Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
667652de9cd82b800ecff9cf5c36095f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
667652de9cd82b800ecff9cf5c36095f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
667652de9cd82b800ecff9cf5c36095f_JaffaCakes118.html
-
Size
504B
-
MD5
667652de9cd82b800ecff9cf5c36095f
-
SHA1
a22622d6c79147b752bb4192d5e4b95f0c7546b0
-
SHA256
8faa33ba9495cff3331ceb2ec1170d716c1172f19e70ae557219c1888f64f436
-
SHA512
0da983c8923e2fe86773f33ea340473beb5b3e78aa10c6179ed0a6e40c748caebb7679f69bc4d6f64c1b93373541c98bdce6d215dfb9c1bb6a5a84e9944e600c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000006a140cf77c25a700beb78df7ca3b10c8e5afb148434ed6896d851357e24a272000000000e8000000002000020000000cfd203eb25d9c476d5079d1a2fcfb02c8af15bd76bcee7409e650639ca6d7c9f2000000024569a62e4c1303ae9c4af01eafaf2211d7d99f94b281eaa6e6d324069a80cac400000004ff2e9c3cdb8ce1a33c1d1ea2db2a979df980c87ccc44747481d4f01ee5a96f7915aaaa109e84ca7b9ff973faf91b4f4e76e40c62203a228128fff5bb61f93fd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20F50D81-48C3-11EF-B39C-C278C12D1CB0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a626f6cfdcda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000002e5cfab6d481c4064a478591e13787016665c0a868ba1adba7418360f6b7c457000000000e80000000020000200000002aea2f83e9de348be04f8ca4c552a5727593c03b21ab4924792012eb2ac2064b9000000045d1ce91659db845b3a2b7621f1e682172a6694a2c8598c4ec5aa7c3454f436f5f45049d74d865eb74d0950b59a19d03fdfee95b5eef446142a0e66b27327c25a68ba900a0d6cf2ef95d876451510e525fbf4fcee9afaff5af8dcd0d5fc8e6d516e2f960fd9e897557c370b6c030c7e22aeb1fdf68fd4439339ebefec1b7f574079e3a0c2ed7c9f1c01b67f792cea82f400000002b0b517ece5536d6c7c6b3b7215db76c98220def72b7eef7daad7c21a8e0056404c141a2371ba8f5b598c3f522003a45e0af0e0405ddcb478f254e4fd0805be6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427880707" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2904 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2904 iexplore.exe 2904 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2712 2904 iexplore.exe 29 PID 2904 wrote to memory of 2712 2904 iexplore.exe 29 PID 2904 wrote to memory of 2712 2904 iexplore.exe 29 PID 2904 wrote to memory of 2712 2904 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\667652de9cd82b800ecff9cf5c36095f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff5d937d34fe201b674e7e0aeb95ddf9
SHA1940971bc786701dc10b9d6eeedf63dcb2e589b9e
SHA256257b659b7f82d4b9269617941ba64ba3ab57c180f6d06a22c4c55dc322844323
SHA51249ee9086eb817822c5ad6fadeeab2d6d58b1ba8913118db3401292e06743d88f18877f06d0c75988dc18dcd81e421450ed2203bc77bc7d5b8cc6bd0c48d04f69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58131a7dc600aa19e6a70c9df83184bb7
SHA1f777de77139be4d7d35684f940b2e3bc984f7a0f
SHA25619986e39ba44c3a1e1b0ab705bebd0a690a701bc373c6317c1c2a42d36d55cb8
