Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 16:59
Static task
static1
Behavioral task
behavioral1
Sample
35987b4eb81f8fe1277410a78709f961_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35987b4eb81f8fe1277410a78709f961_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
35987b4eb81f8fe1277410a78709f961_JaffaCakes118.html
-
Size
44KB
-
MD5
35987b4eb81f8fe1277410a78709f961
-
SHA1
db66eacefdd6a86f1e14b80eef90511030682608
-
SHA256
6fc0b50111647822d6f63cd661f39069b2765bc87b7a6e3615e636e776302521
-
SHA512
40eff02d2db8460db3da2f438b7ad4157a6de5a2c5aa2a6c3c6db68e233662d6f26abdfb30067ca018955031a8eb0ff4ec15b5bf6a0754c9a13a7b089765a1dd
-
SSDEEP
384:uKOb8IFLr6XpgnQ9uQabYgPv8DwNIFNTEh0+T+OtFHjwq9nPcM7VwjvHo4bZM6O3:z2vPv8twHhFqfU5jTyYO1Azivef
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C14492F1-3EDD-11EF-B001-72D3501DAA0F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d9d395ead2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000d17ebc9d9c63cd6111ebf32a1fd60d111a3f38532c486da99735f47bcc98530a000000000e8000000002000020000000ededce6b7affd97d7bf66c5d414fc70d760bd07d68c983755e379eaf7085bd982000000013f680a0e439f6b56107b63a60120138980141a37d248e9776eb8903b6b716c0400000001e541ef76f34f3ac2239b37ea245ad887c8e9d1c2f356b32926d47417d6193e09ab4598a380a94497d814542534e8a82cbb1401316ab7e3215d21acca32c55ee iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000875cbc977ef306e0715f4ef738eaacb48bc8a88e0cac6c9af9b2f522f3be7b42000000000e80000000020000200000004c6a08a95f64cabee443dd5387e0029a299ea5567f32cc1cc2103baba4e54d43900000004ff99d62dd8d3328742784f987de442133cb35117d343e4e9e188692892bbd97c18a1550038577f9f21d5a843f50871175e0e0b33713d42e454ccf701db79a285a3767f76ef8d068fd75e5e285958932fafe8749ea4fb1d2792acdcbc859fb08721ab79ba80fee8393409a33ffeb25a1ea82c55f73d8d43b7b96a9987f522bb38bd6726a3e67729c07efecd3d99a40e040000000b744dd81a1238e0076b2fb34ee4ca873f137a3765f7d6c6b7d2bb222d40b8af1529a4b936a32c5d3300d9541480223cdd2c029e0a45c3d58dedabeffe2b1aeeb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426792630" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2948 iexplore.exe 2948 iexplore.exe 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2256 2948 iexplore.exe 30 PID 2948 wrote to memory of 2256 2948 iexplore.exe 30 PID 2948 wrote to memory of 2256 2948 iexplore.exe 30 PID 2948 wrote to memory of 2256 2948 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35987b4eb81f8fe1277410a78709f961_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c687533da2ec24eacb6e7cfe33e6abe3
SHA1e7bf23a311fc47fbf09baf922ff0148adf94160a
SHA256fb9f1d10f3c6c98c0e98fd14f4852f0bf039dc2271bf41dcb0b2221bedc8cebf
SHA5129ae9c90fcb4affa7b63dd6c627a5169739472e4cdfe8c5295b8c53db10d340efd64203c22c5673ef648da16bca56764cdda2cb97330646471dfcfa0a653f2a5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf8bd67b35367d00a863a0ee064fdb73
SHA197059348c1a440d5e3da293225829805f87c96c5
SHA256f0c64cdb2f836b95d8ff050a47e942bad005d2bfce07662afc34c110cb0b9a42
