Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
35d764cffa7390a4e43570635e1c38f0_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
35d764cffa7390a4e43570635e1c38f0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
35d764cffa7390a4e43570635e1c38f0_JaffaCakes118.html
-
Size
1KB
-
MD5
35d764cffa7390a4e43570635e1c38f0
-
SHA1
2fe51ff3c8aa9c9e6f2356b69087676f8d59f13a
-
SHA256
5373e7a93efa393aed0a1a08ec445f2214423c6c415ff9699d59db45ad94b466
-
SHA512
d479ad641a50fb5cb9d0df5f7b3086d2cd1c2879477efd7cf6b6dc8c1d3db1931479e98ebf078e114228522f380e77c3e7bcf7b65448008c181ea8183d3067a0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E81E371-3EE8-11EF-9982-6A2ECC9B5790} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b704bc999974ced9133eff9ff156a2ac60b27212e28d9206b50629ededb8dbbc000000000e80000000020000200000003ae19ed9577a2e1d7c3e0fa8358b2fb8d29c2540e8570d1590c537b8f3a3cf31900000007397b1164a2f1ab37f536196b7c6cfc11bd54766acc64094426212fa6f02b553ade8441674b42a1e7aafa68f4bf1b236430c440fff18e5556175088a152ed37896fc946e2b01a3559243b5d2d70e8b31a09245e3532434b87515301256fea52369a3f5783a129d5c759185466ae228878ec69b9fd84c258947d57d778a5f376d8831cb11a13382785c86b26d9fed09ab400000009e0ec085c3de647d29ed7fc846d2d3d1c011c82519ab4a515b95b0909afe0fbecaacfa1ecfcb6a91d091bb0c392c96ac7cf260c3e1f89a3cd27710d913f81b66 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426797296" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000bb8e764a3f21801706a94b2b3eefd340d91e50bbbd887b0b462390e500058aea000000000e8000000002000020000000fc0c4b2bc3b4512de2538685b04b66306504ee8b84ea280dddc2bff3e50efa3320000000540cf403bc69168a4e81ecab9b4a29e09f4e0c09bb23923e114dde38981526a34000000041012f0cbedbe4e9bac3a686d852ced13bfc8c6dd1fd974234bf4896e385942c2e31db51a22b16ab8f51e6ee5e7b30afb9c088a21fa173b196cc5f00420b3672 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c4e172f5d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2096 iexplore.exe 2096 iexplore.exe 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2764 2096 iexplore.exe 30 PID 2096 wrote to memory of 2764 2096 iexplore.exe 30 PID 2096 wrote to memory of 2764 2096 iexplore.exe 30 PID 2096 wrote to memory of 2764 2096 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35d764cffa7390a4e43570635e1c38f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b5506b0d805761e761432c70d3f537b
SHA1ac536ac5eaf3b9e68540db78330054af412218b4
SHA25685239e7443cdea7b2b3b87484ecedd3784c9001f3cea8b6c316a51118aee87c8
SHA51221429cb53a2d58a5a6b0a5117b8b56b0fa1c977d32d5d9712aef998263d27d918bcde9f81e8f2dcd3de49154c2d5180fffa7223d955535b0928f56da31d926f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1fbe9b5ac67e4607747167c767d83d1
SHA142ef13013749ab8c6ef64cbb6f593bb3b62a4eb6
SHA256c073873708ec118a7bcd266ad310848f1344ed3e2480915b1bb3c4322f652de3
