Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
3c82f5dee761577a05d9870c39fe2589_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3c82f5dee761577a05d9870c39fe2589_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3c82f5dee761577a05d9870c39fe2589_JaffaCakes118.html
-
Size
1KB
-
MD5
3c82f5dee761577a05d9870c39fe2589
-
SHA1
63a0b281da947c6e730fd9a385f344d62f1f73dc
-
SHA256
96319e54b77cb573fff44afca43b5da5b97e48f9568ac2cd6fa8d154e28272dd
-
SHA512
852a9e8f44e264008d546379d29f124483a5b369d415b159bcb27e5e51cff97f4fb091ce1422a63b28fd46adf29f1124c8a3b895f960462ca5066f61f928d285
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00791641-4022-11EF-9CBD-4625F4E6DDF6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000010cc50f3873f1b18d05ee8931e86bfba3c2026ee12111119b151e96555f38dbe000000000e8000000002000020000000478be965e14dcfaa9bdc8221b14622bdf09fdad1a865e9342e99f7d9586359ac200000009060088f1e0649c297ea90ae816e774c381a8006ca2d5f03d524796c4aa00b98400000004318b6200adf117ba072fe8952b0a41e0a11aba7ba55619d275491b092ad12ceae869f971e49c3580de0811e778f78b3ba54549f5538313ad984b5c619e82384 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e006d62ed4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426931893" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000ff93394c9c2dc25681912d788d6d858e8f106e1f9dd600cadcd6774811ead0ff000000000e8000000002000020000000b410cf3ee2b21ff4f2943c0c0f8592b5897b26ff64063024e8e1fc104b0bda309000000027c821cf3d4a170f055e52f26666a1814e3a2d3cb1ab464ac96e9fe3fb7f3cf1357632ccc24f95071c044bdf605bc87d42f8fd70a1adb97d618564a8b2d7da79f3e6504c46ebd903ebab35eb26ad91f7f3137ff8710dc24afa9e6aae436c31d8829d27a9c40fb4a7d80e974d7da53e75bfea40729e5b5984828ae23bac2eb52beb97f4b0b236085be2282ed683096cdb400000007b62dceed38fde8fdb331b8dbf6777ee61127093120141d375bb25cd036b940f2e32f08eaf75db3f3650c51bb6e0f58064d13582a5ad91e6a203b0afaa16a910 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1628 iexplore.exe 1628 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2704 1628 iexplore.exe 30 PID 1628 wrote to memory of 2704 1628 iexplore.exe 30 PID 1628 wrote to memory of 2704 1628 iexplore.exe 30 PID 1628 wrote to memory of 2704 1628 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c82f5dee761577a05d9870c39fe2589_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561bb5979bbd098251b6e0f335caa5932
SHA19df203e44742be391e8e449437fd176df7180474
SHA2566e5528decc58f3d3f66e8e63fa275f095abe4d0aeb3c5290c0b9ca45975373d2
SHA512e33f39772fdafc307b4dc85a114dec02528e8933a5381db3b06a2cd7b681319fda0b04128e788ae6e6e02dca26c4f448017116d0e1e56dde7b658bc1d9723373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a27fe5ede19b1cbad9a340d19dd4cfd8
SHA1c78cbbccb1ab43029aeb25446a9bbbea4680d050
SHA25692d6e214e4e4948aa5f50df0bc10e8de4c9d26a5d701982c64f1519d239da6e6