SHA5122c83c722a80407e1d084deb13eb35b0c846a15d3cab499ab326aa2c867d50d684f0ec5eeb0128d83315aea51be10403e356c81b7d84a1c3960b5ce14052ed8a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d448f3b1837c34bd02cdfb73cf77307
SHA108ee61b1e63a85d1221eaf68d9d536ad28673b33
SHA25667b612afd5ff5db02a8268a0f1a67a079a33bd58c44424af01f3b88b397323c9
SHA51219078e76593556722f4fefe268635219a6a9aae918f7081ebc4a490287e8b196275ace84749ac4087fc9f082bf263036c62de0a0070fa45b233166b18d7555cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e5990b18cc228147ab6e5839451e4b2
SHA178bea3202de27bfb5627f7410b051d6f3bf92b29
SHA2562ac713431335efcafaeada8534a5c2692deb20f3ba08fad52d2fc8352571e633
SHA512c998ea7f50f9bf29a1bb79e42c92e2b65a05b326209cb4609fa90b1df7aca8350c650bad6a6fd78371398f01235081e6d1d4dabdff1b7ead727547cebb720f93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7448b905b512bf8297f6565af1b3388
SHA15bb5c9b79f95966f43714324188b10829ef2f610
SHA25662b13b0ead47798756028dd6e4d514f6535eff54b052209adac6dec3c1267e9a
SHA512aa23c758b019e3cd614beaacc11804897f473d61d84d79a185e300ef5904d7e273161986249a2972a7358607af93e301fda978f2bf9fbe498d6ffe0bff77f432
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab71557f44673faa2b5d4f2e33406f8d
SHA121358b4cd1d3c22538ae657726726646feef21bb
SHA25687d935fe1e20ebd65c60c0ae206935b09b99e516e06392f0aea792c85ac3c193
SHA512a21e4b479fb82549032ad0ba210d88830c89f9b4b6ff7ed6f84c8211a8bc8e0969a13872ed020e4463ba3fdd56e5407d510f786da531b492d18e6d245232fb7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe063b0950d25dc6706d88d5316560e7
SHA19f9411130690025b72f9a9db48305c2df78e59ad
SHA256847f24853364dc01ff1b2f2d365447a1c0bbc0e01bd442c68b3a6c259835553d
SHA5120a083c355420de60fd980727875c1a9850d345b2f704ffd96f910723aed148e09b1470a9f78491434462652ec7e6cb0da483829212760b4a1f89daf9c40cbc8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7d48cec4d45e441f19f705b6626f044
SHA19c4da362f8bb93cc52deb1600911593f71b7c6de
SHA256d31fc0d52f5384af71200ea5c4104f8ba7aa21d0f1dc315326e62940525cd981
SHA5127e3cc08e15932bc269226a4afbc4543946e937805abbfd3ddf88b3c893cc9ee6392b9422ae26f530b31b0852c2f964af7b9379938287e735be712d18539fc8d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef8bef9546fd260b14b038fc0dfff950
SHA1aa231c1ef20cea6c0f9ed157d3ef10055704db49
SHA256976a11997cfe7a4ae7bae65ed523d6316fd4b791895519ea86315498449a85eb
SHA512f60e49a40de092616fe7a70f43b3dec0e715eb5a04035da018877515d9d1594adef3e33c9affd93b3c04941c4694626c021b8e8bd00ad3fcaefe4fb2bf5089ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5febc64400546529db629e36290b07920
SHA156fef258046ce3ec21472a082cffe709987d7f47
SHA256ede74c247989ab71fd40bf6924a6e3bda14f83909c093f649578a291c42790bf
SHA512b2eb6440b81972d1d8020381189f0c79f07587cd6f9378cfe33939a2ef98e9814a6f50237f043539f52b725e27a2ddb2d6ea251fd7ea1768036307b4912512f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576e751d2c18a9eda4e0dbaf003850075
SHA11b11713b4fb49031d9033c3110a467a2c7eabf14
