Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
645b9baebdaa46159edc6963997147b9_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
645b9baebdaa46159edc6963997147b9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
645b9baebdaa46159edc6963997147b9_JaffaCakes118.html
-
Size
6KB
-
MD5
645b9baebdaa46159edc6963997147b9
-
SHA1
26bf0cc71885bbc899c6ab5b9c5692b2eeaa24d5
-
SHA256
49bdcfd4d0b458e4468c8c30d7d992aa59a7b2620114ddb343011e7827a5c8e3
-
SHA512
ca0f99735d78981cc3f537c6503b25dabf01fc376a94a1e604de7b53cdb557a6c550422a8351fd9d27741ce2be3c3a4bbfabfc1ebf86231555bec122ba681b27
-
SSDEEP
96:uzVs+ux7aNLLY1k9o84d12ef7CSTUeZcEZ7ru7f:csz7aNAYS/lb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ffe15c6adcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427837066" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{863FE721-485D-11EF-B4D0-D238DC34531D} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000006995f9f93682e4f34a8833b12cffe79c4154b02275e253a3f3f589ec83f20778000000000e80000000020000200000008323bac71c20a402e2e5a1123e931ddf048017465b4fa68cfb39d64b0c294d2090000000ea3d682966e90e5329ab95a4c79bc525532c373427518a3adf9ddc1b763fec5179767ee09368f18d2699d0990032e310f1f98caedfb6c2ccfcf449b1f5188099503332ee065d54b60257ea9408fda754a84470f88bb21fed22b1da7ed86d32cb9b979234d982ebd8e0bb649d83b806e5ae3a16235d000a4b346a500b0a20b5a36a359d017f2f82b95bcd593ef0a39e8540000000f68530842deedbbe8af0b3d700a7ef4428d749b34c68bcc99df4405e1d59c53b1c4815668954b69af9b7186a5ecdc35e96ba64407cfcdb7b830e30c61127e2dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000cc3036f31c4a2448c6f170c2b66c1cf85149e8145ccdc3a916c25eee16b185be000000000e80000000020000200000006963dda3b93a8a5898b9ea80fc6f4e85a923b0dc281410696217da0021e4e23e20000000f20b295533b1d3a0052556cf5e2e6207e41e27a39804e1b7c6f0211af3ee9079400000009f320904911cbc7a1861e9531f5971f04b29fb82bdceb656473558d04f523683cecc7044486b579614319d0093b11d6d257c23b73affd1d676bf73671d94aa5e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2080 2116 iexplore.exe 31 PID 2116 wrote to memory of 2080 2116 iexplore.exe 31 PID 2116 wrote to memory of 2080 2116 iexplore.exe 31 PID 2116 wrote to memory of 2080 2116 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\645b9baebdaa46159edc6963997147b9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee6bf8c0a51452d5376bd6d6ff06ce77
SHA1f6fdd3b688cb24c38dda7843856ac5bbea38d24a
SHA25641c30538ddb5b48d978fb9b092c8058f9a9cf500008444191ea434e20b6c32d4
SHA5124306278d25329c207a233a4887a4bb8f84dde8b4c87c2e21eb67b34e4cf2025c2be8a2b2a1bedb14cdd2bf8ef88ccf0aefb123951a71ab837e6242ac677a58b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5099d68868edb5756ee5059693c2112ad
SHA10e202afa44a2e796d1d77bc34706e96167e70837
SHA256b2d3f59328c89ccdc5c23660004313bd996d15c52eb9c9ba4fec58dc74a9abbe
SHA512f22231479facdbf64229e4da4e8e207432e2719aaa88d4ccafb2feda042f28950817bf94acec6966a738492ce1973d4a5e82e9bd11569972413f9f464e9112c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0580398ff55e3a5335d4aae24c80ff5
SHA1106a43fd79387d7fe45100e50ab9a7caf163059e
SHA2567959de24bc297b06f9ccefce318f457427e401326e53648e49d29b26788624f2
SHA5127c7f7dd8dc06d09d40059a539051616705f8cdf319cb8f5c5bedbf170cc7b7f5e3f24d16b3b6ff34298feba3552c6fc790a53025fbd94e6a5300590fbfd8bac5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b5a472898433f1b4a5462d9542ed35d
SHA1129d29b3feadace569e001f2ec077ca6b33c4155
SHA256dfbd5541b808df7f7cdd0f09f83e125915a38f5cd5fa61c3e30986e208943e32
SHA51235c9bb480ab590294043deacc89e3ffd36e46a5fc606e069be70e55354595aee4ef35b9d65f4520935296ed0791cd66cbec638941c9dea3001667c99ac982544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52546c6c3bfdb7465b9f51eda0a11baef
SHA1cd835021f80db0c3570b2d95db425d3db2cd9b47
SHA256f90c90ef5f1f5ed6dbfdc36227a34c3cb10152ae02b16fd96e34623f7df023d5
SHA512dffde578332106df03387060989b0da5a7ebf87b3bfa918235e135a1d34b2d868689c717c3a256070da834c104de5ea5a15bd0792fb96f88b2e83e6f06c8b250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e58fc869d732784a8d16f4692a25116b
SHA15dea8b7a9e0ebbe03a20c2b4fff2c2e77d8d3362
SHA2563e52e2a29119970f1e5b5f2c43785bef1d99dc8f6da92fc41ce408dd9f2ce280
