Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
49b706c82862cd80de02275a6723d536_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
49b706c82862cd80de02275a6723d536_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
49b706c82862cd80de02275a6723d536_JaffaCakes118.html
-
Size
2KB
-
MD5
49b706c82862cd80de02275a6723d536
-
SHA1
3c85ae7942ba94d47689d9ca91943cad890b4853
-
SHA256
125797b1bcdb8f47c5c6a62c12162b11c1f705ff7d4d92f923de890a51faa380
-
SHA512
136572a548ee53c12e38d56ce259d6dc742c3fe024eb23e1e9bcf08ddb05ee4a754e6b44477b40f22630e5291428dd3bffee133c95b3a941536ea3f9ebb46a7c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427213658" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A180931-42B2-11EF-B6DB-72E825B5BD5B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000006caf3928051be02b76005a2e5692e8263806d8c19e46ad9fb6488309093f8b0e000000000e8000000002000020000000c19a35a8a79c46ed46b6039329d4a4d97812e8103c87178c9cab4edb2be9f6b5900000003656b23a3426523574fb60e54a2d7287bf9a28aea0ee4ea82d354cbc6081db641940b66d4407a061a1b632d415eb421799eff096f332e395ac021f7c7d798a59f8aa2dffe28bca52220045e774de0e127f5395cc28863005c6e396da0de7665478de8faa1a1eaadff24bfe5614a367b61daac4dc46703f3687df718c4e713567df5863727c65a9bd1bba3c930e9f567340000000fa5162aab31e0a5761df53dccb9ed6c41c890382542f84c3ff0449a6d047ac8ddd29fc44343c064df34d49b27eca314e9e9a651e17b249853a82776a8e274a43 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0df8bdebed6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000004a5f21faf5127f3462da2bcbd139f785bd9311a8c675ae17b59e39cd656128cf000000000e8000000002000020000000f53dc42b901b5b6cc4f772be89d04730217179015c38bf5820e67b0596f946c020000000cc80959e78663d11f1d0b4e17354ea44f3fcf5bf40b1425fa9b47fd0077b3ee0400000002c513589e1aa992902f926562f6f5afbd62ffb71a4ef92cf63c0a4508d08b2b458e11d156b7be2a24716c4387c30dd3cca54be15fc78c7e6345b53b76d152d90 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1636 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1636 iexplore.exe 1636 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2132 1636 iexplore.exe 28 PID 1636 wrote to memory of 2132 1636 iexplore.exe 28 PID 1636 wrote to memory of 2132 1636 iexplore.exe 28 PID 1636 wrote to memory of 2132 1636 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\49b706c82862cd80de02275a6723d536_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501227134ef3b2d2fe4979cb995c0787c
SHA1d5f22687a7c9df7cf2b7f435fc6b45e51fd6ac0e
SHA256c2b2f95c87135220fee9581414b3773e8c5a92db101c4d35940888f6fe3c42a0
SHA51246a9cb08816db962894c40015176134bfc2912f233fd02c2a288ff9996771030d1418d87e42075d66217841f4840316963ffcd89c12cbdb73b8068c8221850c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ea421c8c87fd562fd055dfb40e01565
SHA184d525cd022b5bf3ead9012a0b6404596dd8fb53
SHA25624c14b7035354ad78a8d722f35001350691ec41691351270295865dc9e0fb6fe
SHA5125f884d553e462504ff19e3c4be4d91ecff26ea12ac17088dc00a5565a855af84137a135a8c48f2fbbe2a28bbab989c439542b339fb1502a3c5e606aacad72962
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5661922509ae05e7abb42225705ce349b
SHA180b08bd41affd4d10df15607d9abb08da9b0057a
SHA256377629d506110a2fb26624feb44a3c5224583f22730dc1e8509580cd44d80f97
SHA5127ba866ea606ba07979d791d39505095c3931542c5fe6fb4764d303eccfd451da96ebe00f55e1424f8d001e0d0f94809cd500b7ee655b5b07d82d9d7ce5c80d6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6ff3f7ecc64322bddff1d8e501fac38
SHA1965f0f95bf660b7fccd078a92bf16be9cb08e70a
SHA256b9f18445b35ea7663841bf1fee372667dfa3a244c3ddf218c356ff8a31aa9449
SHA512c76e0ca33a46fc2dee2afc599c323a672571e03e70f188cefe39bf53a6a8367ac01bf243680afc3dbb284d1efcdf573061dbf2904f6dcd9ec8798ad26a35e2fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bbe73711752cb96d3adc765572afc89
SHA1e5024eae8237bf916194eadbcb22ad4948b8d450
SHA256ff84502f204cec441ffcef357965f7098938aa5960d226ea4e63c12fdb5c4593
SHA512e16e8f452aa90d7d18be806bae4e10f3d527565e36ef7b9d570dfc0bb690fa1f8a10c57af1924acb6d880888841a629636624f11f0aae679d6f0e7bfd8c526b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5934b8a8f7d26d793a219e3c4f8fad8aa
SHA11a8e67f0f0d1c47a9f2bdbc019921e3f8bb1c5c0
SHA2568b66ac3de4ce3de2a4ede8fe39558181c1cc4c99ed536965647e28cddb2db94d
SHA512c933f5d21b6775921f900ab02be1db2d115f779fe68d69a32530f4f647446beda6a2f1650848cecc2a8e739b4a96002851cfcd742fb002336231513d0f58f5c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504bc087307b5c90f5c851c6ab4017465
