Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
60337f55ac91de04840250e88e432d2b_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
60337f55ac91de04840250e88e432d2b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
60337f55ac91de04840250e88e432d2b_JaffaCakes118.html
-
Size
93B
-
MD5
60337f55ac91de04840250e88e432d2b
-
SHA1
862e033ff5cfe5136280ae52af29fb46bd83983a
-
SHA256
1766d2a2f2bb4c4154d8abb71701616753ea27a6a2ea72f3d0c032b7704ec417
-
SHA512
b436e383ad13a70044167f5b218d1bf78c73e107fbd82de726ec1d4535c858d8dcb28b17ac1bb6b7462890a4935d4930b007a78cc9bdb0160cff9bb59a7a0b5f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70623f25f3dada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427675917" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000f9169e628da480652ae3e8229bc5947a3bbd6cbe5a9700db39719b33a82b5a3e000000000e80000000020000200000006771c846e2faca1ef008cfd27448aef4b610bdb574aef1c433ba8473b07da96920000000142f23bd6e8140960f99f4e29abfc0fc36a0c48f4288ae9b372c38227dd178894000000080f2ca73cebbb800597bbc5b3371828e24bd6a079e529072e2c149248f7b8e2fadf2da2e84db40e0697edd8338f47093a1d3d791002107a43b8e9cc94d728af6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000d0298e8d023b0425b621a12de3b5a01f660ed44034c326a8f02aeb8a52c762aa000000000e8000000002000020000000117a899bda34b6155229e97313024a8c8dec4e2400e245f881cffb42fb0f96009000000040952c0a9ccfa845fcf6447df73f05c2e37b60c811792d785718df2419778c91e54ed6b782e2e11c245fa170590df7ad332e573d587d70496211a74e0887b82974eafff6e7394ab7dbcdacf9f6126b8591a776362ab575ba392129eff53918e56461fe41657faa1a6b04e248cee4719309b9e9876177b14b1a57e0e72d09f366beb3e6497c67f990fb7fcef7956a123540000000f90f7f93474a8cf64e03044fb6c150c48246678985cb1130a9b96b9112019ed30ed2ea19c62c93043675020e59ed6b260bc1db5ff14b85529ff2267db10fcc0a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50CDDD91-46E6-11EF-8CC6-7ED57E6FAC85} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2404 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2404 iexplore.exe 2404 iexplore.exe 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1696 2404 iexplore.exe 30 PID 2404 wrote to memory of 1696 2404 iexplore.exe 30 PID 2404 wrote to memory of 1696 2404 iexplore.exe 30 PID 2404 wrote to memory of 1696 2404 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60337f55ac91de04840250e88e432d2b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575b7e107bf0b3392c9c67e513505df47
SHA1d337e4b9ef405456992c52fc5432a9a20d7ad3f7
SHA256ddd1e18117dc8d69330bafe033dd5c40a267e947bc5b86009291e6d91bd5d159
SHA512626769ef18fe91ccd49ad5fa0a975b01f46c05efb103f58516add462e176cf5530e510a8b1a996bc8513430bf50e8d1d39687e58ab173a189929a2450ae6dc06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb53ab8aa5a2333811c7ce5f507d0582
SHA119f3a39ce657bd4518e03f9b1e03a00f2209b93a
SHA2562e944da7b10f3ae561f1f17984da138dc9e852baef91a6dbe774ace8207e69af
SHA512d722d32d701bb7b3100d482e1faf8aaefb0d36a6ae9f10044afd37755e0f1340d29310ea8efd29033cae4ee4c503ead667c3cd403109d8b873f7b81637b9c583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9d8750f1936e975cc744092ce6c5a8d
SHA13e628f3a1cced588f8cb90ec4337835591153d01
SHA25675bc5f04fa66e7348184e22c23a2c8ae6b6b7bb1be75544966a2127b9cab7f5f
SHA5128d306db31bf3d317f3f9398f2f7d8e256664f01bc7f03a7179502e766ff42c1f4d087227c80b433381c06586470aa049074393cb602dc94304d141247be5e9b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575cbe5dbe28d5f5a212f97ef923ab4ff
SHA12feb5ff9d2bf0bd8cad4fad5cfc42dbc3e28652b
SHA2567ec5e36f8f424154c24fc38d5314dd308b575600eecd02f0ec8b6e6e5ac23957
SHA512ee5dea15cd24b0c10c167c1a3391490e5aadc9978342d7ec2cbf3eef8d065c5006cb5e99351f7c558cb2663d1d27d68e72026701f03962bfff6c9ff9b194a1a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb6eacf177d8570c431886ebea0f1cab
SHA156554e8f37752fe4a8fac04d0c880ed6619feaa6
SHA2561d919162474d3667fcdc39b57d6fcd80601330ccbcdcfa2a6c74abc1b760fb30
SHA5123a3ede62d8ce69c7efb3579195dccaaa514f9e7368553f930ffff108839280c3b11fe6284f499dfcd3b544d1e786819878b46569ef364fe0d0dec7c2b25c7f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b8cc603b6424d874cbe959030cdde63
SHA1dfc0b16e36b25326bfe4b45e323504af1168c5f7
SHA2562f4028b298a20b808fdae9d4dcdfa04d274709f7d4fed4d8f06a256314d76f5c
