e1a8df0eae2732962ee0c49b36478960e6d3cb3cec2485078851a2b40000000207795111acda8b03eb452ed147800402daea7c7261809d447c3f0886a86d89c2c10cdb353de8e23a31f2d580846e3e120bacfd3977891345f7f7f6fc0bd7827 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1448 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1448 iexplore.exe 1448 iexplore.exe 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2260 1448 iexplore.exe 30 PID 1448 wrote to memory of 2260 1448 iexplore.exe 30 PID 1448 wrote to memory of 2260 1448 iexplore.exe 30 PID 1448 wrote to memory of 2260 1448 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\33c5b082fe9f8f64798b31fdf0cf480b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa13a20128a6681576d4458705600c45
SHA1eb3413e5a8b8c9f8638ac332ad1a674d531471e2
SHA256c0b43cd8aeabe0df639ba1f4d2629c365743baa5a7d6d27b4e7e8cb369a805f0
SHA512e354aaa470982d67258af6dc8ec13acf8934070f1401f6e214440b9cde8c7884edb7268e1176bf971d2e4edcfa3d750a7bee83780a865f93f7d8674d71e44289
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52439926034ab781b93a7665de20bc3f3
SHA15bca2135687175a8762d5fa4d973191d28225999
SHA25696ebd3cdfe943dcfafaa4e9004ccb00917a479e19b7ae73addfc2c313d3cd30f
SHA51262a2ab37fbc347426335e47046c2753c4fd79d4f9e14f94054e5b85419122ef9eee84e4696bb32c926dbc1a3a886b0ab9a5da79b4692aaed5477e31c02f9dd42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f27e028edccc5c5be94dda46188c5630
SHA1d81cfc097ca2eda6fdc97fb3718764f680adaf84
SHA256cd1721a002fa453df0fea525646e87d98e8c29c5e05518d4e930021eebd49be8
SHA512df47636176fce731b204c1af20c0df3b782b05bc69b28fbd66954ea174beabed10ccc19ab696552f23f57327dd1627848c0dbfe30dd3314cf53a11ba13f4bd33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c574bc125d1c80fb08def3f642ab42f
SHA1b8a0191c427d24fcbb6acb96b4bf5d66f3b445b2
SHA2566badeca3827a67d6e88265b80bd6a8f48c4bfafce5daacb8185f07e126dce176
SHA5129f27e86cbd9ad2c3b4a2b23af0c1f8562b08139c1e426f1962bcc4346085810dc209e3e7c7c4bea69d4413c1e139a86e94796cbd6c984479f9ad46d0d8692933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f093d79b626e9fce9e4b290c995e9832
SHA131fd30acb8e8e0494979b8b2ffa25dd2a22547d4
SHA256b1690d8acb664d5af585e0a4456a9809b5a740e8d5cbb912f42b761e7c5c26b4
SHA512c36716fa6965061eef2fd43e7e7b1b582faeb6a90d6a0261690df42ad00d0f1bf8dd8a819156a5f8a7c8ba47408620e26cc8cc780a6d68e97f727efe53c29247
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557bb1935d75a22fc0760f72f3d4d3aee
SHA1f11ce880a543f6e88c13ad00cc5802c20abcc1b6
SHA2560d0698d58258ba14bf2f63eb12c7d4129f0f875a6dfe0a45e4ade23656a50842
SHA51284ea5c4adc6e93e5c273cb7e111002e75708819aed819ac845292d6a296f3c24a04aef580c30292941e85461608bd56b59c2174f3039e4c3697fb002359189e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dadc67204859eaa42f2d249e16955d8a
SHA14b79287727918323e1778082a6aa3445407bb4f0
SHA2563f850affdf5c907cc67be0acaec415a82c19737b26150ad30594a96c9a6a7732
SHA5127986a94b970c7662ba415496cc41f452ba08edd988bd298ee618af12052a5e236aca02ac880e200c05984597341294a3e9f85d457a3d9db8d08ff010734d3814
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5aa253e401a8f5ce61e9eeacb8b8627
SHA1f5a391c84b720fae68afcf4d13c7e6a9fb06c7ef
SHA2566b595c84a175e43f9827041d9af8ac62d3bc5b187c3662d5526adfb2b3fdeada
SHA512fd03214695bc0c83803fcf407ee214420f499611cdc002e5bb99e10efc43c0177eb4b60a790ec7691c73798dc2bfd3c9cf4fc5bb1636863ef827d0179d644715
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a87125e8729743109b45f625bfe55b9
SHA1f78aded1e84987dc337a2e5f45df553360d300fd
SHA2568e174be9f50e66ac680525bda3ce26e9cacfae042dbd51c12d2072a6631b201c
