Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
6006a03ed0bcafbf4d30105233c63103_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6006a03ed0bcafbf4d30105233c63103_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6006a03ed0bcafbf4d30105233c63103_JaffaCakes118.html
-
Size
2KB
-
MD5
6006a03ed0bcafbf4d30105233c63103
-
SHA1
2decc2c1226f5d44f813a253fb6f141b1a0e0ab1
-
SHA256
30cb7c7b8390b22e465e0a9c8129d238ce58b0038de5c1c91a95b66c5fcbd90f
-
SHA512
b0b78d6f9381de751cbff59a6d2c268d82e84018769402a633bb042d9853949ed4bc26c6614ef21ef6c3b6cc6fd26419ea492052edc5ab80399c46f2c7157cee
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000009dc183676459dfcf0239677e1b8e0aaa28aa9bfad58edc289a1c9f0056a36a7b000000000e80000000020000200000002ef721fc00e3659d2e698ebfa3e3ac89076fc213bf5799a8b624a859bfa844c290000000a11b572cbfd93c988de8dcae79be87170fdc1d71c592932968a342f28369929147e9acc5fd87e8dc3496cb2526a48143f956b4819bcb99c3df021e2f73f0d217507f859a23b083004e9e786d40fbcb92bd83e2b1bd9190f1806001a70f2ff048da9a83de612ccfa90a3b0963f32239d57a1da023b52a0330156f676337caf0e5e4f81ca0dc323e96ad9921047e58731d400000001c17b7f685af331512c40ef3d5c6a40a8c0866033879305d07891f76a54a6036b8d29cc0eb5ff3c7e065227374337348d23514c199f77650758c77a1deb69369 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427631524" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000009a7d4af287ae8aee828b4c56914921ae6616913953bc080ba68fa8da98e811e1000000000e8000000002000020000000863e6f6e51f75254631e28aa6e0e091b008b25f2d86def1e952ae7a725cd96d420000000d757ced7449528ee0e7f53e958423efd14d86c26e9209d88d4434cdbace0399a40000000e4fe24cfc4d5ead32b2d18eef86c821926b68e996b15e3ac7c0f1b5fdd625208000b7c1b52fa9a05e440174ed1c0379603d1e47d491c4d0b640d5815d287dd98 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008f7ab88bdada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F59F9291-467E-11EF-946E-F64010A3169C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 964 iexplore.exe 964 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 964 wrote to memory of 2372 964 iexplore.exe 30 PID 964 wrote to memory of 2372 964 iexplore.exe 30 PID 964 wrote to memory of 2372 964 iexplore.exe 30 PID 964 wrote to memory of 2372 964 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6006a03ed0bcafbf4d30105233c63103_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:964 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56558f7ee68df5a0c6ad6b9ff0840afba
SHA1cc03198c14ae553b9d13f09aca888a8e2f9f0464
SHA2562211571f98d50322e6a6639fc3de266435c4109d9b5830044baa5317292544d0
SHA512d1e06ba1239dffeaacd7c7421f346f8379bebf6c22f85df73835c24b6b851a5e668e51a75dd08ee0610b25a91d737e56e658af76df031f96ad4e5919222255f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550fed3320f0dc53c170ece6838ecbebf
SHA122bbaf5eac43163d9382b576b84959ce132b2c4a
SHA256b9347196f1a26b2bb8fb7592592674b586350f63467423c8b8dda4372cebe581
