Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
4183c5f41251b32e5031dc1d13806b65_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4183c5f41251b32e5031dc1d13806b65_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4183c5f41251b32e5031dc1d13806b65_JaffaCakes118.html
-
Size
15KB
-
MD5
4183c5f41251b32e5031dc1d13806b65
-
SHA1
203f9ba5dbc5480f78b42208701cdfcf1b8f34a9
-
SHA256
bd63172a1bad2c7c88305f07faaa7e11b4ab6ae25173dd85a403d3baeb5fe0ea
-
SHA512
5f82e9a27a8cb458c8ea2ddc33c3cb6308e9b4d97523984e8f232d834ac598724ac3d34757432582857013045201ab14392e3a3a55dba61420fd4cea7230a3e4
-
SSDEEP
192:gb3b6BV6U3iEm4NuXBSLPURl1+mza8/aJucswhMdhpa014dg6iXhWxdxQwG4xYPx:8r6BVun/giXxwGBXQ8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8674A0D1-410C-11EF-8893-6AA0EDE5A32F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000000911b0457e42860fb907702cec450174aa403b47be5856c3753f1f6fb92851d7000000000e8000000002000020000000c5ffd66e4c916677dfd1aa5ae1d65847868d4f9b68e74e8a8dda04d28c415deb90000000f7fd44fc3140f44bc6ff1e1812f9f13e9bdd0f53164ff0184eb0af3cb2e53dfd2144e9258dae84b828f29dddb2d74c79e7037c0364367b497e8cf91ed7113c6700e1014d47544c366b8bdcfbcbd72edf9512efb4baa9247a81b92fc5a7836b0e240768f3fbebfebfd35665428afb41ea408aaacdfa29ec67be8abf8a182a9058861ecff6f9508adbfc9e8679bfe15aef40000000965408a1b5a93e9b882bda3e9098bf101194a4d8d832522f6f66de211d4520bc500f48cfc29db6078fcab42b720c3de0f263dfa24443b3f24be8ae3483664915 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427032619" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000992d7154193ac2f30132ee07075173616872a8d543d05b500a7083e5a211991f000000000e80000000020000200000007a3da116582396f0dc3496291a8f8dd5e3c156bc52b2adf6e1bb2b89c2daa02b20000000d09ac166fbf0ff68f1aaf71fd94d3198b071af9c5494131fc7744019b107114c40000000954dd2f838bb64300259357e12788338f22e86e79e53a6a3c1e4770462fcbe76e1fac6230ed19bf3a2c733badd9a446a663f5edd7e049411a838fb66cecabaab iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e047d35c19d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1344 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1344 iexplore.exe 1344 iexplore.exe 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1344 wrote to memory of 2192 1344 iexplore.exe 30 PID 1344 wrote to memory of 2192 1344 iexplore.exe 30 PID 1344 wrote to memory of 2192 1344 iexplore.exe 30 PID 1344 wrote to memory of 2192 1344 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4183c5f41251b32e5031dc1d13806b65_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cc0c468cc394ac401a6e326070bb1c0
SHA19189d60a74b9ba65acc409004aa8c9eb7d3912fc
SHA25609e00e05b03a48cadaed5dcaa870de237a62e4d66b3ccb16df67442d08a71a2b
SHA51263fe48a40043070c058485f159d968407b185d03131d1d02ff9f8f2add2ce5847f3c9fef3164a936abf8d9478163c6bf803a140ef921693271f0022abb83b3ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4226acc5683e0eea236dddcf08363d6
SHA1ac1c5333ea62f7f1ba9e80e7c41f9549044c363d
SHA256de5ce0d0412f422deaf76c47f3d4b042f9dbc2f545b9065da4301b05798e64e7
SHA5125559915cf9cfef4051c5d68073a1b95083b1ea38992169a649f9e796a4f497d41151c24aba659b0223dbef524954e8f84a3c61fb3e58c841f4a8584641dfff81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510a39f502a68049d29c4dc86c2a5d327
SHA19834882b11a3ce65d51422e82bbc0b91cc779e22
SHA256d197dcb69b90040771c05d85bf999d18620786d3949f7a9f64427e17d3d685f4
SHA5120c37a7034ae74ce707cbe7a5427c64d288268af257b9298267e969d57ce4fb3cc7d6a48ec0abfecef0a61a1177e934a8e89724a236499138fa317603693e249a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5851d92cfbe03be8bbeb43f306f907a13
SHA117dc5d6d81ee31ae7f6fada783b51dbab813fd9d
SHA2560092dae7c567ce0d50e640499037cc316cb411968a09dab660162484db88c9e3
SHA5129ce86f58697c4300cec47fc9138ac1dee70f9dcf05db1715a177740a5b7bca579ebac9a37856d768df188b810150bcdbae012a2488d4742409870105b24aca9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6e01e9b839e653ae09972bcb2b6a8a9
SHA1aac5c8bb22aa7027b8c448ee7d69fcad5d6a37d2
SHA2562f67ef1b4799e648d6e7c043a66ad1771136425e782db2eac6f8da947ee564ed
SHA5129cad7ed93f99d8bda70f37ef7bc252297baffb0ed063adc960912e7fdef5caa1e28ecc4e6757688ff5a1abf3f093dd09f17d908355101409ce2c9fa57b6a57f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541273b7072556758aefd8e24ed2d6ff0
SHA1ed063ebd015aa596c734f8107d7a119a527f029f
