Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
439a2534572b00e31b851776f9a8afa9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
439a2534572b00e31b851776f9a8afa9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
439a2534572b00e31b851776f9a8afa9_JaffaCakes118.html
-
Size
15KB
-
MD5
439a2534572b00e31b851776f9a8afa9
-
SHA1
2f0aefd1f676f735645f673be4691a162e71ffd0
-
SHA256
4221530997fec8d04a288342af99f559b2edc0bc41b7bd0c2dd776f7d0bef8d8
-
SHA512
4955c7103a407e913409fb5bdeed5cb55b0d398c87a1d2292007e4b9af59e4b3aec7ccb427f8624caa20105d0acaa1902fdf1fa688dd951feed9e3f07353ef9a
-
SSDEEP
192:KtwSE2zWR9ibJAyqa0zxMWa2aQJrn1bqNA3lRERPXZhyZZUZULonN9mErRjPWeNi:AU22bzxM4rnJKe7UZYoN9mEUjL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CC941C1-4167-11EF-A24E-4E15D54E5731} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427071688" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70be785574d5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000d923fe953c3ad2e880592b9424eef2af25b85eff88dc84e0236f3de5160fb84a000000000e8000000002000020000000fc7f394b49f5355695c9ecaea8a40ef0cff067b60880bbb741162b4c6fc44e43900000007c4ddbdce6a816bd1137e17cbabb6de5314c4ddfc5b01e4e344033dead66a61738a758570204c4291854a9687b5204597caaa52c5b84ce44c81be94b0a5d5ec53191a5417f9c564d6f3f4753a0cbb0d47a36b05ca07bed37a0f81b1d5ec552b0a99d1f2e3629a1dd57e8c9b22f912c75f3b80a5d25bbddb467547e303cc9bcc712ce0be8d9f59e978503d9e9d4085fc04000000080d8d4d4be763c9a24a2927929a3ca1df777c9913c35645ce8c819136dea94b748c6e3af08bf61697d61ae5ac73205b27ac1161d459cba5b74e32d8c8e5ad627 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000055430eb44833fb16114dd4c382fa23df46cd778528643369ba4080f805995103000000000e80000000020000200000003fe5f73c164f9b253e41550d860c6bd02ef758c448a4508961d662abe8985e8b20000000e02f82c00f3bafe2da06c1f5498316d8d7668c982d2d49b90bcea06e8a61b680400000001888416e87854e338ce2040a16247ad92d6b44da86a6cd6392f9dab8c8ebee6fdcac201234a6fd9733813019ca5f84f0f83a4afafc5809524a8db20418844cc1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1620 2028 iexplore.exe 28 PID 2028 wrote to memory of 1620 2028 iexplore.exe 28 PID 2028 wrote to memory of 1620 2028 iexplore.exe 28 PID 2028 wrote to memory of 1620 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\439a2534572b00e31b851776f9a8afa9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58608e3bff406b6ca0bebfb2697562274
SHA18991cf608f47cddf59cf756b61882f911914840c
SHA25623d537728d420ffc364b202686a98de39f09936fac3bba720606f0e553022a9f
SHA51233fb15daed2de5678af1dc80ec9b2d666a96d708aad54117b63f425335ee64a3df290fb9d5fdb376291a78441a0ee9eab6114ba9d33aadb4a54d0572a7026ac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD506c884300473ee866ad42654b4deb946
SHA18f317f65a6e3be5e2e20a644628a5572733506ed
SHA25609f9afd65219beb8bb118cb9811ca96b7254ad7e8d30006d810a5430bbb05b04