SHA512a0fd3d776e93374594086eccabba34a56e64fb2e15f4e21ac793cc0dd31ad140bb38856162ad590f86cdc56b59ee78035d257fe0720e35f560221cd9c5afa299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52199e3d19948b526960e4c0d69e47515
SHA14fb2faa188dfdf151ee4af73e3de149e06e3f254
SHA256abd919cc8de68c3a47920f0ca0446caa084395905f397e1ea368f5b488d575e6
SHA512eef96a7417400b08eeb95cd06f6e9252495ca42aec0230dc74e0fa0fef4ef97c94e57941fb7634fea405d1168031f6fda5cfcc0ebb676a29b84cf68ab59b5ae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5878e1ba03c0a037f7e45b7104b33aafd
SHA1df1d9957d220e3a5080601539772682d56b3320e
SHA25616433d47f91f096d7f6711564648001a8e6f5f0ec09ca373a532dc797aea1580
SHA51250f91213e8fb4e4e81efa7f81ab26d4ae353c071b47beb7c61613ac72a7b4c8844e60b4b3054c63bd988443f7d200597901469c0390390350ec5dc38e92cf8eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516db0bc493972fc693464481a3ed0ef8
SHA1c6fc5f8f8b90b1d6f08104929582420327f9145b
SHA256a50776d112acd13daa44e43c1eca7c21ce4aa768c9d33f0af90457ca867f2082
SHA5125eb5ff357b7caa35531d95855bfb0cdad25fa2a908b1b20bae012295a267ef737787424c3b8b1ce8858fcc05bee5de38db5fd683ac77528dbce5ff4a77d721c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53be461a79ea62dbd4c24b3a846ff1aef
SHA1c351682a66081e5d8ec37a9fc18aa6f2d7c6521b
SHA256ad88fc25f132f87bec1a2ed5ae4d78c4a837a5656a83b3c63adab49723cabe9e
SHA512d3d42e0e10feb8de951ef0ff86be984b6211b9a739fd26ab1da8416e828dd8e1552c6ec57acad7a3daf9e9ac9d3fcda3b34b01efaadea15248761af5df9d4f11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ff97e8dfa17488cb8139a981d166113
SHA1948eb1504f28f66fe97d8b9265972917638fcdf4
SHA25601b2125526987509d0171d1c0068c893ea3ae9695459c66d36a7a0d370e64185
SHA512e46c085f7a06fba8ce6685b195eee31ec877f4ac150a8d2c99922cde8dc83dc9fddd6ed8d5b0f12722693aa49f49eecebb8f2f600514252cc74cc6ebc3646560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ae8c61fa2e228db7adc11ff458eeab8
SHA112a1dddbff15c2d23fc2cdd65bd9b5e851dcdbd4
SHA25605d5da09713e2b4f524540e923883826bd04d2abccb90b8e59fb50e663860e8f
SHA512983eb951bb9395ce2b8c2daf099e473d8844dbca0954107e6f87feefd0fc9738405b4397e158da6d698180ca4d6fd05932383464cdbd47be7ef426025a0cdd5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad5fdd1a0fcf5633d789833b8eca799c
SHA14ce27ff9c9eaa3ad9424eefb3f788603505a7848
SHA256be89640b995fa55465cff1501d10a88d5b1b4c8e95d768269c4a7889f027ce52
SHA5125aff08e1ee7a1a9c3e3496c4f42304c2baf21be74e47c9cd426d519fd4876ba1fb06867c8f01aba26c7d7dbb96b54040d12b7832a848907459370747a92372ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c9ee2696eab0d66f668869772f5dc4d
SHA169db18afc00b0eb40ce5fe633663318e4130526a
SHA256cbecdea79337d3e4af6410f26356030b87bf9307e516c365e97a3366eb680d4b
SHA5124851299bf21f7d901ae12549687e603fa3af300c2cd9ae261aa339e7ef8576c8fef7479ad09ab900311d677311e52f62d49906cd2bbf0c65038dbf6b42501ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525be17006d21982a2e4955718c50faf3
SHA19f7c10723539c93d2d9941746fb35c8c366c70b7