SHA5128fe291b8f354688d2fb86501bbf5c8f4cbab04c49dcbfa365a82e83993ee19266d6f3e6cea24658fe4faa0d3121f189f430031cde4668ae56ab546784df36255
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c8b808d1073fceef5776900237c6e5e
SHA1669472c21f6cbe77944e1c03be21ca6965e5277e
SHA256ed99d1aecfdd348403aa003a6895f93f0d30466e6e9f76b7dee64995ea2bf391
SHA512781898b8a9836da7e1b57f50c318db566c196a0e582472d5b90636188ce0dc9de125a9ad55a7f9f907de955ded6910d2a65052e316ae590629bee613ba7ebd8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5864a86e9264fd779590e8a90631b8c7d
SHA1f8544ab2cb5dc547e8ad9ff82fffdb561f6f227c
SHA256a6f37c0dfcb62b7cd31342113c017f5bcab549a22c2f56e089ffa4afdcdf790a
SHA5126ec04bed459c2caa23a8d59dfda3f5efaf402c6853ec30845267b008201e4dce3470ac25da2a212f6571a03582deb45c00c5ab0f9d2daaaff6912e9d4c547bdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527bf4d1503d9e29741024059cb479b4c
SHA1e85ffcf5cd4682ef166e1ff0a34a16290ccfecdf
SHA25618240a44cbde1a299cb3553b832eaf9b281048fbf70d547e079f3be6a2001ada
SHA5127caee85cf93a76cb96cdd2e384d7307ab45ebde52b391ff1108245bc53e4afaa2295f01cef9251af4a1df60c5600965cec46d422ab8af1ea798fb6188dac4012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e13b923022e0b817745c14c1d5b6fc4a
SHA10249f925a091b96c687c2f0b289b75480883af0c
SHA25641813b4400d87e8c60549a60e3b80b54438aa5e4c8f31f30d9c4a408c169e2eb
SHA5121e419ef660fc8e64485a2a3158f46a7b1bc331d93f7192fcc7750934c8b9fd97ee3baca3d4fc9d1732f73f7403cce7a058ac82b2b889f783baf5539f1612d5e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5084c10c0d76eb7d45f5c65300155760f
SHA1f8fa244078cb524d06e323aa49eec313a23148c9
SHA256dd1e339a6f719bdd53e6bf54b02961770e0e03b3bf79c48089e2f820a3c19d11
SHA51278c8814a15f423a62ba3f33cae86c9077441b6ec47229dfc2b603d96733d2661fc1d1eb9ee779034ae68278e17a2d6ea19a6ae91cc1de697ff1bb8b1bc09f636
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0db13bb18fc2cefc89dcb0f7222ab05
SHA19dc3b9ed7f544911bd427630afee01cd3d458218
SHA256fec7fb1ee098ea25b413698065fca1b3d6ce5eda7013b47cc5845e5125c95071
SHA512aa14fd8a9394675ae0f5377b311c58537f8e2b09d2c2eef404456930e9e30eb015f0ae9707904879694c55282c8ef52fb6dd5b13e2ae050fbf213ffdfc0eed24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b21e682e46d6743d197b9a2464dc33ac
SHA1234dc9578244e844db5ab521d38cbe0ff6925247
SHA2569515361468deb9320b67a8ddcfd0a57418fc1759b0e1031468cce4921641dde3
SHA51224eb5821efc033aa29013c7c254e118522da387a17c972468e2992d04da59c52532bfe14871e15c343e3171cf9038367ec0c5dbdcff430528e42355f212007be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d38c04c4c52bd10fa7f8cff773816124
SHA18a803055d8a94053b76635e8c2d94f1ff6519185
SHA2566016d9eba3a4aed7d7fcbe15048ed3faa97b6f6c08e42a09c989a7a9f0335dc8
SHA51212fcf4ee4182d509caa007568d801d014ac86291a2ce70e4780c801d330b487cfdc8a2cc72a373bc7fb93023fa9fe45e88855d9e50ac19004ec9487dbb7cfd6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550675cfd3ba02175d0aa8943ed127839
SHA11595d38fbc9de3b34022f3796460436738e5c01f
SHA25688c52a35cb2fa626fcf8420c7e6b2693f8d8ea04a6ca5ada2bfce17233bc6a08
SHA5124877222fcc2cef94253cbe5d89fc5f7eb432635c3c32667bcf9cef9a930be3d554bd69cb24d9ff3398a825426d50b659599d29607d1beecdc02c1750f99c95f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d296c1d3595459b1a7019533e1c9170
SHA15c56ad40020b4470f9e059f5dfff469ed0b9dba9
SHA2569663b28caa1df2a73ff552e58c3c2d324d313681d122bce9e14bcbf57dbd7405
SHA5122a7f0d224e2baab2d532314b9014bdc482dfdcb879b605ee2b329e0ccad11dfd03662b0e2f01ef0c0eebd7304267a40543cd8898aee3d29962edfd1b8c92abf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdaaaf99615134495dabfe3756d983f7
SHA115aba9221cab4d5dd1ff9dc93cd37a36a893d6c6
SHA256146f42d96385c62ca254ae235938588829a8b027842f535f412c5b1e54a41442
SHA51279fe7256205a2f0fb627e1409e2f226e0b58ddd2bc4714b0db24a1d78eb252e99af086c7405b2d867bb9055c3851107a472b6607f2897bb32a6141b6bb3fef7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b33471e5b6d22ae1d20014538c218ef2
SHA11ef61c8324c8ab341316a7b81dc12e921983f050
SHA256df885569a1378e06d07f01dde25b256dd6f8cacf1d9c2003e8d13a4e22f30152
SHA51268b2492225a7f873cdf282a3568ce5498973d37908dc1bc9160d8deb37b135b743fdbca35ba23b4534e86ae1688d23b90ef4d5ee1e9845367de2d08294ee7090
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b