SHA5124678b8414258801bdf072b7ecaf20dad1bbdab09e310fd07e38068fcdf9475eee3d02dd24644a6034d9744af5e39afb6c62ac35ec2bfd85771e9621a3995bb31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD583753240ae2a8c5d3159880fd094147c
SHA1751c5b029e95a05e3d0e2bb668414746b71d4b4b
SHA256b28d6de72255a94f28798d0970faf870c5b52d597419a44383b902d9af4b0e6f
SHA51271a6683a2ac54f52732b3362ab940ff0f013e62bdff58d72db2e36d3a018ed926b565d604aa695865c1a14bee811bd398319babe05b4335b8d13de69bbc02a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dda9e1925043bb12edf7acd578f6ed54
SHA1b8f865042ae0eb503eb4a3bdaed2d53f604610b2
SHA2562d13308bb70ce65c3ec332269cab18770a5ea0e062a417456b08c58cabc37e36
SHA512ac8454c77e351fcc07a7d010e411eb0217eba6fb224bc73aa26c843fe5c9d1713d44d8c1127540d738f838a4cd334369bb1b0358e8d5255699cfeb35f1a702cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD512a08da9e68d999e433eaf5aa768d4cd
SHA178d11767814d108c86ccea15d10ab69d18793ff3
SHA256024905e9295f1ef7e79bcdab1f08812dcafd31bc388fd919f634d0afcd85f191
SHA512864ca85112bceb6a6df862dbc2794625a0b122773f86f0aff8879519cb7eae46cedb6cef609cf2841df481d9127bcfacf5aebb9f7541dded16415ba1c1e049ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59335d1d46fe8185460fbcccc1cafd5f7
SHA168b351d8248c849991455874866cd11153429c3d
SHA2562ba2cce108c85c2d222fa4bfa1501ec9c03112fee51f3efbf12321935488efd6
SHA5120a1ac5871178789e835cdea03d1997dd4029e42902dbb12103388de9cbe2e9fc0fc1ef3ccd377a8a2ca15b0c57f24ed4d78e69076557a521bcfcac299eea60e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bbae6f8317180c68d8320f7e977c5a91
SHA13e0cbc9d83a43b62ad2ec0820564c70882b65166
SHA25657042f19c2126fb37e075bfae97c021d8c0f738445a75ead93877fce08aeb622
SHA5123de3d04e8588851d8cb179842f5009e25366ced88cd52e4e71050ee3c219287133d646c8f800cc5a6713a1521b5a0323a791108c8c3e20846558ec4ea60bff80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD562d73973c4bbb2947808137efa18ca2b
SHA12b92791e4e6224f97c38a1ed539dc34b13208036
SHA25668b98d49b9373e6a7ed00269a6cac7d403de9384509c349b5b27d4f98bd41092
SHA5123c65a87f6e5a2c9920048ed42aa7c0d62662d428060df0ae62e51672904b9f4410fa1226a4ac4c3b602793441219516f89f572500525eba46c701e8bc27de939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56b445b0f81fa0c68e7df5865cd0695fb
SHA141dab8cace3b86f5a0227b4b2b65a8424b158a7c
SHA256e230acdb626d66a7e88bbd6145dcfaac4f879acb54fbee00fef2abe9a38f9f3c
SHA51267280c159224d611787c2d80799bb9d83a9e3c00b23ce5f44b5e60ed1ef1b983421357051d0f088690a367a6dc0e574865096da2506a5bd447f2c9476dc79c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54dcd1c10b35da0b4ec1d0f6e5b67b6d3
SHA172b7ed544f70a59dbb22d66d80539e41b3da9ed2
SHA25625a9130f35ff91f1cd423c02965beb18aafc76b4fba238794842144f9ba9ec60
SHA512399c8c095139106b7e3b8b1eca827443698ced4e5e2050864cf0e6b95eb0d169b9ddf93d85fdacc6a0f4938fc690f9f82cda4253d53ead1e1e1b0112de7697d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b177dd9a03ec4b1d86dc6aebb5fd57aa
SHA1b1b02e9de41c3de55760f8c59e4e833d4b1d30df
SHA256fef2c3ac3e7638bd30297dab8df90c435ff54194211d7713d2ba396bd6976de4
