Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
5bb7f4715257665b4a12c1e9ce163d4f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5bb7f4715257665b4a12c1e9ce163d4f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5bb7f4715257665b4a12c1e9ce163d4f_JaffaCakes118.html
-
Size
152KB
-
MD5
5bb7f4715257665b4a12c1e9ce163d4f
-
SHA1
97ad14ca53fee1c75441154610b88b6db4fb1afb
-
SHA256
569b2746da7fa66ccfb3e1c2c9ea51e0645de77dfd820845aa4a16f3affc6608
-
SHA512
c3940574247644a944413dd7aacfa2cf47990f1ef48e93b961c953eb7a397f1f137b8ef08f864b899ad77b977466fac826ef98041272640ec4074a4e721fd63a
-
SSDEEP
3072:lyfkMY+BES09JXAnyrZalZEI+YKhR3Z7Wcj:QsMYod+X30ZEI+Yukcj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427549841" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000e83524d97b56aee7dc6d46e0abd3228cf5f626d3db063b1f1ad8ee55f0958349000000000e80000000020000200000004b79f60fd5930fa6eb5a0e9ba7a76fb2006313993af969f562018d6d0f760bf0200000009faa87ccabf81051284018e4d76d9511ea7e56ea015724136000bb78ffa8b5fc40000000d80da59472bd7a908a3ee187f129b702cb4836bee3d5cbb29c0a03d4a4528dc4fe53df99079cc71abb4da764a35bc4c7635ee5b8f847ceb7ff21a5a80412bf77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000d67f7501e6b539721e6187527e1a08386be0c13ee687a007a8856706525c2999000000000e8000000002000020000000f4a6c880cd1cb945d3f90c47d34dffd427e7f3be65c13db3f77e4d0599e78d6b90000000f9db1b99df35ac54c9d1363a4e88297874ec7266eb6b0ec7ce4d946e0bd4ee3c5b2b8a3fa69d84e00a250c9c3d51f7fd24eb91735a5aaf9b44aab76d4be944e79b96d95f47a39366183d045204d17bf7af175d29a82bc15a94be0a4f6cec038b464c4f8fd18f5d6b800e3cbad6559cac59f6f5628e827ad53a0da267954a6fe0877f0e8eb895fd2405ccc801da7c39de40000000b748b1bfa89b0b9dc16a360f1fe4dd7af5edb8fe027f9266f6d304c607d534da6faafffa95cfbce61def259a7623332480ad674dd669bf59f642a0def0ddf6b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C632EBB1-45C0-11EF-9749-F6314D1D8E10} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b094ab9acdd9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1952 iexplore.exe 1952 iexplore.exe 820 IEXPLORE.EXE 820 IEXPLORE.EXE 820 IEXPLORE.EXE 820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1952 wrote to memory of 820 1952 iexplore.exe 30 PID 1952 wrote to memory of 820 1952 iexplore.exe 30 PID 1952 wrote to memory of 820 1952 iexplore.exe 30 PID 1952 wrote to memory of 820 1952 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5bb7f4715257665b4a12c1e9ce163d4f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50843734f7b2a794b60a05b96d6c858e8
SHA1fa7eb3514bc6553aba7bd39f1eebfd9bf5f9acdd
SHA2568102bc0ec6200e34f2441cc3848096bf90aab22e53765224017aa00beec866cf
SHA51245db72eaf1eb7550535149b902c0174ad21c4d76508215e78765a7bf98009f7abe8e191040453ef5cc0cf8f68811cd12600607dd440d617061d462dd95c71053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556e3b5fbb08363c572aa1a4c5f022fe8
SHA18f7c9ca49b58603033c32842b4e5cdfeb0d6262f
SHA256f63221e6385a01f9158e89d431b648b0db2025225274e2b3ddb45d4fe2e26a83