SHA51220ddeb6148d8bdcd35b7f9a100c98e88f6269b25ef6a55fa7d3baefb06c8c28570cb14d27a4b4ebfd5a49e29793c69bd6a3a777c09a07af05c425fcf98966c74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad623d2edcf670ac902a079534e1b918
SHA1edd6d5486c974010921a54d40f551c586c3c4cd8
SHA2563a346aa721965374a367368d2dfcc5b22a5167722325d15f887f97c456d2dc6c
SHA512ff69b81fd54476a6029a98310467ace47b02ad118c0b3a81d05da9eddc4c618ed2a185954779c836fff18f5fb43737adf560a2b7efb5d9821af13bd5788007ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5935e34435e58820fe4907760316d31f6
SHA1f74471566e73809c6ddaa88aed13d13296af9242
SHA2564b0065b1dbc2da0e5bc8b240240ff7ea7b47c77eb6997476e9ee98bd1376125d
SHA512717e1a79725175e541ca41ff3389c740ec60278f75d95b359f6095d71dbcf0b2e0bc560b9773da6f7ea112cbc58aa83ff75422bae1a9c6b2147626af39c13f16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540ab5df49b5deb0bfed80de2c88f96fe
SHA17342769210244746e8b761ec21e4eb6e379b3ffe
SHA2560b610e6652e117a21211654551916444dc1a959688a2e72b2c8cd901965b5f39
SHA512b6abe7db03f4a239cb7c212c3d4e7a985b49572b0830f79b2097c5c46ba95e8248c5f106951b334e1da8a5a342bb3e9d8fc41599ccdb6f4c71007788938a7b68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b11d889312b9f9112b5776749e0130a
SHA1c24c0f6cf993cc4e84e4bc364b7fad6bbad22e81
SHA256ae3965a78f915aeba75b37d32a82daaebb46745323668c87c9ab115fd039e4a5
SHA512b2af64ca5a11ae0893a9adb6a9bcbe31c11cef9e2b2f8dc2513629f4dd607c44f44b6e647711514cae91d5e581300cbbb8304118f86efd52c641bdd254778082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3afeee205b5f220546d684c4a20706f
SHA1fe52c2ac0fd349c3ebbbbe73239dc6be72a110b9
SHA256edd5a78816efc66a2305b24e1e5cf7e1fb53b3299a46d8a9f56dec906f56606e
SHA512fd22e4df510bf5bacebc115d9f1e8e2ae7258b1f5318aceeb5d100c161da71ddbcbfb21a6638e08c38d676f5a97c0ef54ce9c44156bd405839f4571b65b60f9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b923636962f95319a6a6c9a8f9560d0
SHA19bd34ce43821a86420c0a677da9176912d48a192
SHA256755ad3842d4090e80159ee58a2b8a78a5d141ecbce8d9b5a4915634127572314
SHA5125d092fddd61cfee1d6deccb7c3089480ebe728ae3b8f86587f1c7b35ca91bd0fe565e302537183f62c9c84280eb18fb68a587588530c87ec59820e915e07c9d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a82edcc45a7fc65e4925d7d1801b900
SHA1b094778b1297c9ff998fe5e4f79c4cec51d7219d
SHA2565f592077df7429fb98f400a79406a46c5ced5164f666830b392c35ad7ad67ca7
SHA512c5f6f3ad74a9a9ebcc46445f18e509d994a7421d62310ab9f7300cd6926f6348dfca1c17b31efab2f73d2aa9ba0f8ae1ed66ebbce5eb559ec2b78394b2547523
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507e2401c2538b3404f5690d47362835d
SHA1b57ac50dc555af8e0d4bce812a7d8863f55f35e1
SHA256030377d19a0a6c296c7285b0403dcba223c787b9d704135b823bd752f670d50b
SHA512b019caa2b4896d21c0b4be00460b591e191b9e8ac4cc49ac63fd2fc2875a783a8136cdbca1faf8b90b7fd5f7e784c67eb7826aefa9cb98ca36352abaac1ec190
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a94d120b2102b8141c3a69999e11f3d
SHA113d711dca14b66237b1e991bc7b8974503740d07
SHA2560efa7f1a6aec4c5b98cef4c06141e7df6e83b92a94f6bd6ee36ad550337f970c