SHA1520af10728f8704dd7b39710405f74cb58e4fe31
SHA256ec683a311e4195b4f9513b2e154056cf5b10f5b9c3fb2770929217ad6833105d
SHA51266e046c6b00c83483640ce2eaa2a3c7d7df5918f49d77da3a2faa1b101eb50ac36049c2740a9a433b16cc717f32421abe21f0f474bd4142ce1e49cdfd67e8f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c8c08e1705d4d873c77022df02b40c6
SHA16540f03acff1e36511f56f1667a21d657cd9de56
SHA256f4578819d84a77fc19f00892977b7ec97df1ac64009b2f1a89ca802b2b309f2c
SHA512c13ab36580ffdd241e1374c25414650b464a949b38124cb171c543a3789161f6dd3cd2940650f51cbb0df8c56b608bdfac9dd01136e6b47727d411208e478897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a20245040af4da345c19d81780e825c
SHA1ec32c1f3023d5fdd26a1a23fa303ff66a5c4fb3a
SHA2564589d4053dfa0fd146cf4a7cc2ca81e48d662a27a8d61480a258b3274ef5de6a
SHA51276b2366930d4899921ccda19fcb06945abff9416200ce5035289a605b3a5c7b217a26af371659bc9bf1c9ba60b7f99d8ec804ed969c64d9d89d0eb54fe9d270a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbd34bbc3cbfb76bb9824d8b301dcc3d
SHA17e6649af42a4b8a81aba104dbce1bac2078e9e24
SHA256a361745cafb1b10ddc8d59159f62aa2da523e8930620acad6ce0e7266cc12620
SHA512030a7c38cdc82079103390e76dfdf74dddb3e7b24700ba10d30c12e855257d58cc44eaf1e7508842a38b49cbeb65fe266c8db023585d8f86f91442f538e7f52f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8b4d76cdc058567b410f2c00671b72a
SHA1def7cafa4d8ff16c4fbcd3bbce1b3d5c9865dfda
SHA2560c8e5ceccef7b7fd9698cb06b98ea0ba13e123f86cb79b314f36988ab7c836a5
SHA512e1977d2d858605fcd2d3b2dab3a4d9549fe491a29d71869f63e72f7194fca6fff91e22ce7a2cd5bb173fc42715a824a494d1f4fc62e5b8c2f6d46a2d947b550c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5705b63aabfa0850e1d1b7045928eddf8
SHA1ad31550278d1be44dc609283f53bd3ee375c4e4b
SHA2565a304bc8e0396db9ee1af462620a4bb09d2f5efd82b70b15cb03cf40365c352a
SHA51224d4a20df6167ea0858f865c397e307d36d29477a7e7076be4a3c140ffa98a5f7ec74a76d1691b00edfe6626296f8dd71d4a3ddbb41af25fcd0c579d85b4e37d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548a2c9915753d41452bded2722efa73e
SHA1b8fa350f1ae70870d84112e44144455ef0e3f25a
SHA256d6a4063590d88d5bebaf07d06c16b3518a18e90ca801d4b5998a36094a4f694c
SHA512cc39960f0029d78f365e57771c8339c07d1b254723095f7203567bc1373a0fcf738d0e405178fe35af2fb1ae525e045902d21db9f98a2eeb19014e2c79ed2569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1df471752418b9de74be9194c5c8f4e
SHA1994b78301e79e03eb1b83b9ab59066b9964721fd
SHA25662d53e4d249a49387681e6bd75052bc6900568546a06d9990cbe78ed468abac4
SHA5121176b057d657ee8949e72918799d1588c0a6934cccd14015468dad385db3dae9e20d5839ca3613b66805a8fcfd451a8b18b9ee1c5a1aca272ca503e1ed397be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53eae348024d75a8c26f23d158f75fed6
SHA139b3c64f5a75ed6d51c5a41a9395d4e066938310
SHA25648bcb5f58ae15f74b85901eb32cde4540aa23d6c355819e38671c542849cd5f3
SHA512fb099ccf2ddfea0f0d8507d63c3936fc096d03d99d9227d90c3e17afb7d0d1186b9d6da24ba86ba9f485e5776c8fb86ba97f439765a88e51d59c33a9a6b59d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f3082c6f60e1dc0869ecc05311776b6
SHA1a6bfd7571a07c9c5b9a0e7070457f2986ecf37e3
SHA25642f4c2fc9c0d1a32b93a521021b3d4be915e8a7cca5184917022720880f6a088
SHA51210915627c12c01c4c8c8f6614551bbef9196c4454194fb0947192ee441b063909dbdcbb94eb5624b7cc6eb6b49ea26beefca6b5c4c6047369e92504966bf2b1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54233e0812344b44ae4cb3648a2c78684
SHA19bf7bef3cd20f3f4df6f5a22eb5f57b3c1cc617d
SHA25605d1eac60dd780a3f6a26f108ca75030b79b81765e5d74fdf89e263fbf76ff55
SHA512d0c8202f73519069f6afb78a601fbeb63f64415316417f01578432717f6c9215ecb9fb8b16d2957e1ece3bb54817d89b4566de5b25aa3ce2d72126ef4890a8ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf815fe24b37706f6cd1443c2486c49f
SHA173fa472bae9a0adeab65a2f6250894ca9809044e
SHA2561e6094a30dea93ce5a1405704a8d3530e79d3ed503666354866ca283c7dd70d8
SHA5121257ea050c2f40e40cd4829d7ad9850f3aeb865afebffb5caa5d29fdd7bb71b15675b9964f7c9b9ae4672c05b3862b6b615cef24eaba12e2236d666330413dc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bf76610d0f974141539dddc28273da9
SHA1273f9b6f361e6fed80356d7f37d9655daa69728f
SHA256cc4f1f06cd0d522629bdd22de3ac38086ba9fa8f8819332f7e0fbf9643030073
SHA512eea5e8ecf7dfa6220410c6357afae568d64a8e372105a1283d75661faa23c21098833502677f4aad5ff2fa9260805b63ba87501f6027eb18f01359187231dcc8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b