SHA51289be5a9366965ec1ce4c8b0c4c186db710f1deae96d9bd93dcc5514af6143c01191b5be1547e487adafff7b1447d48f8165f866d619acaf356c28089d707a142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538cc97cb64cba503e6e77603ea64f6df
SHA1933d89aeb595cbed20a6989e62b6f5c2fc7a509d
SHA256564b1621f7612ddc10317b1f9e787b1cd8dad4eb6f902e9d821d4070809e8f97
SHA512d9913bf84e67ea87cc096a732b5eb0c3f469cd0c711aaf10845e3cd3b90f5c5c627f9f888fbc4adb83c5d998172adb1c47016c471450eade1c95b84f57ef7d58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500767d6608b395840a1ed33a94ea97b6
SHA1bcee328e48b93d5735ef21faf65bc83eb76868ca
SHA2560835489272a240fcfbae73b85e4be70a13f2b2af8a4d05cc1bf76d494f903709
SHA512f2508c3056bac277aeb7ac1dae67c8023c8afb489436129eef2cc8ab730cafd2337dcae96c3fd22d3f6ebddfe17620fa35a9f6d071d8b56a7bf700ee94a394e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5651b84b93fe1eae44b9f2b1e9d57f437
SHA1546a0c6c5e79a7d30c72656a034509fbc49082ee
SHA256a7a98bcaab6b5475982db2dff780c55576fc22cd040bbc084f7dceae679796e2
SHA5121c3d4ba5f3e125bab26855bbc8b8f9c5ba478abeba6500ff3dbbe3b04b6e5adfbe664d5cc524402f303dc8d3f36cab59d4e9e8f48fcd991827138ab46a084375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512bc09640b63d0d08a1dc53cf60a9af7
SHA1c04f100af14bc37688295ba1d51fddfe4b1027b5
SHA2564b888d8eb0ff001f4f89f8bf55686c306e03626068a47935a3c18302a1df4655
SHA5122f8468c35a78a48ce5a1e2ee81e69bd49446c50b146626722594c00c66a7ccdfc75973ab286506a54b075300e50c1b8fd67889f0dcfb28c3117f675e7ecbda41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575328c2a643e73ee887088d208d037aa
SHA1e02fb78f27f0fa572e7a93a691a8208a3354e597
SHA256fa84ccd54e131f9a1878bfac13475ae74c7f1b6b0ae5da18a7f4f7074e736161
SHA51218f6737c29559e2dfdd71298525afdec676ae4d62eb6e28fff5149864ee0fca021f754563157813c6878ca4154a42b1cf3876fffcefc6ea02b9c1193e862a0a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fa81174225e976429195f79f1da67fb
SHA1f57d329d33d1cc3d12ce9327d9702bc454ad648d
SHA256a713e393515cfa51d5c2fe1be1207c9f6dd35fb03ebd7e9ea60eb70ac29c8ed6
SHA512c7590ff59beb43ad5ea2acc15f48e83b8effd995f885d96e3067056f31ec056bd6433dc37a2828ea98529cdffac7fb5eadc6cc568e61694224c414816450c254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caef2fa16d02d9c001dc9f59c122c602
SHA18307da3784bce1f56bedad8e6d4ee90fe5716889
SHA2560f23d22722b0fc52279dc92f61567e2562a14a6cfe767f6cc2598a4b265b051e
SHA51249f2d36769b01a04ffd9c5290b6d6c53d7231852ae596ef277fcf111b9fae60ce7ba2bbf48fa3d7eb054238c860bdcf2bf451e7b08488a014eaa839817e52b55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dc559d64e3d7d8a2178117734d941d1
SHA126c701acf4fd06bd81c0e2511604f206d29ad1c6
SHA25643fe70c206bc14e0291c6817512ad99d3802e71daf2ff128cf0db8e1453869e8
SHA5126ea128752e511826bd31d98736d44aeb7ddd6e17719743122ab7295a20fe096449440e171594ad515b87061f5b6619be66c43ee6d7426cb4e23f76f6f3de6333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c640f85c4f41b812813c4462a838f54c
SHA1c006ecd0e39bdf0500468955a6cef73e28b993bc
SHA256f231e9a0aed70af6a47253c27cf971ef505af06877f5308db520291f43f9cc5b
