Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
60a322830a562f1a95ed176d3c56fe00_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60a322830a562f1a95ed176d3c56fe00_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
60a322830a562f1a95ed176d3c56fe00_JaffaCakes118.html
-
Size
1KB
-
MD5
60a322830a562f1a95ed176d3c56fe00
-
SHA1
eeb99133647589b91db19d009a2caed688be6097
-
SHA256
5de7786cadc5e181df0deba3a748595f49f63cbc29609aa3eeb5d116ad679367
-
SHA512
58f62ed0147678897db71c43f647583289a9b9ce5d0be71078ec8c6b720d654804009d05e49b781bedd9747cbc0bda3569bde34a34a03ffd9d8c520c68017380
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{177FB311-4763-11EF-BF89-E649859EC46C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000025b45bb01473b679d0f68b40957c08d934ce86349209ec615924c0df7fb6439f000000000e80000000020000200000000ff20d069883e9b97fa2cfd1a6d97dd7b1bb1c4a206bb45474a6f082de2b689790000000aae38aaff49a80ce0e4b22b11aa727edf19872683f1fdb5ba078234ac74c05ae0825ed46fa611fc1fe429da813d022e244cacd51b059911134a34220ccd1af95e0dac3ac1788e23a989c2950a5b5b3dd98a7152557bf666f11ce33056518eaf951ac058b647571ae915a97ba7ac1b9c34bc4c64af21575081d16faabdbe6ed99e9175e551b9376123970846d9cb8a5b540000000b29c6f5edd89ad9170b8ace51bc2c389c7eccc27cbf34a9ec4a6a047e047f67d2cfb0c8002a7dba68093b8440f0d59674e8e1d3e520c0a7c8167ef09f1aa198c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000f54d2c63731bceb51b7b723e454799ee8fb08e630a5f0fc2f1a9a75e753a5ff1000000000e80000000020000200000001c29f196df93b6bea6dd1c981493931ae143bde3d2ff309b6d8ef525e4142315200000003f6f1501e3d91da7bc5d43ea113b2aa52794a467c7a10957537665987be5c111400000001e29a61748022c26a5837274a00517494852bed749c0e85fee08b54d04d83b7138d929cfdbfbce9219712811b4d0e3d699069f44940d378de1df8ae61a6b9ab6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a8f8ed6fdbda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427729507" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1740 2092 iexplore.exe 30 PID 2092 wrote to memory of 1740 2092 iexplore.exe 30 PID 2092 wrote to memory of 1740 2092 iexplore.exe 30 PID 2092 wrote to memory of 1740 2092 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60a322830a562f1a95ed176d3c56fe00_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5136aa98078d00d283418c0e747b9ff65
SHA1c3b81aa23f8048df42c4a57076b8bd94c32b7372
SHA256a48d40f7115abb064964adb485d75eb14f1774d36ab7927438a51c24a63162b6
SHA512f3a01768875479dac698ad5e77e99c2457cc0b14f64d889902701c383e4c992c6081c375f0d5bf60efe178ec7ffbb4b0bf150bbd321db00507873a8394e7eb37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56ef90d56be16ce3b14f1c5ec874b67db
SHA1ffd58143fcdae914ab6800bef5cf7868a1846275
SHA2564e1bd419d773da9fa4ba592d6eef321090b62555f5dd3d86dfa11f9f1401f263
SHA512d2405843a287ff2ce557d12970f9f8dafe25dd633448e7d758f5e92c7ff36b545cc6be891d9f015b58fc1c83e82c8389c2e0ef6b3044ab178fdc0123da6f7221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d48a93f6d1919def3ba84fcbb899015a