SHA51290955c6293c2853d1eaf626f219924f5ad7324170ca2c7849c02b1d53d29b63d6071f2654c3414f10dea2e8a9d0a73e2078c560e9c99baf15e807663414057b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c2ecc25cfb681b137851c94da944a50
SHA1c7e10cf054bf976ef699d108e6d6a49f40f12242
SHA25663080bc4ad01b534da5a9d14fc5e2450727a873d940d795a15bf7131400ddf3b
SHA5120ba8c3f6627000ea0b1c9694c614db20b1f75c7cb27f232a726045307fc5b9cdba96d43b3d98f74399bda0c651906942a207430d49b9a4c2bd57aee122ada76d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57599fb9de273b20d8feb4962c967d05f
SHA103e2b0527efd7b6b0fb00355cb0c986a2fbfef0d
SHA256934cdbcb91573f6c69db02d3f6e2169cad738af48858e8a1d5c2414814ef4857
SHA51235924f4fbce7b27b009e8e27c12fb0c72e69cd6eda9b924ce6bbafc1a09a593445c77bb6b75e3fd3ca019981dda5a2852afbb34af1d398c807818f65ed41904c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5867622b75dc3ae2910f7282a6c32404b
SHA10e09a7288f999efec093b6d017cb00074b7e6d9b
SHA256bf4a8280a35be0ddbb8b1bd543265e226806da1cff77c2bf8aff3018c64a24ee
SHA512e6d7d5fd8d4cf08626a7512f72d57dff081ecfe006a034e6ac4e122b7a656032594d242b337dbe66cc3fc7111aa413f88ae2f3ce00efec7fa85ab27f968caa7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5704c5a055bf3ea145f3e40e767f2024b
SHA1a695f030595580799120e7f2ead5a447fecf05fe
SHA2560716800ee4b89ca3ff5b38171577ad291ec1a28cec209c7f66e3848ea0f4c3ae
SHA512046d72dcb10251cd268d0a56c931432113f31e83dc9a80d0611b9ca53342f9d0163194292114f403eaff4208daeb7d66e084d9f77ce6da4691654094982ea3f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a36596bd8b129fd9aa3fde1bbf053541
SHA1597882b9e220b652e894a27d7f2989e4495d0aa8
SHA256ed89f6ee24094625834b58ebc3e5c6cde4bd52a4b6a0b8181571335fb5476696
SHA51215a22d1c72d550756bd42ec2bc747050fca3ece4d57b8db75a29e596e44715bedbd4415210396db845b9fd6acbca4af3b6f7995ee28fcc1c726861682e9038ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b946affd5b7c59db8e6aa4f7ecc1707
SHA12d6d4e72add07fc126fa63301e8d890dd47a7d40
SHA256bfee4d6b9a01875e7bbd2eab2206ee3285fbedb26d2cd922891502716a3628d6
SHA5127c5e824d2959ffd52d5d5dfe13ffd6496a955ded4fc4b7b9cbfa5580a7425b77a178ac4fd78ab1b3d4267595e5b7cd17f5ab1e1be1227cd416583e0fda3c9be5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545c29926d809c103fb4a669de1ff0ba4
SHA1805bd5ece2e7914bf6ee20d066e4791ad910bcdf
SHA256e021637a066aedaa1966b532d3111f5cdfc4b74647f13e43475235830cb88308
SHA5120c3496fed09be6c4656568cecb2186c53cfb4b3ae07c60c4eb43464472d1e6fce0939a65323a8b2f29ed484301a6a4eaebf1fc15c636907da33c6cd92e18f501
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d26a5a271c626dacc682ee9e5f2fbac6
SHA1e874ca5019d7a7620c4289e38787abefd89abcda
SHA256794992fed2365306ccc653cf0e5d2b0edfc2f84b72254f57907aad78185fe5d2
SHA5122aee93323493a22633f0fd4ac1079acda2a51c2fd7fba4fea30d460d6ca8ab0f3e0baaaab4653bffe72c4c80bab9955b2881f58a6fefa894f5e474ff4d91ef0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a80bba102513a24ee26f13eb596a3280
SHA106041a94e15fb155f894d30ea21ccd282e3e28fe
SHA25633763942933cc39e0caafe8e82c0b984b37750e980d22e8dd817580ad25e0f98
SHA512d2dcc91b3bda98cc8ea4082e7a111c1c5640a0a26b473c71634cd56a72f2ceb56d63ab13f726fe107f8f793eb09ae439e14b35a3fbe3d2c12e1e19a67a353def
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b0f229d63ab496d5134bcf4c520518a
SHA19ea3e972ab3474abbfd92e01cdf264b040faddd0
SHA25656c603404d7c35d1ab0fdbbbddbf316b4641ea58dc6cabf9e315fbcf8f518fd7
SHA5121a497e9ae91ec802105d7cc2827171339f689bf8fb1da68298f966558e5a4728034b916d5140773af8bd1631058aa3bf39a3f00d5f76233cc8b9d825be129aca
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b