Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
634197a6cc07126b4f259180f268a98d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
634197a6cc07126b4f259180f268a98d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
634197a6cc07126b4f259180f268a98d_JaffaCakes118.html
-
Size
2KB
-
MD5
634197a6cc07126b4f259180f268a98d
-
SHA1
b8cb614e604aff579803058eebed615492027ec8
-
SHA256
7027439101b53c3ddeddecb357388a08afb1995091972d8a92946d204cbfa85e
-
SHA512
351a2a8fb4d9e6e2eeb1b8c1d82fcaeb7f14ebdc8e001036ebf4e2e14bba0d8c4e323926b514d1dada0a07fe6d59e811fbb9cd37b1e34daeac7e3ae6efdeec94
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000015644a6e2427694f3ae20ccec0051faffc57a64923d7e91064a0b35ca6007fec000000000e800000000200002000000050c122ad2dc9a486c8f3300cca8ad812e46ed1cb919eff68aef391addc86b7739000000085ab8521675065133f03aa786aa8fe5297f0d7e2b907c84a0010827c0c46b0e1c8cfef490110aea1e01b9c4b8e8c23d866c36266ebd13a3255cb3343a4cb970e56af87e713836e61998bea39db3af57eb126073db896e2805997509b3d3ecd05fe8dc6f0bcda4ffbefd03a1fd37bbfe1c266ae2c2a8ec6d04f4d503ae8627b9b6bd60123331c05b669da710db4a80c2640000000dec8074b7504c7593220c9f03df8042ba107494ff7f6d22787265538de37a7f8a2b0a4fda9194fe42d00380c0ca1f14d6afaf34495338a62f3dd7a436ddf683b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403be38436dcda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94D63CF1-4829-11EF-BA91-7AF2B84EB3D8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427814758" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ffd31cc6d58e0c240bbb78e1a15c5b7e9fa541d349dc8e42653cf5981d69899d000000000e8000000002000020000000f18f17a250b485461c9f476631a45074b1ccf1892c7857eabde935220f50af65200000001ec1dba44b2cf15dcf2811fb018ba30103eb2244b7d8c0b184090cfa0012c3dc40000000a15f393e63959feeaccd702d76b1642dcf4a787463b275e6928f7273856f71d12d9d4d57d9a89c79ea05700d541d4d2e1fb00516ef8e7c67613a31c9b9acfc99 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1628 iexplore.exe 1628 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2176 1628 iexplore.exe 30 PID 1628 wrote to memory of 2176 1628 iexplore.exe 30 PID 1628 wrote to memory of 2176 1628 iexplore.exe 30 PID 1628 wrote to memory of 2176 1628 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\634197a6cc07126b4f259180f268a98d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57617fe0761102d52f34122bac1544b1f
SHA15ca864217606fb3b069d4e49a3cf50fe0508bef9
SHA2561c7e4a283613af7c7a2636cc241b736e16b69d2dc39b2d4408b79f12a8cc0a9c
SHA512d786b1c11c97bb67a0f9a967f9afc731a198e0dcb876c506db36c3c53cc989cda91ad83017f9b2f1d89dcd700acbd63d8b5a4fcfc3c95369392dcf18a33ed57f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528471920e80a6e6e675ba3c5e1da431b
SHA131e6047a6be701b8406ae99e03500537d39cea7d
SHA256b15c81bb0fccb5274244496a670aa04593caef121a0460ad04d9c7bac656a777
SHA5126a78ecdf3077a71a72af37a48928924600cbb8568522e0684d9d10c7b243f5d0df2797d6aec2c27de5490126bfb7ad726bf601814297101ea3bcf9a55d586048