SHA1d2d22eedb1d2df1cf14381444b3f932d0bd8bc92
SHA256a534337021f270a8cef01daf34ee8d5ee776538eddf4f48f4e83d42465b158d3
SHA51219d03c97da5f25ffb109128fce3e95d2e66eee9fe90466f910706845bf71317990a8f16fdae3a92d6adc57f57ca63c9687a2ba478de387fe3e9e75e30a23e25d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51a528151d781b61c863c08b4eed6a481
SHA1103c416b2b4e714e00a7d65579ffe276adbbff48
SHA25604273aec4968eaad77526ab4ac95ba8b6c736828e29bba8cc4a44d5d6ff07454
SHA5129384db0115d96ecf1701ad504715ff0dcf06cb212cd87b711b909f6670d050547c2849d9ad9cf54cb63ec0312d9421cb7bc7a20dc28ac33e8e15bb520d016705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57cd4c937ff3b8296145bfce61987ef12
SHA122bc80914879d2afd265ab32bdf560e1253074d7
SHA2560aacb13604c6e09deaee6c7f5f7e06109e35df124603812db535ab738f5c0a20
SHA5129d70fc6270e1ea300f47976fbdb1370e01dcbe6615201ed4618fd06331cbe12f151a31dcac07529fc4d0412e58495ff0184549c9540f307a57b3ed6450258430
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54e156712bb61549c9e7de713200343d4
SHA1e2c51cc4e9340a6859f81c32b96f080a2013a30c
SHA2569f3ac3a5fa274147edca9dce6d0d0a70a4c0c1dcf8d9ba554fc89dadaef07501
SHA512927d6f95d2f31a2d3fc6f85d5c9a1151b64d5668c1fec0b41cbff81e0f48a1bc7b3e8d1f004d72c7849408b22cffa561423ef78510e7b9b3a863de8f9de7736c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5746a07fcf4c5e0aa5016da7e8bbcf683
SHA19c8eb1d0832dc0f09a468ac6ffc2a2d3ef28451c
SHA25655e3415e2d40b0400776b95f484462c688117b922377f901bb1d7c6be02b585f
SHA512fed9fc1cb0dc2844a5762a53e9aeb24ccc5550fb26ca32dea041eabb60c2bf81b2e55295ce5ee4eeafc7e5046fc67befc80345c83a0390847e7c4a4289a06482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD532aafd6edc72d9e771acb0978043368a
SHA18e63f3424c4071fa9717abe4236a9efc81113a78
SHA25623b3df07f1c2edf8c442921f7c9b829b62ee3604a96d7a8d64683c95b280eae1
SHA512b36880aad2a9c06b4d6e4845118adad3f9da80859d12dcf67769a4a13e24ec02b8ec775fad173a50f890c45ffe8fcb76fadade80e41cfc17ba424cd36fd54a46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bd45dcf85706a97f080578ea35c37f68
SHA19684d1cc982c89ced64081ee48d64b99e47e62cb
SHA256e13b12e202d2b517bbcb05339fa83fb885865926095fc77d3247160a2f725254
SHA5121e26b12519c25c23a541bc8cb2a248ea37b67b5e90b15425d5be39a445fc39b44c0ea4e1df7c9c7fdc5e900d95213e3628686e2ef362ff7d9c9bbfcfc34c2e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD541818125bd724904d89bf5d6f7fd98d8
SHA172763b276ce99866544f7fcaaf50828576674d6a
SHA256778eeebd40c8fd4f63299837dcdc40dd7970c34aa0552c1a9f1a1d7f0f7dc145
SHA51296ea177ba11053c45881ef3363d501a3e725efb07542808349c05cd694303e88e8b299a138c1761ae41c541e383b504ad37363dc53ad341bb38346c76a15d5e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5afd630c2f7c8ba051f2d1a392ef1e515
SHA1363c32bfb19f1d62abe2745687904aa9d67412d9
SHA2563741eed930bbb75c7a1f1c8717c2dc72303a46b7eb225b58228d64bcd99536e0
