Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
618495b9cf004315a1071fa6a9119aba_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
618495b9cf004315a1071fa6a9119aba_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
618495b9cf004315a1071fa6a9119aba_JaffaCakes118.html
-
Size
94B
-
MD5
618495b9cf004315a1071fa6a9119aba
-
SHA1
6c11fd4378ea64e3d9dd38fb9dfe46ca6c545a8f
-
SHA256
941c683c0b72aeb1aad9c97662c2521626dda22ce86fd27ce1f7532105d3527d
-
SHA512
aa25d374f90fc8bb49f9d4169d6b636cd91ac071134a93ef14ddf5745cd6c47c9bb227273439437fc5e2ef6d6f837e8b3f91278e6ae34458d9f8c834639666d5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{859C34D1-47AA-11EF-BBC5-7ED57E6FAC85} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301c085ab7dbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000156ab935626c4135db2288247e43f320fc5f2eedbe170042d0c512ec81ddbe5d000000000e8000000002000020000000a396872a4c2648667f7124c81b8dd8906298932eca0cd658f7745034e5715f3120000000c42b81915bea2cf1be74d79c95f6930aee1e514236cdc9e764224a188db3573b40000000570e9bb4d03fae2837a18f555653b694d060218939ad5ecc2604978beec531cab9894dcf335b02f1d1284ad0aa2cdaa74205643826fb0ef79c798f606fb3cc55 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000005bec8bd94d0d2e726f177e9ada21714422786712f05110ff31c80c58f7b7e6fb000000000e800000000200002000000009975989d0f626ed5c5b33e7e665f9c61e2a3fbf06039a867e909e877d611fa890000000558433cbf5bf8b330c148dadf53300b39bcdba9b74da958fe3a8f540e58ab97bea94c1fc2ad84f06bbd6ada0e059108ef05c0f9ef979351151f60b46f02b2aef63c526f84fe713ed69f91d79674a3ba454a4fa1ec8a8617a68175a85edbb1eeb34d754b0ccb5e819dc65ce8ecf914e79b792463884c6105ffe510792258dd63e83e1a76f4c93ec1fc37d7bf629fabd0840000000ae262d635e1d3b1f0a3f90f8aafd914fbb163e65eb2d54f0375f6731d17e6c8e1b1e1137d7c0e4a3d8710d7675bca6681c9bb3fc433763f80cc9491e1c5f6a12 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427760185" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 iexplore.exe 2348 iexplore.exe 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2780 2348 iexplore.exe 30 PID 2348 wrote to memory of 2780 2348 iexplore.exe 30 PID 2348 wrote to memory of 2780 2348 iexplore.exe 30 PID 2348 wrote to memory of 2780 2348 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\618495b9cf004315a1071fa6a9119aba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e1b46e56c5a42105b58ccf6d4663f88
SHA1748a92988c31370524b05de837565605a1d47472
SHA2562e0fa0028f1db6b6b43243b6f504a55cb890c640bed469822b8dfc378b5d355b
SHA51289fee1df69bc7f2336b9734696bc5ba1a4fb77c244ba8ae6cd2eb9996ec3ebd057a545a2bdc84280a6b9106666dd7ab6ae3eb5d97c63cf5c680993e029871ada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a33031586ca3997019ce660d4dfe4981
SHA1400ec49dfaf59f297a3ecf20c66e96277d575870
SHA256736a59e9c31a086ccc9c488c97136526debfc6e3ab2b2fbf14c0dec24b26d5cf
SHA5126a6873da997439c976a9030277ca76baf898dd581511f11ee4a8bba51ddb87ba55258392ea62732fe0307a0e176acc29537a2f873406ce2349efe6aeaf3cd383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537069f5349a359b221d84bceafa3f1a3
SHA19569f8b57f3340d0d0f50e8833350ba76f9ed4ac
SHA2568ad57fb1582829f69e1c657398c6cdeaf51094d8b396d91872616a3d1429d207
SHA5128b073683a40ff28ef9a3330c824ebb34baf290995ec6979d51a2c75f2944836903a476120a1dd43f28d9e3f10ce610164c4b0a591d0248944966a485ff03fc7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bebe7c85315b0202585ac6fe8f8b509c
SHA111277b3f19ab491c211d7ca27ac12e35d468e2be
SHA256bcb8591075c9045bfb5fc40d168c564cf15a2de5935d0a840aaa8591cfe634bc
SHA512aab48d25c40559d33d60f6ca15fc11087d18290ae2be4692561e39f144f5ea433443b422e4edff50b77c553e7cce76bf4d988f9ad96dc9d12c4565e5e10cb16c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b031e35a35340e3228eab3d726e6fa87
SHA144d3a1f54f599e8fdf37dc93ac8db45b45c96def
SHA25657991b372dc5e0773b4b88e315f43bdf8b75c94f691358699ed1796f3d269c55
SHA51272977095de31a0b95ecd29d4597e32443cb07ad7a56095b15ae79ed7d54048cc8a872750e744d64af7b14004f4f202ffa485cdef38c75ca73bee02b8c40e261e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c758e2aad4bbba5b37ce92e0eae71079
SHA1f8c79469ae0dd4e735bd827b4a9b0559808695d9
SHA256433d298ef7ee22974fdd8bbcc35a523eda4ea8995216b410eb7487f1eb14cb12