SHA25638ecaf477367cf0b69b69a4bb56f485cb38042ecbf13daf3469879cdcfc39a4b
SHA5125bc35b83c6e5f283e861e1f1e700ca299b9afa62fddffe3a5822fa331e0d19654cb2d55af6681e5b5de4b1b5ae359973feac42a6be707e20f36f48a32b72c167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b151a71a16c5dbfb8f06f31d024874e6
SHA114453d828b6ced7f5b7c6e79e2f93576c338071e
SHA256d748f3dcde7add5891de800c48e06d876af4d1cf765ec4f7dd66de39dafb1bd8
SHA5125bd33824a42d40a61b8ccf41c8f6ce3f1cfb0319d005d834d9b5d2e64675793838ae683a27d7f0fca4fc44312ae5b61b2fe782653a4133dee939306694d62359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58edc31d8f80b293feab9e610d8e56b99
SHA163b034df379363a24820179497b0c1b48d12d5cf
SHA256c33a123ae85f94f2bb290bf82e880555341204fe035cdc981342bf7303016b40
SHA5128036fb8b6e4b237709ed8f36c9b930a55a20bf3dd993862856c606b3ec3a0901d63cecab546518a5be91e55f2b655d2b8f0218b97d5c5e09b00c02ade7a5cee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52eea994781984fbb23c7b884bad6baf1
SHA1388045bce1d5ca5611a0710c8b1e82411fad4bb1
SHA256108ddf78abaebb1070e9a81d544748579281641aa9de4f477149ee7e391b8beb
SHA5125fe1c43ef07b2afa8fe2e2f3d2c29014c4876e1918758b7edc1ee85360c04b9a6b0e23884961e11c26c597bb3e2ca19d85b2a77954f3e321b06faefb48862036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513387456aa72a71479ad6ccfabf84089
SHA10bea204e7639c4bbf5b20ad35d6c4df731171462
SHA256c3033404f69f0a39691070250c1770ad45510fa128371a153a323a76d4e551bd
SHA5121ce84c7ac47cf101efe687898226a20fca9c1506c024ed6e640087772fe445089a14fa2b1242d4960385c5ab5657c7cf96a7de10a36ed99b24a32019fece66b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c805b020aef2037f2b678487be54706
SHA14866568fe4489e76775db06d299ffe9bac1a9ddf
SHA2566fd7c58510b5870fe2758ca60a61d6ccdef980f5f83fbc193742d05eee08e09b
SHA5122c724267124e84e6595683f6a642278372319a92342b25064d08758815adb3f6d51db307512bb85226a04f98a6cd705cb4179f0cc70e4a05c92829f3f074a583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d9edd5c3fe9299fccffda2a1b33f74b
SHA1c8fa6a5e80018c62e203a1da588bbe4cca671278
SHA256c0ee95f514e47ddc9450fad754bd9d9e607f1c0d2de9cc7006691619d193509e
SHA512f1c91b5dda8ed9b91a915e0b2c617f929dd64aec8068a6af2362639c518c1bb89a29b9f611ee3d6f30fa2182e2bfa23f14590a5724a4bce6122983deff3af101
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5287dd1d233cd7cdb6f28cc2e65497e72
SHA1d9fb1ee4d4a4a2d4c3d00e7eeca9d1bfa7aba7f9
SHA256509590d4f1405ae06286f834de2df5ecb79df909fd7d787459528641a8c01801
SHA512263766ff28b725ba1dfee221fe296389834bb79c33ef12c1721d909f4d70dd91bdf128b8349fd2e2d824272809c92b476aadf80b1705d8846b3ce5b1d96dec0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5a52282cc6136bee233468989a1dd48
SHA161a78f72d6f1476012eaf3b4fe49c94fb1feec35
SHA256ad149b34d40f1006e11781590951cae357d8f62a7fb4b79ebcb560ca21ed1eee
SHA5121d09ac76ab5a57c7bff8333f0bbad56ee86f68adeb3c366a4f9743b7183d72fe1f2ead04e0f842f5a0c068ef0f2c7090499aa2027a0372de60fe591fba58a6f3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b