SHA512d760fc5a4af73017cc8e4233cd44e7e910daf4d4e0d7441636c45b9569863d9aee76352cc81bc0255b691b504f193cc1629b84e67dfcaeb8572a25a7ae1b39cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b452e8b70a1cba5920b6e3303837bf4
SHA1bb20f948e9db88d8cb12d5437095fb034e120a15
SHA256db5f8f7b88d94d6d4e91e024aabf6d588aa0587a141f3e5c1906a15ff5de815c
SHA51267d1a7d5f776ca1d62ce620edd914e0c1b7588c46b7bac85a4c220e7c447efcfa6bd1c9153ffeb051783ccd0ea1a3836d3a88052ac1d0234dde7dc808fa6f47d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5437f5e643707915404619b4db5ab9af8
SHA1db62b91bd04b2a73847559218634688b59e64f6a
SHA25645d6e44f777c834c21831a438cce671b6c2526a30ba957696f23284739a878d8
SHA512f312e45f1ef80a0b04565d2601247a5db2fcf81aa936a988d173a08610bf88f2e536a5bd52f87b603759b5d3f680eea4a55d86117aa7e7eceeeae34db4d4e9a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dae1c67fca0394f8a954efeed02fd6d3
SHA1014aeb0d4ee8a0bd79bae593723c345a27b99797
SHA256bee04d616b1a0ed26715ba3795dd20e90517d61ad06f81ecd7a400b251fe3d50
SHA5128232d3ec790632a6b185cccfe882d7c401bbd5e4131f366ec4fe3b52a499fefb9eeaa4073963122ad0fb6839e322453a463c369708f5f4dab19099f9f51180d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5963ae11887eaca87bb4c5117e07d7505
SHA13408b3f6223378d1b23fbf4d1a58d5dd1c050251
SHA256876c058a5a7b53bc9133b16b05a9a7d1bc433a3dc627fcf9506c45c57b42d839
SHA5126901cca91db6b536fb36af908ea80d051edfded69a17bee0d4226d06b435d9b0c806ac3453415ea72edc8bcdfe194a4cefe5e118307072d31a12e95242769622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9f24473cb0be7cc5dc2fa6f52d5ce3b
SHA132d95c88463db8f937d87c3fd8905479a3838e11
SHA256b9ff1c57a86bd24d1a4e87d36adf8eef84ae3795cc0f4e0771cff71538ff4454
SHA512cb40a9832c9c712fb10bbc731bb3488256989f0ac1e5cd4dcf1df9af84272233b38b2db585ebc07c8871ccf6eae93212ff3a2f0070efbde83432bba9587afa9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573bb75899c78a4f6598df5423c47af04
SHA1ecc4959055304b3a2a9780eae8eda7a8aa2535cd
SHA256342e2c6c49b730bd515a4b0ee33544b90ecb1d1b926eb7888ce9f507f73d2877
SHA5126e27cb0d2f9e3687de963a1ab6f51795da4c15dd15c4e394198c37ad7e59b722d7e071c47d3df6b49b5fc7cf591131122f5652bdd425a10053869c453119f3a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b48a96fada84ed8a0b96f45eac60144e
SHA13037bede273d586675df43458d85637e839afa4e
SHA256cdda31345ee0def55aa63a67c19d61d2609dd8039a7b2df83bbbd7fe534475f5
SHA5127476e135ac85caa97e33f4887f235424740341c2e14e025a7d20c69e96bd6761cd9d1a76c36990cad5fc580257c6efbd9c04e98fa940bc69dd236f3dbb4e1456
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e142d38db1ed0e1753068501a6a04174
SHA172845288f62dbe3cdc916affb9bae29f5545feac
SHA256355cc5bfd0c48ced5fecd2e6af6ccdaaf7df471cd1af46ec08f86ccbe03ca452
SHA512379f1f8ac9e9465cb935b9de269bdc5f59113391c048246bb21a2f2e0069743ab1b670e905b0b79278f13247a5e28a34995ee2d4bc4f4f29b610a9beeff3e5c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ced453f81c6774c35bfa3dd68a16454
SHA133e82cce27cad5cca75b02f8cfc2e0f9ce9b876c