SHA512c3810bff192dcb0be07bcd2a750760219f5225192cfab14eb8391e468093211bb5453f7e28c92e35c9cdc24c87a1acf981c55780f40c5e1c197280330f3d8c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512a007777d0db8a7eb1806031c11eb47
SHA1a41d2b4caf0cb01a843e2e181057e9e97995721a
SHA256d4ee8e374be12b61c68cc0928f1f4713bbb0ec67a688a51b905fa691725eb0ad
SHA5127805dc953897a896d0c25c87d6307f135ff2467abf35d33d6bb50f5d0f9fcec20589518705d3bd8f8942050b5c653a251e0faacdbf74b6c35da89fde6f2902fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3031613a5e723bf5874d047a268afe6
SHA1ed0850afc502b45046e23a36b7f3d63d57f53787
SHA256f15aadb65b4799b666a0124a536f894977297657c8e341a516b9b6fd67d2d7f1
SHA512b0a631cfc656786b1462d5072ecc7a9a201f520caa1678cc81fdd41f6a3f79575b09be4a856626fad33da337ba4088a3581d2c279d5b6af89cb8e91345dbf802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520c2912e315a29fe3cb2845c80c8b990
SHA124b3701526c4351353e113db114ca98f6bd89baf
SHA256a62e99a0082a619baca506e84a70ab7c2801a4dbb40de64ea86954cd9438e035
SHA5120e2bfbbf1477c7a9e6718a2331e28990f373921d26708e3fdbc0cfbc962989e62fdf8a7ebc285902cf822cb74d6080025ef7af49676809c06185e491da68a755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539a6cabd7979e9f3a5b3dfca16bc8a38
SHA16cf4423982059d5a3b5cf5f79c1d70a143cb1288
SHA2568d1809076561c5fbe7eba153719e188897949fccf06b2be639ea9c1725894790
SHA512b9232e8d753f5ff47373cfc412364bee6f5c6c69b47be9568426cc79ea18e52e960ec7463ac89bc59d70be88f44fd42c668aadec245cf33f53a5f33641506aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbdecae0da30d167f5797855ed9c1af9
SHA1c0d3585a48fefe4556bf9c36dc6cb8bae90bf04d
SHA25618f851971d4748b862a854c4db8c7f146878af8605b610cfd351a5d84824e505
SHA512c363bfaf4f461eeecd7977dda1ddbfa334d48676a05a6499a5472687675f85045fbb0780431da3cf58189dd4af801fe5f128e830a6dfc87f4a57a50a76aa6421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5623da26452777d098836879fe91be300
SHA16e94c28d14ca37de2603a9b97fc4ca3944796c36
SHA256ba853d29b3f1352c084439ab2925992d0ff08f98b33eb4f73b66914da9366abf
SHA51209856b3bd13e647fa03e3b24ae8ae5fef6fed0ef70ece528130f314ab362f16e86eb7dba0146ecf2968aef8eb21c55f2d6d1cc0d37a65274b20716acd86dd496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae35bbadf96ef511f7078e4ca3adec50
SHA153b8d499c33b79b08283c892184529c820514c90
SHA256a4f51c98c858e9c6cbb65ff0c5ea5683681f7d3488a36c4c0ddd4bad45ab4aa9
SHA512f7918975a0588742b60d8a93f9b52cef735e05564d950b9c154506e0966e7e8dce21020b737f2e72053c1b160b6d1a069756fe68422c4d39261bf5da78abec3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c21d2b8d2b965659b2dfa7d162df6097
SHA1708056245a70a0c6b3a8588baa7729e5b34fb287
SHA2567fe1d734485c2db27be91e3a032d09e7410c3cfeabf51bb60479884d24a56940
SHA51243ad83643c06a041d9d48b40e2679337547a618d43016e5a46748036c521e9192a8135723c254cc08acc6e7df8658aa71c3d9344cd583d5f3f748b1d4737227d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d922f248635889f280ab9f4899eeb7b
SHA121e296dd3f69c30ee3161af474890b8e9d37bdfc
SHA256578601e601967f8488f42ba8980d50714e64e8b0943f07465c49a2e15749c760
SHA512cc06be976652c03de5faec1d7344f9044b95bb109a43fee0d7beec08520e23078419266bb92778d1669f6175c964262738e1524e0c94fabcd40f63635d4f0c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1bb8c2731180b37720fdb9c29b0db48
SHA15aed4ee188948724744985b0085895914bef917d
SHA25658df90c91191d0ea8b7b26656df947ee2cf8dc00262eb7d0e0c242d1f583eb40
SHA51224b4d3e819825825fb12f294d290a45a464ec7c181cd0397688778f6dba21e2d27ec35f9d8281ea22b02894930d90cc1f86e7266ffdd6e49602509092a53a368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a380a0676970a3815f2a2373d566bae1
SHA1597c8dd4ee8e3a1a980926d1babe6dc381c82c46
SHA2567254404f07adb08c6a0eb38976be57d227f7173f6fd1f4f7ff13be2621ee6436
SHA5121bea833754870d2d7ccea4d2cb1e01eddd957129e4d7b3e3a4dc41014be38537acdc8295fe3e22a4ab8249ae995c5b6d43f97198db561e3b582b1776f5e2659e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574956eb88ca92a5cea35a82251c92ee7
SHA182533ea7572d0a08b26cacc5172034eb8179f713
SHA2567a8bfa1bbbaf028e9d378fe4faa86cc08afef4a1d09aa6269f80e720436c84bd
SHA512d6ef13c939610078b7119ab824765e71fa791ad4e8c6582bf70d8fbf00a51fdff4907ae648e09e175239d13698f653fb3d6f526d41f0370e371e76ad620806be
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b