Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
3d28b40dc50ca81faf9361ec716c4ec6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3d28b40dc50ca81faf9361ec716c4ec6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3d28b40dc50ca81faf9361ec716c4ec6_JaffaCakes118.html
-
Size
232B
-
MD5
3d28b40dc50ca81faf9361ec716c4ec6
-
SHA1
b6de289e724d7c62f49cc74a927fe57c266ba106
-
SHA256
8978f4d7d1537f642d246a28636375ffa073c2950907706c356bd7a13544fdeb
-
SHA512
db96b0aa187181413d899d8cf5605a5ee3f088c7b5ce2588b7dfe22709b0434a60fa7bb76dcd6f874856b66a78169b894b025542fc7fee6615480f77f77c6643
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000051dc5ab52ee6536edb3cd1cd7ee832c2703225c247fc277da85d7289c3410678000000000e8000000002000020000000608f1ebc9df7cfd475c445adcbe319b9f3e7c660122e4b770b81ce247787ea3d200000004894600fb750650f08691ea1aa2d241dde651bbc21e03dd5cddd6c6206db008a400000007dffb87120f18465335cad9a9e5f601d0f5b8fc726bdcb56fcef8d2a4de8f58fa5de1013e8c11b4fa6cef553a302193c9fb08dbde11937b478ce8aaf48abd57a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900b12544dd4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426944991" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F7E4911-4040-11EF-87FB-724B7A5D7CD6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000037ebc2886491d32d75028e35b6b07ed09a9fdef1db1bcec2ac90e91f32087ac6000000000e80000000020000200000007ba7df28f9c0a6f86b5a9ffc1bd50c9296a73e9474a3e00b7a82aebf241644ba900000009a1429ccd902a70064dc0d9f59732782c097326228f7ec49f34fa9ec71377215c7abf1d4c39bca92f588f2c3655daa6f39d819da0033caeb3d8fe9bec96a32f467fc96112be01ff772383f25e6269cb434545c2503243ee1d36b42640602b33e7d79eb8c8b8731d28d1988d3a6dca8ace9b5a475366d23a1406d550aeb5ee0ad33e87786cdb0880169242880bcab258c40000000e54c0731198d2754b6ec332ab710c327bacc6dc554f522a4808bb19076b50cf92bfcc789ae7eee9230070a1ce35ae2077861c23593a10d4422f62cb17e40043f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2680 2364 iexplore.exe 30 PID 2364 wrote to memory of 2680 2364 iexplore.exe 30 PID 2364 wrote to memory of 2680 2364 iexplore.exe 30 PID 2364 wrote to memory of 2680 2364 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d28b40dc50ca81faf9361ec716c4ec6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e82632860e6ccf764f3afc59792ed337
SHA11df135347cdd790591ca039ee6cd150f2183803e
SHA256516658203067c0f67ce54cd461b90c75a159563912c6ea72d826a456b754a7e1
SHA512cb4cc065f4acf6b4034b6c2b6571d5df39e5cf0f6137fbcd576075be2acf34031bac3ce5fe6671f8597748a1412679780f7aeeed7cce48fb4081fd422b02b086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c687cb8591f3108789c9c43f0e936b14
SHA132d141aa62a2635df47b774401c730b564195fba
SHA2568351e69978bdf4c59d1039b912b18115c1a6ff8624d61baf25a8b45da9da44fd
SHA5122cf3a8fdd5c906a0054d1a9da94d97426de2d754a71969fa87ffe76133ce68f3b210883674f9ef27e8df79a34a762885ec06aebc491cd2036f13e08e2c0b5b80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519c72f99a6123a4d1b71f6086037b384