SHA5128dda710c158e201daa4fd081f1bd06f860941775a09543f99975a99a4e055ea906b800dfe21a8a699edc2410d60bfef750650923bc751516a352e491df2eed73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e20b21caf3d2b630f90a1f14e439312a
SHA112164da4a518f82a36ffc6b5868c0eaec90ca514
SHA256227d3d17cd1164ec970641883addfe508e9dc918da0a4942481908acbaa5769e
SHA512bde533c53e696cd8cc5dcef55554505fb5832f24b5e7abac523217aecb6088f49edecb2f08a76021eae3e60fb3968aec637fda002ff332621bee2fa7c9b52460
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d5f9174f0d0036dcc5b55972b05f40e
SHA12acecd8e64a7bc3166d0443614fbeca2f1b632d4
SHA256c9719c139c9ada2a7d5dfe0e28e3d26d40e6c582d2e09940b4b21947dc3960b6
SHA5121bdf2d29887624a07200911933e457de4c306812c7f224efffd163bc942dcba59f91d2bdac7ebd42985c2024ca4d438fe4c8a3bd9b52c623161b7d312e1dd4e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdc51111470c0320509ce8f11e5bbfff
SHA133b13a802d178eb7cfd8482c478ce5097e5d07c7
SHA2561aafdf7da01c2323cab50b45d54758995d9665296abd3f0570522d776812d197
SHA512cc7877ef254dfc5d712a0fd307bafa95ed0a8ad4eb7feee96c79009fbef484711c321d987c6ecd13df88581e40790ba8cc7be6b29136c7176cb11b8c76b9fc71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d35c0c24258df618135517e17c029322
SHA1d9583722ca87f240db6c30d042255d4c1f6a0589
SHA256b1992c1f345eb5eb2bec2eb8e39795b3b1d3453609ccc106b700e18b08fe29c6
SHA5122c5725bc7f7bd955293e4cba788d1bd087fad3594d161423578b85c986293ce43a689d204839aa6f6de94561743645a4975b2794c3cdf35c521d546f36b7e4c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cf1b924f8c81879879acdcbdc44c24e
SHA11513be4cb78dcdd09db314a0b70f8e51d5e7048d
SHA256e8ccea080bf780cc7833bf07baade49a38f027f07efe572161a735bb7118133e
SHA5122a9bd9d2b64573af6284eb2bebf97955e89e0c8445836d5f5aa1ac92421fe4e33a4b43fc3d6521f1f4bac66f0cc106f50d17a119946e0df1d07553f9e4a50b66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563dc4bf21e2d28f1b8497d4a333d5172
SHA12291b54bb3690aa7674d928f2f214c4dc8daa842
SHA25689b0b2a3b13a9831224ab188138b06f306901123c3fe7f6ddfb9e54f81bcd5d2
SHA512245e58240be4521b9527712d8133fbeb969516eb6fae7f1f8230fe48cc38907c1820e8bc5c4cfd17fe342790a4598bdc691e4ab4921e91749953d8375baf117a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552e597a278bb723f73a9bdf2ab1df1ca
SHA15bc47a7580336110d2a7ba3953e0dd78e37113e5
SHA25603eb2830653ed1be1c089491fde15d50fc9b3eef9add0d20ee29656ca2899ac6
SHA5128810ab47857b3f6d9a55fbaa2c90e6bfb0c14cf8b51f9857355dbf97e06c6cc432b2d813653696e7ead9f36664075b2b390e0ebe37741de61f45cf55ed31b04d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5e7257007dc41da498f8060a15258e5
SHA1085b3c0760a562f1c279402f40e171f3e3cb2233
SHA256c97366626f806d1868d30f5a98b74355ca5b33dad688f21efe7e1bec7ebc8c65
SHA5125b6a741c9b7b147cb4960a625d17d6c689c79877fbeb6cb14b2f4b6be7b022d3bd43cf94184135fa7ae125b6622811a6fb742de8ae1d2d89dbc1ade58584bb8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8be4b260a8289b170c592c6484277ef
SHA1407e26ef60c0a8373a53028d5de5e16b0c841b2f