SHA5129fd6d1eb8663d630af65e0255b24511420c6e2c683f4805b3409501ec41786db34071995aa32c6368435a3a103b23a75e851bb17a8d4986d0907e90e0605fa9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5caa5f526849915f3dae1394f3ece544b
SHA188dbbd2575fff3a3d9797d15befe5a6090e1e556
SHA256055506acb8ccd6c2a4d33b5bbe3eaedf4c1a2e421263bccf4b07aef7cdd93efc
SHA51226da06b8895d77f25d7c2a846774929df10f3ec0a0bd03a1c3140b8c7b27258745b8725c3538e3a60850c4101f280c52e21b1978b378d6ec60a560fa0facf206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51649ec2a121cbd3760584a6762bf922e
SHA1f81d412d6e4a6a85a2a7c0bce9c00ee7669aac12
SHA2565a98b2dbc6487cc32e590ecf737f9838bb6147ad28c3dc9806e4b8f244aa6ebc
SHA51276e884c2fdfbf23310a0b5f383db6d74adc78ea4f7a7750659bcb8700425d897eb30afbd924eee727f541559d87efb245f47c698795952f4adb3b85ef65f41bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e7bd789214ce8a4dc50d1566909aebf
SHA18657863044b0edb31e8bc161e2de400c10500002
SHA256165039b23b93d89f83de30c67ee98bb4f308e236d1048b73dc6fbd7bf5710d20
SHA5124f421fad32f2e9e5fe9e2020226efd0ad9da9063c8fc49438ea4324cd135b1d7355e5c5333f28e9ebf310796becc9bd604987b044eb5286cd0c3c64c100bd339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b62a485b2d53b9940eeb8c5a0aa2b9d
SHA10296fd47d4a06414bfb5e9bf020c0b21e3ff91b1
SHA2564b75192f3c6eec40cf5153e0f326fc3f2d4138c8e88795eb1307340af0e4b3e6
SHA512813cc52a2c9f1fd7e10da25dc4dfd55e09979fe246057a75968b6cea84ed16cdd7a114516dc3c279b2dc0bf545a27734f6732afd26a085479074272ef9001be1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eaa185d87005d14ae97fd06e1848122
SHA11c6bc1666c2ca19fc47866547a4dd00187ded643
SHA2565e11b917642bc2cf4f16dc8bcd9932c83b0286aed6217d2bf21b3bf879a03e18
SHA51256e5a10226dc7b0bde616f2faab707d34e6e2f50c3c17c86f3606a226697ae99ee9f22bc7138e01db740357bda3948011ccebe4f0e5d6cc512030250633ec7a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5c1909b8911a0bbdd6850d681c10524
SHA1e2f764e53e5c5ce24a0c4d12b7c9be78ec2f93cb
SHA2567012f1acc2427fd34a8a8e8fa518f28564d258e195d9a3b2318cdeeebfd12c5e
SHA512b07b08ec2ca7e5137071468e0fb7cde50091d91d8f6f67cc525431fdcf8aedba14a5cf5da0ab33aafb1533fe6031d5c3eaed7660c9cf84169dd826fc3d61e85d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be903c56319d37d20985e1cd2bafe20d
SHA12458beb556476586feeee2f65bfb33b33f77d88a
SHA25662cd3172b1e7c926f35070cbf05914f7da8b43bf5af824560fc538d5a14887eb
SHA512634d50ac14261206c6e72bcada5c1908a1861d37c6a448109c063c3ae2e6a59aa99ad52a99df60f7b85e4aecf41377e69aaa5d2b6d922692a9efa0f2726123ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5658ddca11ebfa51feba4bbd469f0ca82
SHA1036f0fd1a158bc1e9d33b7707958dabe6f85ba30
SHA256296dd008aaf233ac91cb62595e5e36835379bc601ca2da981168821b0548d319
SHA51201355eb415895c87e8f5f746136be8f1ce26d2214e1f67186b0d15ac117a17f909191dddcd5a6fc21cc883b5d29779439a15af15f4169dcbd9f1f277a73f5762
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e76a35c33b8ac5320c10d2b6b08e3b6
SHA1bd6f8588a2331d19e750bc9d8a7bb5fa94057501
SHA256b4916b07c302d7be0f7bf4682b37188e189008df2759c89cc3f999b4a12e2015
SHA512253c6403f1461ad155b83d45c901d5854f38e4e98b247a78f6b4bdf9e0f8d7506a6c616e0157f2dbd41c1011cc9f44364416ab0f4bc5ad83fac4fb66a1e55714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8f04acb00779fe759c694cc582c6333
SHA1a9e82928ea3ebf5385d00004825468ff7985fd33
SHA256a30ecc64b21c438edba430e8fb7e238deea3c8fe6f482b777e67e082d8e77cbd
SHA512d17b251fe98b0f6e817714ff63bb57dda82d718776876c41894ae74f513e7e5b4e0719b31cd70127b420d25cfa1b68a7dbfd960438555905f850a4173e9f344e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb88ea6495d2b15872272f445ac6fa53
SHA1616491fca9eb6c1b59a611707f6a9bb13eb8c7a7
SHA256e4630bf5da757827bb2ec9a4bbe8c0109b3ff2bf37329d6de24cc314e08c1b24
SHA512dac84acfac0a6d0bf269e4abd65e2f753413d84d1c546f426081750262db32507d3efc3088259d354fc4168a790cbdfd87d9112bdf55a6e108acc30d2fa9b66c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589bb01f04884b6353ce44b17558f4c86
SHA1961601223e2f69d7fbf08f29eb24b949d0811969
SHA256d7e6d6e9dac853cc4b9706b554345f3fa8a375c8e51edf6c0c12b0b6b5f9f139
SHA5122137cc2a9a9b591bb47d2c0100366400b447391862c6b4bf9b489cfe5dd0dfd01cd245bc4cf8c5597530f8fabe42acc83855d5b20f3e94b87910ca0b7cf31087
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b