SHA1b8cc9530d262123ad8abd7ca15daf1f27ca86492
SHA25698bad64095634c0d7ea53c7b83657b1a6c5c9b3af6f7e6dc28f37299bf415d39
SHA512c6e9258aee47dc7c03480fe50ae647dcc8ff23002b11185a93f7a3e08d997a47a789a558e8f44558cca196fcbff778f1dad7c4e2f57d2ad4611b49e00fa5e0e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2e972b2cad242999009c54a2dd50018
SHA1a7302318f274d46efe755245f6224fa9f14cae78
SHA2563f3b332b7ffa0498fc2a420318d35cc970f3c3a8e9cc432bf44603c3e89a4fa0
SHA51264809254865859f11e024adffe983ebef1051e88f24a610e4c6fb443ab34ec8748688dfbf273a893e1621f8bce66fa3ad082fbf217f5dbf7e52336cb40faca0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56408ef6f3b8d1e2d4d11f08f20d45ce0
SHA1690d83141cf08a79fbf1dff8c162f47f7f8a9d7d
SHA256399f0cc6dbb30ef6bb74ed11ddaaae1369fb1861a3f999bcb3d62cd975b14b6c
SHA5123514193b6aad672adba0cf839bd937f0db9f221cfbcb20935b2db6070c49434104cf6da24055e25de131a13eec509fdcc68e4466217f3f0e3d30d517ae0c5328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1fd6c539f318b5e8ba60394ca909037
SHA1398ca677cfe5a9e8ff951b6c9de22d5f99d2d3e0
SHA2560ba02e76c75224d44108fdda1431819e9d5ed251b274cdb53bf28920b977f38e
SHA512d55654ee28e8c09f72fa853578ebd303bf85656c4f74f55212835832f3f399e0fc26b90b224197bd8fc38a749c400bf1153b46e05bea4e49cb116dd21afd8f8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593998e2a54a13e64aeb4a3c74c9dfcbf
SHA1529fd904341a82d4b543096bc78f2c892810295a
SHA25676f9592e6566434a2703aaa15525db77e45c10b13d65aebba27701e8acc2d03c
SHA512e882f1feb682d22edc8bb8ade8a04947e42d5a4867e559047a333fe3c89bfb21afa0c1e2745ea760867b11960d0be5a15ef3a657de5ecb7fe62085e1b22cb3ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52046e66661d322ba86e586a27bc6d41c
SHA10f28dc91f41b00a08c2a6c59324bc43d32cdebe3
SHA256188ca59699ed38361ef75196ab528cba9e6ab2ecab1b64fbe89e1835e3694ef1
SHA51269bc260382997c8c1bea5372ac72b2c81253275880c0e6bc433cf9f60775d68a61a03d89bb509faba395737a6c84b313094d72feb9498cc5bad9b0744a4e2710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52213a7e29da35e91625c3540fca95b09
SHA118750ea84e0a1348d1c74655902816734d25fbff
SHA256d1d414b0573ba84437770db39e95dbc971a981d686a9cedf5c070028e63f22d6
SHA51274d23ef84a83012ef8d72e19baf3d102b0ae820c234c5b1a79a407b57cece9e41dc35473e706fbe2486ba58f78a59b1911a64a1f5f3fb28d15825dcc514b680b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5099cc518500ea1dc21b2685dc4ae691b
SHA1a462db09e3956ceac977a014860524536414cd08
SHA256eec6b76471e1660879210fd38bf69b3c0a336e9190a2f1dcd3e2208ac1b1adc1
SHA512244b9bc89d09d58d6ac85dcda2a376aa05ba055909945e1db6e6c8952fcaaf166a146881a7db5f72f481aba5c3ec22faceda03fbfdcb2d4b2d1addd70537cd78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcaed6d8d9a3bf257cb3e129067d2b51
SHA144b127f5f48704f3596fb45f109201234a874a9e
SHA256302412a26c01267c2bd9c5b9b8977a6e4b35355bb03e310e4a901f1faf0a4509