SHA256afe3b79eccaf81fc763cf256b62867265553770ccc855d868dcdeea75eddeaae
SHA512ebea9539a14eb6cb3d2af458ea4fa8a990474b08e84e17c0387d610372af925a01a468e71e0e6ecb945e8d65f0353ff93cc6667c5e766c889c1496be352c5e26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd7ef44f85bf28ca1fa117c1678bd158
SHA12c9063c9ce45fa09667f1ee8273bb8e7c3d37322
SHA256acff42964894e3d8316da727e2efe6af0e8a1af145376809490e1f84db4e28eb
SHA512bb5a3804d0951103c5c3f452e3f083f8b88b4934523fd8135bdd8ceda002c128e1efbe8c49262e03814944b81fc958473ac96c9385f54bab07f4e099a223f021
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a60c75e3bcf9b4ae88ab9f09d47c4584
SHA1ff2c95112e5d962471150418446c93b388357b15
SHA2564ce8a4e9cc02a30f8286af4e5ee24f7f6cebe9fbaece140eed95ade4d4ffd74a
SHA5129e234553167f7a0002ce8d2d76d83e51b4c5f48db8f641ba54552bcfd5a2db4648410d0d4d0245c4feedda27b20fa4f6a14c64e294eaf2781355200ca445c763
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7752fb37cfd1fb7ef44ea4907760d7c
SHA1c96bd5e8c737ac68b04f8190eeda0f3bdf08d1cc
SHA25641fb9a3863cfc155ae6341577133be9226f8b912fbe38719850406d858b9f93b
SHA512c1a089ddb73585f12e220ff05f6bbdb757e518b3a95df41398feb7e40cb736abdc1c50cd4def3e3b09b55fd94a5fe60403fdefb3c52384e22715ec28539ce20d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8b64cd35d3b375f331e533ccdae0bf1
SHA13aa67385e72c8fc450c02436a96260ff72884f01
SHA256292b7ebac85be85a87bafff4c00fb539867a11d2837d7c88daa55678725a47ca
SHA512864f12823a3f55bfcf3af830f327f11aa5eb5567ae3a26be8df0528e060f835d3373f336af5d46e543fbc963a40424d68917fc84c2c5c678fc62a385d026c4f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5341d8f4b69d25ee1596eb883ab3bcab2
SHA16ddd055abc0aef25ffdece1d2806aa7f9d97f4f9
SHA25613239f673d510f606f4c68f2b7f6a1b681330d3fcd9c102feeba2f98c68ffa17
SHA512e24bc928363c4d23611a24687e544641f17f1fe62fdd4c6a540b75b3428213b1bcd15356f261792fcddeb037b79bd3eb1f3606f6e6b84d39300902f3ee7b3376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b86a92aed2704cffb2a84d6a282ec7e
SHA121c8acf5a857bd1c9aeaf28eeb86c74d19cccf99
SHA2562f7b2cbe2d62a927e934a0824b5ba14c0be94ea0a179f3e369d22ee30d650179
SHA51239cd1ee0fac74ed6cc8629ecf3d6b8c4c3438f0fa36ce0090ebe3cbf1c91640c6fd452c283dcd29128ea419077b35488c9a80c0ee74845fe2e8e76cec8689514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c60ffaab07d10493036620faceda674
SHA1614bb089c2eab67a62438441815ec9a6acf1a48d
SHA25636ad8b60583ba2813935c071cf506e20d5adcd1d3b9fce37a2da5be03513193f
SHA5129933299e51f31a063ab1086007aab9cdc4cabdad0ddaa8887b97eee96f7c1d8594529e15a6073884bea8fabfaff2a9a3fcf0521588bab00631bb2f0e07b89e68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571bab7024aec85e4694439a449bf1d06
SHA1eb729f07511ea84fa86791c7050281c1ed06787c
SHA2562217ecd9dd24b2333133a58aabe04270e0f682ea78ea38715700fa6cf1fab37d
SHA512df0e689e715b1cb17ccc34d10da3483be2e575295399d162a462dfa963668bcf6b0d6a253a4b9c38658d74a09514094e62fbed6a8f212d4c2f8b2414e47ebb4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584c5fc32d0289c4ce9d163b6ce87d533
SHA10585b52fb713c618d2c0f1aa4151a9665f205c7b
SHA2568abba892cb4a225ea909465590028c59ddd372db18c2066973b3e5ac0940c757
SHA51242fee4ea7017ad3fe5945736d8c0447057f70c1b7b620edf8703cad5c1588234fd46e15bf301f7899910b43a437142281e0ec7cf1ea6f3d04f4693434b676a53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55db37cd5bfc74ab50a8734ebd471e9b7
SHA154aafdf74abb5a7c1a391e0f08b865f561b86c4e
SHA256a3edb01cda1fd22599c7fb30d277371ce855490af9913d3bc5cc21602e810e38
SHA512ed80de55690117ca9f40571f2f3b1b1cccc9176e31d547e9e161eea5b4cc33ba28b9721b8daf750fce2be5a9a72ef067361aedeea555c4b0c98fd5b815908e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544662e16675bf9794fca414b84d52b35
SHA13698e1946859a3aae95e8d93e9911090ba666b7b
SHA256bebf64fec1e6095961528b75f1435c4eb9527edf999ab72079d6459734c82e98
SHA5124fefb312ccd8d13146db33a5e0a206415d02549f5106855d528b139c0ac0ada27f8707c345a4e27265ee5d8582ec9983b323fb0ca71b90773229542842cdfd38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c41b0e76bfdbab5ba8f3e17e316222a5
SHA1999bb34f4891e058add185d260d0f554ae675fad
SHA25656087fae5ebc1b331ad993fc9faaf370688722592b3cff3f0c0d65b97e6d2fac
SHA5120cf752fbcd001e6b7fb76530ef99ed6f81e62ed797e755840cb29cf7d69072de3cea060e49aa7afcf70ab929cf74be8c869387bce99f5a52b758199229fd4184
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b