SHA256f1320a3de41c5e91bae18a0dc859ee6ce0bf2d6d17405f5ed683db3c254dee94
SHA5127772741499cffd6902b2f476290bd24b98a46ebb910209a3898d46cffc4eea08e373a705a82f4ebf8674e945d0b67f8c0473f8abba0b408d1760a7390347f43b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df883b549036155462a01cf7abc93552
SHA1754e8d1c5236dc41267f3d948e6bc8f0e4204963
SHA2566f98931fa40f1ca33d512f22727f32acbc28adee2ba6a68960649d030e830123
SHA512386a82729869e336115a196b7bb67e3eb23225b6bed072a9db7b3880384388a238258e441d119c270af7238834161c84065da55f3cee83be6a71d4c7ae046519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db90ed1e4f4a0f3bc6f70de5a3687dfa
SHA1e8146ac2cefde23bf763d135ebdcba6daaec9c25
SHA256c73c264ed7465706e5c28e253593a4c20728b298926e5e6d58da7ad1dfafc9d1
SHA512bc138d01f09194bfd51b3757931de842d2c6b24f1897ba4efd46f139c9e27e2ce3291c0ee6dcc07112de285be072de6415d7c8cef12f92446de40dae2449b933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5335010209797c7aade3cb23079e79bab
SHA1fa695ff19c5861853c4362ff2a72d6949c7bb5ef
SHA25673c50d9290dcbe9c72560a7fb8d430268d9d802b8c4892c72e6f3554e520e367
SHA512f81882eac75c23abb92c987cb3531cd17ce81401baf97669a57d2bb21d3f00b59bb65e7b99b5315bfffcbb732c0315d07569d7f7e9fc12495ae18ee83b3a339f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a681fd98b5e7c744960fac6e8486ba75
SHA1db0accc94e1f53462f5a0412d35c15825125434e
SHA256e3bf922c640d5a531d593af220eb5664287c52fed05ff93ad431825bf0f858b4
SHA51249f26b0e78860ee73df62d526d4cebbc072588c9261302af06765a066cdaace3aba047e51b7154db023a5f6c36edefd285c71aaeac67b13a68c9b6e1b143d1be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565706923fd56493609c5ce15f59ff3a3
SHA136caabafe35834cbfd4e4f0705b62253c0e2d6b1
SHA256ccdd4ccf190526b0c9b8286b1e79f5cb6b1fbf7042884d78464130e5daa37af2
SHA512f19e976e5d85a8c6ca2c74bc5176c5606545205c07eb4669901f235d4ed8b69552fa38d27d51a52f0665cca9e2066d79ab93a5a49c3b7a5ebac7ed48e5f819a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51421bd173d19e9f6dac9cf8f286f4b33
SHA1a6b9b88348c63dcf2f0256a729f582d0fa99666e
SHA2562d082e7d511c6052af8e62296aa753ab3991b1c33cdb1216581bc26eeb0c1330
SHA5126d14570424a09250c4675b2960e829d4339e3bfbf7dc4efd8533163cfdb4f90306d38ee8302b2c79ac6dc37b812b62cc9f9ab11135149506fc4905caa1d73ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fb46fca75d062eff22c90f1de833955
SHA13fd12268875858ea3ea0df0266fa55b36d18ca3f
SHA256d4a8ff57739d4a414a49c8eac3757107615dc1c27f905fb2e5a3c880bdca4f85
SHA512cb0bae4ba75698ebde163d6e0b20ef80a1325fd7fdd240cd5ee355a593eb5ced7f938c5a76b454a414b2c575db275f9f3bf464b3b67c7ca72c36514090883a47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555d5d762c212702f3987e579e19d75b7
SHA1c75b4b236e382cb303aebef29bf7a412bbdc06be
SHA256c864fffe6cbf062270f9433800a773143cccdd63f3083a0536b079635980ebc0
SHA51228a428959eb3e7b16d1d56d897f3ef9a04e0f54e22b8193fd2ff77a6b352bc932e8d62ad75a75d187fcb6a0c9701c9c154edf44b42e7819107eace549a5925cb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b