SHA51243c6cc6d73164b4a2ca5ca26c2776fead8926580ff6a3a949e8afea3c6c75e9e19c73396f9243d9ecc67175569fedcc3134bcdf1c61daf058bcbebe4a6b67833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560d348c4cd192de14deaa6a028883162
SHA12356e171af336c521b8b5ef915e683ae16d410f8
SHA2565916c05d79a865d966be8e701fb9b2a3c7b567d2a56095a9ccd34d94c437d8f0
SHA5126ad1ed292e1f78e3351451df4f8bb51e811f5509e7833610f6f372d75be5088ceb77e495aa2486e6fa6026fc246cb88583e4f39fd5f1e24da20391dc174df369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d449596cc176f4c813aaab79654dac04
SHA155a28f7de112b2f93710fceb2c94789d7ee6bea7
SHA256177f7e25db922f51aff0ee1c5da654726753863770bcd1f73f7e0573bd657584
SHA5122f1ad3d21ca241203285c3319388aaf56e4973ed2d7e6109968bd2d1d89df7906e9228826dcddb6efcefaf9d063438a8ff26e5a5edfac89c7e1023d6750e887f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576f295c09ef5a07c2e01165db9c57705
SHA1d0fda175760278540f5735d55bad2e00cd6dcbf7
SHA25667f1cc57d450c93f9ed92a6061ae7a035064295b63f3357c1539cc38c4b096d6
SHA5125c6e98e22dea2cdc524c77e9033faa3a6f705501c8f41f38c46f68a8dc1bf1f3ef8d561a4b62205d4443461c649cf96e99cfb2a15dfd43f9b7d5a4c74d6ba1a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592b2df4f0ed31ad0b56c59fd7d69c294
SHA16aef0012136616c724d0743634ae1c0a092bfd95
SHA256a41ebbe185f8bbf1ed9dbd8d01462145f3a3c1b76e98e1b0f4566b2170d198f5
SHA5121f87fd23f95a575dfe979a831b5aaa02aba26c5f69544a931296f51f58ac224afc6cbf3dddc8a1a7ed9bc68b78bf347abd8d7b541d38a36b8708d96fc4ee5bed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc3d16dcba6a4602602dc0399d7f42d2
SHA1ee77605713b145b6acdcecb21f83217e037068a7
SHA25660cebfb5674021e5d7224e528ac2b8cb00075fb77ce1b8541e9b55d2db02771b
SHA512f2c12ae874b8c5d01055b5f027a1f74789abe7e3f68c63a20b482f78a62c8f395bede9e88b1e72944a1e2e2db6d5218fdc8aa99852bbd5a51db912590d61dece
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50281ccf719e741d9b7e67dd3584bf061
SHA1e9ecc6e2249b9e823e976b08e0261d7c2525be44
SHA2561fe6abd6f96e98fc7a0a45d65c52709b7529f9de728fdc3b5cfa4c8dfbafa6ac
SHA51235a6bf78888cae1155c3c926aae7408c9d65899a0ecf675aea251350d2eab5cf82fe3e365c07ba129bd02cca59709536e0acc011232d4ce67ee0d18793018a39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c7e90b6ed11de83740d3613dcaf252c
SHA14f592546f8899eba60eca87e89ff1b8c8ac8b559
SHA256be4a86a03159c805903f30d307a6b74308c1388645ae42d9b10597d2b9f3beb9
SHA512365fd018caec693e547f33d185e8340c90bd879fafc94e2b5b4e81aadcc9e8e658b495d44c9e76293692701eade004d546db890fdfd564766d46ef4c3b0b1e87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587d2d650311d0df185837121dfe28505
SHA137431022d2b1d0246d48130d506c5ec7ff7e964b
SHA2564488a0179ce735fd295450b76aaf0a363592dfca9dde54ef1535af1bdd7ff8d5
SHA5127240153c989cd9922f2c3729f393ce6b1337056227d62f778878b6c35aee6e6a0608553319b4c86c2615c838d62674e623afe9d059ec6ece5508c3805039308c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b