SHA51256eaa9130e0d72af1752fdf1076a25506a57e8b013bb95acf505e25b2408612a8acda78d0cb2e8cc01d4f2af1928b892141875ee7d7b13bd9c78c9870e6fc392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d78a21df581aee4c28f86837dcd791c
SHA13714f38e6db021a2e6b8839ff084cfa2d031199b
SHA25657924deea83609065ca5e40ff0a16f2de5a3fa07a409497fdf5d0c19405fb78b
SHA512ad84244fc96db9cadbb417646dd64059db00566fb8bd8360b97a854a6fd84e8cae62461ccc53e4f530f0fec213eea43480675c5c11176de7ec92d29ae41bf749
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6d06627dc517ce359fce097929098c5
SHA1cb930021e5d9065e12998647b6df8e7ca94c1d9e
SHA256e0a25148030bfae0aa59c9ba0c02235eda33bea34302f0e63cfc6500b29031f7
SHA51287516fedfdcbb9491282cd94ff5e27b9f7400957aedb15f4e5e6dfaded9f919c8006fc03d4e42d4d3f6d7f82163feb406d6c77c8670840fd3a47836cbdc67281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5632b4078f54a52503298238228861be1
SHA1c2a999c47c4320a4ef1934710c7c93f9e42c2a4b
SHA2563578080470ec96b87cb01f5024074d9e473d9ddba033daa5624e01215540ff96
SHA51211d1d69a54ab447d566c93a7772386bfca012ad58bdb2a8284fac4e0ab59aa803459e45509043564160ed7a098a75649f6d8a3c9ce671c98378c7c004c65d884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dde3e8efef82ad0d2cca9a849e0811a
SHA1618640989ffae255efa93e4525462ded0225cdcf
SHA2561232dbc036d3b41f2e776612de939dd3122946f0e66e17eed32d2a04789303f8
SHA512590de1d36de27ff2b3533045c5a9d2e99268ba4891921f733feeab6e7ea63c8aa3b9948436fae34970b31ccbb39b6e41a7840c6032c93306a5df5255dd663a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544abf72e90c2b04a99a9885629d99e02
SHA1fed10829e94e9dac26b8237bb9e8aef9965c0c9e
SHA256297914434361cef7ad5b694d6508d9d266351adbe62d31d04d2c31990f6b4937
SHA512782ebd2890c5b5f7f577ba99482912e518373214988f3ce46b78a64d570109c4c7a2506f8841a86b9921510949e7f90125def3bc2e80db961d648d97724d11c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e66fc064f0d632ed29b3409d854f594d
SHA1e37919b8d861937ca4b216b2dab59c767269cecb
SHA2564715214bc3ec5e5148d1c92cfdfaf4e404468fd5ca82e9c55e2bd76eb75ee708
SHA512e360e1a2b31277f92db79df7f249e2e5fcfbc59cf0cbc11cca783aa322f0c1b9f8bf7ab10c08bd2301d30f9ea9ab9bd5431d645ec7ad7cbf788262ff671bd05f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0b28a0a2e095702fd5213aec85adae5
SHA1fe96c1227006eb2bf022201bbf1addb373dfb86a
SHA256155f2f34a28410ae41859eb8af81cd472752122cdcb51d2237727321608315fd
SHA5125ef3a7930f58764cc6030684ff4808a2961ce98a677059886cf06331dd936e036ad866beb44195b8cbed6892f66fc0b4e732ab429f92ad0b1005a88d2ca85c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9bea399af0f67007ec4bf6cb51d4f28
SHA1fc822e6378f76cfa9534bec6ac3c97ff12634bbe
SHA2569be9e8ba1a7529172366980c6a9c8085d8f35fa44f7ed2eb3465bd3c6b921c2e
SHA51257cb14c768b3eaae4193f13bac769b1f0b85aaf7d95c6cbf9dbee7c2f869b2002bde303004db04e24b12d10efde8b56c1ca8aa7e546540da3447d929053f08d5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b