SHA512d4de4647d36c29da59abbcc48dca81e40b2c27c60f7e1ba018b2e65696a21a673cb249fdbb30587b8007b944e2a3de6fd3b01b652aba3e0c22c292abcc6505f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57ebe4bd902ab7fc93fbe31b0d2f9a8b4
SHA141214b27d5dd273a5b37dbc172f094e05d8ab91d
SHA256153e2b8789d5a7f68905c8f43e29f9a8bbd2139df5a45a039ae5b8b35f06c476
SHA5121dc84b1cbdd3403ef60d4e6b14c231bea30d4372e0de0c4c4a04166963ed9ab5f20ff365f80e3075d3ce38b881a12a4cdd1f7555d8726622ee6e304cfffe2397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD522e19d964d53726983aa9a5fc612c1ca
SHA127fd747c9efa24c50cd0501f96e9833de553cf56
SHA256058cfd322daae11b5c125c97e90d966764aefd73d38e5b02743a8a000067640b
SHA512a83593428f22aa386e6cf16cf0d96704ca24d0195500ba8a585f5d6e8474dd8c461b012f9b0e07254b64b59d657e70378d71c6cbb4fa120836427469e390f488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b263a2341acdb6b6839a64e178b6a4d3
SHA10515832da68efd04d1af65c5bd21e6c4529576c6
SHA256afc3e922ff91e62ca633b7b706c5e8ceeac775d770111b48b8bfb656a9666732
SHA512d12da1e225c4380f41db353330cf8ce8be81c189e3a5351e9adccb862269148610814365f623459db54f277ec9bac0c1f5cbedd88d5a6e1d4db99ac47a11351c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD546523e19662f9ec14bdc2e330ca044ea
SHA10181443abc55731cb3a1819e5d217a23866e2b97
SHA2564db976a1cfdc76aa7761565eed4aed374cbcbc5f77fd610b56a7a5a8a4611f58
SHA512b1e073dd09416359bef80b7f3714184a1843ab348856ae7c8c05e8b86ac14b249be2903e2ef60b5960617fbab7e706969209f9361693fea7e6b6312e154662a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59440688edd51c3f60e298bfe545e36a5
SHA1c558d3445d283752dddadf5ac35da57c9f77dbca
SHA256c2bd5bdee1f5323ccab79dfee349b13010b02e5e6bbea3ed75bbce6e005e3b51
SHA512eda25b7ac9762e8e06ee0cd3c198409e2d1f1a615203e00449f2a154ecd94fad924178e424592b22dc041506271c0ec55dde55f6a2f0ff6591020bb0ae34b88a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eecc0a50a1fb408f5dca2caf31c7ddb5
SHA179e0d8659e28c870b389fc3948a5ca7ea18670d6
SHA256b330b6e6d136d2298cbbefb0a292df998d56637fe6689fd1eedda37833584869
SHA512afcb6d4b408dae2957df76a01744e8f4121409c1412097ab045f8c169205c78e418406df5084f2275e8367e45ed4b3be289801ed5e5a8b502c8d0e325626f570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD505f9bcb71baea3ac6c243d4eeeda0abc
SHA105f8a0dc40aad4e16be5dd964a61e7287cc1607c
SHA256a225204bca7e6adfaaca91d4e32ff948d3306e59fe1fefca1ef3c3635a3fa269
SHA512e8da89bf0430035d76493d01a07b313bf3839b66d43136bb1ed22baba8108cd0c6b71178ec4482ecc1e4c338c131a252fc08a034a13c14dcc6e807b2caf607e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50fba28457099edb0794d05df52a3c88a
SHA1570da60165756386fb0af411d1eed7651b0ebbb0
SHA256d304002e0070b6162cd4ebab6b7cd09e67992d0e7c14b70640e43286561decce
SHA512356e4f6152abfdeaea425980caa1bb68e788187710c1a3411252b1dec41d951c1d7a14843acb7065d5dce4ecffbbaeb68203e66d7d4d977eeaae7fa6ed14a1d2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b