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfbd74df0875ad88ed1a48e32afb411c
SHA12e8fff44e3a9736cc16848595224b5836ffe95d8
SHA2564d0bfc9dfb5828fb358b6364423d4fc62fcceed1144d64acccbbc77ccbda683a
SHA51270a6e71082f8f659d6920755a42f0ebde23f39ba3bdc10867b8122caccab7ac848b040f7c018c33f990b2c39fe0c5438b82715e6a261718d9deea99610174109
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a78395187523592050022b3b2067a5d
SHA1e86fb4e43ac6631f9632d72f56c540d15c6b5c15
SHA256e4cea7bbf40ccf5e428f153c47650a95c1c0865fc2a418a5f4a50ed0d65d91c3
SHA51219746d201526c7665a3770d97b0a7a9cfe3305903948c46a2fc32ca7ee4e7c06bf06bcc09eacf1609a2ceeabb25dd92c2eca98da07279e9aa890655fce831ea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b56c078f4f4a6e668b3833c07ccdac1
SHA1217715a6e36eccdd0bca7ab6b28b568b8bfbef93
SHA2564eca016755e1e76d9bba8132fd01e98769b9b4d77a9aa780f698d07d3b2e0da9
SHA5126ad54d71258db29fd45c4dc97c3560bfa02ef76a1c96bd4254af43dcf773a53c9da17a7e7b4c8353cb38313ea4bbe328ebc7d162fc8efd2d41fdc9e0f5e1ca7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7a5258ba37e51c386b2d6ba82e3776d
SHA127373f75686cc8c64a515887ba86802e96a2ec30
SHA25679aaf785dfc04c1bb8a7307643ca5d0ecfca9062287ec47432e18f62b9def67d
SHA512111e93f8adc1c6ac8388f67405084cece77de1713befd251548efa360daa79a178431ff333ef8da3de0eb70f31a992e1d6073bc7c4f0b4794c1d64daf73f5ca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c55e1aec13d5a3254f4c7b01ca0a8485
SHA19aaac9eca132699ac50eb3d4a7ac30aa24a36052
SHA256f9eca76defe72ad82b2a9c6f1b3a4973791f9aa994ecc012fd21e96e13e157b1
SHA512ddbfbf346ebede031bc27dd25a2a3126e5569c8e9ed27abb06f9606f28d0cd69008642156541c55dcd46cff64461d75bab347be17e79477cba1a6a66fa2b02c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e71f0266834345c43942d16d4b2e105
SHA1b8a2d979d234776d64a379c14048ba294b5141ed
SHA256d1df3a6dcd8debdc3eab50b3afd073a39adf8622ba2f8f0e119ca1451d01232b
SHA5127406a59af21f4dee912fcb6274357cf29591364b04acee814ab96e587f82823c1bb79609bb59e96ff022699af41aa8d9a951a2dd222c6d8f0baf46d7c799ae1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c624dde84d36996f8a6aa2c434c581f9
SHA14d0fad9e59db064bee8043ce04550203862407c2
SHA256a80ca7e3fa5bdfc3195a840f182500f3bd1407cc5e7cca8089eb22eec20faebd
SHA5125d5769c2b288d7d782aeff7645f78388c9d59022fbb56e3c0ce535465de3dbdbb4982c86370edd2df921bbbb9e6e59234f923448f171d3187cdc536185673e81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b275b4556c7de86c4c6c7d8775b19ca
SHA1ab65d4d8dc44772caa8e5407e2cbd26f881cd6d0
SHA256ed814d5a7d50d5211b9a5feaeef2db313e1aec8bc3b79f471c28dc0f36663486
SHA512855ce977ca687e4b5e93542eec1daad9a0b47b32940049ea88a3437cccfbdc54c21989eb92d3132050ba1cccf03723020078dffd1b4d8a80803c402979f5e13d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5319d890b7481bbecfa0ab4536e4db46f
SHA12f24c2321dd70f8dd187b647d7620739dfebd6e9
SHA2563df389171cde7cdc7713cd3c6958b9742c600165412d363fad7a7a1c5407fe01