SHA51215ee5fb3f8bada61ca4cbe919c3647ce361a0d6cdf51f310958b09910965488c6e8d74cff8f6e80ee48e8972e7901c6d22be9bd404bb775560de365e48ad3368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50e69f6c6a5c8b1fb812306a5e7905697
SHA131d97091b7ed53becec8542a588e1d1faed19947
SHA2562b99a9deb243dee472492567d5402e06f6280ff3132e4e269d268fe7eac1ce99
SHA512a2502e8039ec22cce876ec9c389a1c3f4b6a9d0393a41e00412a79281fb92ca20f1b12624cded112a342158cfec8b28829c05884cb35f1e85ed66d3292f608d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ea8297943382d15005e0651df817bc0e
SHA1161472849fbce60c6def767a98b6f019f4f15248
SHA256051f923c389da28f2537aaeccd863be3501d2a317b792e68ea79a1773ab9ff96
SHA5126f3090cb72cff4ffae28c94d4cb759fa5c09059beb8145432cf77c2c0cf6f58d846d0160734a9d66fce7ac94f07704779032a65aba5f7a94a529f969647f8d79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54b76312becab7cab07c10847a22e960d
SHA1e15ea62adca1bbbb66a2924a073111ca63f29f52
SHA256f3af6ec6ece3ee4255070bb91d6282fe6228e0c5f2aef0017f6dbe006586b4e1
SHA512f4d6c2f344368058abd5c5af709fdeb2751ea2ebd61d921e82f4492cbc5662a1f36242bdd5ee29f401ffcfda24f8d4dc32bad266efd1124629984ca180211d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD542d1d195d68da510b818fd53fe2ae295
SHA110354de4792f647681a19681fdbe38147e470ae8
SHA256db2945b7719759fd9fe7c2b4c1e447ac4658f53838252c1eac86da76a6cad665
SHA5124628af9c423783fdde451382fa4e21f79b69a6d20ac5a8d54a14bc22aee8705be59e1e627915525a10bcd2debcec76dac197f4377cf49ac4153e7fb3a1ad1968
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55ab4ed666174ff95b013cf3e2e2503a1
SHA18298237ec54e1fb4896bc9e72cfa15c98a68ce45
SHA25685f881fff558273c4c36310f1f0baef22d78dd96edf6d78837422004a50a77f8
SHA512eedc60433ea924389242781e62a5205b9dbc54ab4470ea1365c5109c39ea98150b8fe43c93c5bdb4425174b05311d6ad99ec7c3a8e0fe7617d90327cb30275ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51fae1eecb34b14de658af9882725c2ac
SHA168e44800a1063a1a59522f5434d9284bd8f1cb2d
SHA25688bedec92f98276e0d1e458d802b33c850d44dcf02d0dadc59817c0ab1092fb1
SHA51292b98bf9e1b8a270454244078eca717c7996d7e3cff39a6d41bbfe0df979b9877fc20d80501ff382fd58daaeac549d78c48c2f124b4403b93a2f91fbc15e1a62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50ebc5ecea6cc248503f0339deca5ceec
SHA13c4572ceb1c5466d314b6be709374c36f146bc3a
SHA256a8a1f835911859819d78b37d4aa6712d9cf715eee8f0efdb21abf905b5b5f07e
SHA5125f6c88a144ec8faf154f1f8b2a66fee1f8d198368cc410a95cff0fd9a8bcf01b85c9a3399af91082415e75fd7bf4a609d616bd53824820fc522b9d810f3ab98f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52bfd9e0e172587cd993d3fe80f08c1b2
SHA17ad6b6fb8183d1c4969802e3880c7b15a56efc51
SHA256786b3cd045a33d25c2b5b681760b96c758778eb597a97e4fcccd9a004d6198a3
SHA512f61b726bf3dfac17b73d183a0606ed88e19ed38bfe2359c30ea5b27a7059b350c36d20df2482380292a53a71f0f46554f71af8e27a5eb026eeb36a653d377b9f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b