SHA256aeeac89dc1317519241c6bec903fd0d8965dd6fc381e8ef3a2260b8ce32aad61
SHA512d607713da5398213fedc1c37a3ac2457a997ebe3d3b0d0c9594acaa646d1976bd97e0516ea872b4f669a627f21cb3402df57e4091bd932e91092a8ac84d51fb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2066793ba5cffb71597949e884564d4
SHA138f56c0735ef84ba933421473ce12d88a57fc645
SHA25638bdb0eccddb2cf866376c4f320bded3010b224db1e62cb9f42fcae2d08a7f74
SHA51257e072cf5d503af64985fe662d758ef96f6e4a2f1d82a61793e5f1845b4ece34906c4921e32e19c5b13370982f7e4d1c89eab4fc5cb0d5fa6f9866af370a1328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b06d1aac8e89979d4d318d260a5e351e
SHA11bf2dcf11d6d0be69efa3ec75ddf2e520a92e340
SHA25634025c81f577263a3693985aa855d545afcd0d7024a1071d98dd7552d336f17f
SHA512b10692f9e8c2418bd359c698de38589d605ba3c37ed0dd1e0585034611406b1f37323c9bb21e11f0010842e9d4246c640384b2b044ba5c955b8e8881da2f947c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c22c8024c3e9eb5af00fc10f6d5f3de
SHA165a3eccb6217ea25e369c658b63cd005a709fd3d
SHA256abdb13c78270a7522545258599a236db622f41e0b8cf202e7db2336168082eb5
SHA512bf0cfb5ce45ad194d594e5925442d8accf2241c7b0b513d1ff7ee6877145893701283fd0de915b13298481d25ac91cf62de50bdc989e20779efb42b7019a579e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bddfaa0b97a1837754fffd0ae805c8e1
SHA1cac81987e02c79a45cc2bfcd68b6f7bad44cd031
SHA2562f034e9b7504c09be3d6a80365aaa10e8d933d76d8f972739cfb0f77ed5b89c3
SHA51215ca5a6bc371ba41fd8631b2c9985d8efc5dbd55bb0d26bae0033f2972f695ffffcb78495ad034a75ed0b14dac37817643382f05d1e2736649fc19b1fdf7e017
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5c2a80b54cab9e57e332c35b4771d83
SHA1806f2ddd8a7635eaf8aad4636225f70f3e15eb3f
SHA2568ba8902b19a584cd23cd927a085ff85a9f7f8dc2d81df09bd1482082b755d46a
SHA512b3bbed15b8356a3adb8a3082eac6dd67696d1effd3564a5b46850f1c870b34d1e0aa42a4dde8c6d71a7c836d6b5ecb9f9dbecea52620b5daaf2de77a60d1dfce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a53a7576883dc1caf513c1389f0984bb
SHA10e36df88c4a6908de74cf99d08d5e93ebfef373e
SHA2567b4310ad58697bd737baa6fdf99bbe097914fa61677a9e42a1d3ca76241560d6
SHA51276ae9e8ec37792a9e0c1904b0c3f967fbd4bdec80414f727e8ef0a2b6c6af557e64062ff366194c7a19c632e4e5580cb1970961782ffbd81abbbbd754dcd765e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d252ae8ae8bbaf14d3218e413384db1
SHA11ce4e0fe49e112c47c2c4e0944f9cda790d5fc51
SHA256da05e919a11146be00ed33d233c916953ff1bc5dc95d2d4528da32e86d4b767d
SHA5124cd6cfdb04de76cd190c75b41c176cd5e5d563e144bd61f155c391ddfda6c0514e342a6cb23b826afe045f01fdc4d24f912258a758a9ae649ad816f2d28ce773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56df62e3f3781f9a16e18ea1c5bb43002
SHA1b21eae18350d4f985fbb8105f3d2e966c4f9d732
SHA2566399f1d333098c999dd9e98efe27350f923b234872e9f4b2f167246d27951922
SHA512507d8d9bed5cee7485beccf3a6ec79982cc83aed0b7bbfe773ace9ad57b78ea30fa9676b9edbf8441c06d8f8ff1d3a9d650aa70579a840e55b19a7ec51b34bfd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b