SHA256f8271ec9e6d301dd0e338a99c8111125e05d8cb20810fccb7d71b59cff3f2080
SHA512048eeb1549afabfea057fb331edc0fac0fd0d6a42f05cc1dd6052da9580a4b4939152326dc7437b0ead447cb5305b9ae14131170747b96200316e0e255dac4fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9c325edccc29ed0ec262d5a8093d44d
SHA12536b198caa93019387c05f3b0874ea56dea24da
SHA2568b28870910b7d65618dda291cf658edae8cc68b57c2030f588ae55e10ef34768
SHA51220256818b637477cdcf2b5ced8c2bb08d703291bba747bee4d4ed097d3e12bc5c4ba7e3dde157e901a510c50bf5d209a16b780f4738a09e7ab9cb68e0cd30f7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588e0c4b2afb5c45c9b86a393935f9ea2
SHA199ae60260d8a95f34fed0a48c43caa6afbe6fc5a
SHA2561b7c8f6cb3d8e905a1a003684da50a3d28c897cb24ca740a52fce748d8c6df2c
SHA5127aac69fcd37055b27cfd4221b776b9436ab3a42fcad64fb74eb4a42c81ba0cab52d02b43bb6cd55b06bc14646480548b4cb730fb6e3637775fae6ac2af24c07b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588993a3aeaded244d921975c459aca2f
SHA123dee2fc3a38274cf371068530273a0cbca811aa
SHA2561840fa17c1893e15880d3ea7f7f47a1cf2e44164e33eae9a29d9fdff4287d043
SHA512f6311007ca78ff8cb4fa8df8b31465ca39138ad56bc70715131eca71962183f4af23e894a12f1c18d7c1479f0a2a10fbb57ec5438d607e09edcd643ce7508947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51447efc2179a1ab05723232872bf7b2e
SHA1dcee5500e68ec40d8606fe6fe1460c97ed8f6858
SHA256623854231b5987901a7854fcfe186ef5ad0b2664d052e107636351964803976d
SHA512c70a45092ec2d45af93a8f09cc03a5b407bb204fca317c90548be0e684fd3749dbea49f66601f33c9a39069ff541e4653eaf603ae1d9cd50fecadf52461e8c6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d0905d4ff48204a41167ffd9dc3519d
SHA1dab2501d5e8fe50d4f7b1957ac005ba9c34b5f0f
SHA256d8c1e844524eec856eecd58b40a7eb26220dbcc88333f31e9bec652dcf516af7
SHA51218574d1616d7b76a4bee59960cf703305995b103f7318c4d75bf83d527262e9b16b4f7be4d75f8c7ff1da48d334cbfa36550ea249d312f944478dbf52f74918e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb2439c917c4474125b550c32e4472a3
SHA175e55f7a312fb852acab1be657c97cb62bba8f4c
SHA256a050c7a72983a65c98b78628e3b6bdd808fa6597e8e30810e537b05b2ae8ddc8
SHA51253d8faf2365d03e6fe1576d84c0b1e013a03fa29a70888007151c8fe93ee23924e811df451b1ac597c84d186fce369308785519250d3bc85026fe110d0151288
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d517bb9cc21daab62a65471e199941ac
SHA13cf432a11f330a799550fb2a89019f37afddbc4b
SHA25695ab181474be23a57cb3495d929b3f5871525d53b3ec4e77c209858122585eaf
SHA512be97771a0f0f93884ecfb71b36f449cb492847d576664b0da529fd15f8e5932de1c2531c75c3a9de56861d4f981854f73ed5af11bfeb5adb50fcaa476b03149c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac813c614f341057cc5957e4dfabc17e
SHA1939199ba324ce12bb577a34e296fba175ae8447d
SHA256b060e7490e79ea295d8db88672ebcaaeec4fedc77793ba4338151dbf7e8c9cc9
SHA512304c9ab468de89fcb1c00a1af2dad140d76fa37c52ee421a937a232e98f933735e020796546218a41a8a31c0398a3e6d2b90307dc5e35331c51133f7dc07456f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b