SHA512c78f1add24e7ea063fb3129efd6e04500ae1ee1752144b4d75dfa193a8ff663ab540dcd4c84dc916019c98ff5bdaa3172d42a0fb24e7031d90ff82cddf79e66a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560f772228b88abbc48467f89e7c586b9
SHA138a0c45eb2eea733784a30a96c11a6bd9713ab28
SHA25619c843b2ed254df710d28276fe9b140b6474752f59fa43c0ab67f4cb45ff6d85
SHA5124804d73538076199e47f92bdf13d8825ed442284c8ba8c4f810575dfee2238dd3a7a863345f3d1ab8fb38922b48f42c11e47301b76ce247cd1f647b21b3db41f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580df17e1aa8a58331a35cb60ea255291
SHA1f3dbf4d87e399a76b6d2f661917b586f3d5f6046
SHA25643031796814416db451cbb78600a337ff32d6dcc4001d7cf77d8b405e5e96c04
SHA512e0e2f26e136ab6f5cf54c6fb453d2ea0b12888b08508f1d33f71898227995a88aed1053f0c43cd89b352e43415051b3f7e1ab37bcdce1d9fb5c08dc0bf0a85de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e82ee2fbdbfaec8b867575deb0e46c72
SHA1db989a2bc3404a20f83ad5fba4ce26433dff5e44
SHA2563b23e1cc9d908a74acc07199993863c6bffc7364a4c0bf9150457484f4a72224
SHA5120aa43525910b95ec4ce438a306082eb2019a678c06194122a09192e4ccc0a3ef6d72453fa04f1f7d33198e12d49cbcdcdd0b55530a55c6254b7ef24735b3ef5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b41d38ab4acb4f06dc41821fbf105f5a
SHA1d82bc9968a1ee12315e81e44790ee138e515cf53
SHA2560c3ce37f89a5c686dffdd706238532082d22ab5252ab8bb02761d842ce8ded51
SHA51248c1922df3e3c79abfec8e9d3d52cb108bbbf5240896f31222fc5d7661c6f391ee75eb060200373e6a62d99e4f9222f7fa70b9d685b5c3fd5e10a5136ea65053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515d1fe69f55359fe5650134917e198b3
SHA1f08a674098eb40201dad0d11eba82fe3da5b59eb
SHA25681604401dfab9d6a7b12f49bac3f851999dc9913df593b57e5f65b98ce5ed39c
SHA51278347cd7c8176315840a33ce1e9e58b7aef1f427837d2ec9469466cc8a6f06c4725b345f81c7066bcf4866c7f49ee186cc56d27832d3ea7c59be343463d15a1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0fbda81227619c69818d3c6749b3fe2
SHA19cd8004d60b631299f029d35462adc13e939face
SHA25611ca06008d3222392a53d59153394f7e4a1fa22738bf0832a8a8bdef5f4c59c4
SHA51296eadca6fb3a647174d8ba7e4691dd6b501601a2dced18e9a4a786a7af5775a3a9f16c2c62c706ca386f0fc6d1e1b07f348879d6791977c9efe27aa701914551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5868d5d264797c06c53e521dd6cac9d31
SHA1b436a847eb28a3ebad080ec0391ee9e8ebb93881
SHA256f429a35294900bdec5ca0a53beedc82b31cd3f8759b2ba650e07d41c5498e250
SHA512a90925319ed903e6583d9c58300db43a273e7da24d9c515d6ddf77f17fdbe5583032feedfdde9b607a075a9d5f62eea8ed2ce0e4521807d1dbb16c937524b9b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577888fc35729536e023817457db0ee4c
SHA1e6d4d475aad90434fca4ca9555ade0b8400224e9
SHA2560e0d40fe8c2cd0a524a84b9b01d468a8bf67f3110e2eb470ac9f312d19c51842
SHA5125b6b9dc15012e8005f47636266d65539306c46891d926633b8bc0d31ff82deadff39bdfa7022b7ee6c04b5301cbd4f1c6d4ee1a0cefe84bc2a0d50c959932c15
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b