SHA512da073a691e7952bf546c1c1b19aba74f62348c1940b2b5966842d27aaf83aa8e38bdf52338619f7414e3fa1b76131e83777d47d737995f31a3da10abbd6a0131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0d1ab597bb0432c2c08642927723ad4
SHA1a62376115c8d6dc6324e7644704b31528feafbd5
SHA25680fb527d17b6b4d3e0991d3aa5f9ce045d2769106346fdd1739b2e608a82aba7
SHA51201b3465fd3fc79fa63d5b190b05605a098f15dc1ef0285b4a1eafeb81153b2a154bb75c0d13a395f552c798909b7239fe967c5a791fc5a1815d85c4cf12418b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aeea7832ef9207f81d17eadcaa395b66
SHA1edf1191a014696c5a9052461cbebfef23085dce1
SHA256564e0e548b5148d1d47d26d0b0cea8858029a9ccbc8997a03200342695793506
SHA51209679b92cd50492000e5531514a6c2e9c6147cccfa26cd4ebdf21e76c8e4a69d1d3dd5757f91fefe40ba1c1710a69f52ed97d5ce3acd4c1d3db645b97403e851
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50174148ee23bb485eea6a8aa3c1e5f71
SHA193022e3d87dd69a43ba01d0b45a492d26e7bae43
SHA2566eb76ac1318101f6a6ff79fb02781f7b04a38b2c083da39e692bf8813ccacbdf
SHA512e5f7fdbeed018f90e569099d153690ba3fb465315e67a0993482f4ed9f70decd53ab7ae9e690a6fdc591e44180fc70a60c43fe847c8bec893839452b1b4bf668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e313c85ec3a317a2ce0c55cd17d7defb
SHA1331874040988bfc5bbdf65e22006d9efb2f1aa3a
SHA25654e859c5232c10a3b1a2649740bc9c43f1635f87d38ee4124c69d66f58156181
SHA51269a6dff33d9520d20ce81834163780afe3ad77c33a50988312c3f573c2b5d3dfbf4fda2c3497cda3c38cef71fd55b59b70d9777e4cda9ff282d70c89b9cadbfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f514b5f4592af08bec87780d8a7e0df
SHA17f2ad15d0e6e83651eb2596f530db76499e31f14
SHA2567b92d83c38668998b938773736e855c6ebafd504933b7419f660bfb054e85c9c
SHA512f0b9418aa66759d0265b533b86fcdfb879d3996838f9d79d5a9d9a70333f5a518281591af0391106e0131fda5c303e1c425e47712f655f312fa6761ee19b5735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b79c7ac1c212e581281f58cba3b08552
SHA156b032d971df62c9b5ee7ea45e5a2a36f77118a6
SHA2561350faae87e26d7d901ed390fb116e16adeb9734512096060de53753a9959f72
SHA512756de61f9dbea5b006a3d78968a743183cbfad8edad48bfe6720da4e24ecbef2b303970b29fd8404de7251f83e5a6c963caa045f11e945ce6c1d9f29e3f2350f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581895116ff6a0c0134c9434fbbf49344
SHA1d1aed5b19c9759241b7f0493458567bb810111e5
SHA256f2eeb267e12f0659d8682b155c02701319be29c2f88de904596cad2edb1a6f92
SHA512eb280eac54eeae412415b9b8b66f1dc8000627760bf5982ee691fcfcb886660a1e8a316dc6468808216d4a090e9133953fd399ca4e9092054a226b5f572367b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abbe746c8690260ceb6074c93d022396
SHA133976c12cbf2167f5b3e6acca3f23df8e9114db9
SHA25680bb83dc95a4affdbacdac8733ac11f192e51d289d03e27b989c22459906154c
SHA5128a7d0a4488849c344eb25cc4da90a867023e4c99c88b70b4c8d5f04dd83a469d291c715e9fa9a04c06f1dfb6ce806a6596b43f79480f8cf1d4adefc5bbe8d0fa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b