Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
320f869c46059eb797faf4223ab8d3d6_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
320f869c46059eb797faf4223ab8d3d6_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
320f869c46059eb797faf4223ab8d3d6_JaffaCakes118.html
-
Size
999B
-
MD5
320f869c46059eb797faf4223ab8d3d6
-
SHA1
5011ba287b31d7908439277e7027606f9a5a709a
-
SHA256
c977c28d66f779204392f7aba0559100fc99a272522a9989b5a274c08389bb94
-
SHA512
ed88c473b3a8bfa9d4bd39918ba4fab91a71a9986366e2a206c3c6205c05d34a8143522e7e532422453c2fc3b71f57aa04bf5c1b9d473b203ca6561a1ae81ccc
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507a4e9743a3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2D13D71-0F36-11EF-ACD5-4635F953E0C8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000007c52c10037bcff39c96aba07c393c31d7d809ac5e0aa06314d5f9a6518cb7b68000000000e8000000002000020000000c33c7015c630dbe4366a611a04dc80e019675fda920fd8f366490a2e7e1460a620000000732e737506f5983ffd2419ab161deede57563b84c08f53ae4ce9e7b3a3c7ab8c40000000dabbe2a80ecfdfdf96a7fd3e097f6798e6495208712d9a829ece7196289f611b87acdcdc997f6b9f6f5dbd04277cdd1956408f15c60c3aa6d94fb416910c6f47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000712c2222368591869a7c5bb55858b71f92fb2ad33883ec736f84d193f2b3182f000000000e8000000002000020000000b22bc5ac77cda9bdb95f2afb51e3f1941bfa2c45204d89d12b32215dffe5e994900000007002fd32b1b85b7dfadfd27693b71d177e35d300e17882278251c58b4a0b05317d508b9c4503969732d9be4afc006b4252feece95465955c2dfb055e8f753314c5446a5a450452b49cb19845dd5dcd26a69d8ae8dd9f7c18b41527974db39c28e0ce18305db64f0358b579217d3e55e9ed92f6ef509f7faa2b075473413499e943d5ce0479d688fdfb76a0b5a9891af04000000087fe4b83456ed00ad7758cd51b52c79dae9c6a65587f520df4377996acde1392df893b3dcb9d3b6eff841754e09b9b29376157727d94cbfea2251730efe5318a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421553201" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1720 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1720 iexplore.exe 1720 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2936 1720 iexplore.exe 29 PID 1720 wrote to memory of 2936 1720 iexplore.exe 29 PID 1720 wrote to memory of 2936 1720 iexplore.exe 29 PID 1720 wrote to memory of 2936 1720 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\320f869c46059eb797faf4223ab8d3d6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575db486e1fce87567b83b50cc1541718
SHA14a629f2068f99c0e7dae8cca3331155f9ef4e3bb
SHA256f4f237d2dabdc378e927c9257fec560bace298b9318cbce4773b2c1a88819a46
SHA5126493e40b10d99d080f75b2ea3c663eca690d8a82d599019aa896038ce9c0da5564e85d29169ed7adee16e0ad53d737a7dd545eae358aecbb8b7da6a71297bbb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8f0aee26dfca631f19a35fad407f7dd
SHA119454fe789b3e94b4e61fa1346d4dcf32506da36
SHA256714ba9a75d4b6f7ae058a4c16335707cab9800f1e3c5dd35522ecb9291b3c20b
SHA512ddf541dbf02e241f9f7a9b4560e4a07264b8bdceb4c0cb78475c66ec4d48585cbd3a282d76fbecd927acce2949e765e78870cdee4842eaf23e4ff7d9bf03d976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ba2ab4f8f40341e18f7f009bbb30598
SHA1b0a21b764a1fe1c515cc97182e89a2a4d7897e2c
SHA256df62b445912e583722419b0444efa6868ea0baf2673d8a130004775d797faa9f
SHA512d232123aaf0a8622e2353740ef7ff13a50ea3d3c0002e140b3b9d621942f4cad6126e79fd254a83fd85bc19fd3e31523ea5687f3b939fc5fecbd9252dc6f4d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a54d7fa5cf018d9af988181ba70c0d64
SHA1273f599a57bf97796fc42935691cf3f7a0e65172
SHA2568224f7e1c99ae07f44e2f6b17572fb4f9ab6a585dd692f27544c0d0a6e1eea74
SHA5124e31a5b0a7b3120b025e4015acfdbed9c0c2b65990a1a844f8a67abd3858e9f8cb9749a34eeb4b53ecb3357b30e7fd11fa9646f1f222d38189d2de3e4c0cd83a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a2d3dae9bf0eead9b0773a74c84b498
SHA12faeab4d3902bf4996052c98ff55b069f2805c71
SHA2564196d594eab18ee7612a5686d866537aae3ceb95a1c1a3b3deaf1bdcfea7ca21
SHA512916c19704d9260f86c878bb1f408c83a4de33ca2ea0df33ea2c7463af23e6b55765f6630df10df94808946185e419454bf035abffc31b2d494f3d3d5186c2ac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5630d3fa53297d5335e6618902b0d26ea
SHA12444ed5c3f1d937aebf60c8ff5a8ae271dc1c0ab
SHA256aebfc072579e538240ea7e402d74fe59692d0725033651ebf5703520277c0616
SHA512010f85cde15b1f8f1eaf93e96c4b5a23abcf017054e919621e64f7b0009f1fff3e72014df97ebac70aaa38e47d1320459f902253d64c2195b78cb71d545ee266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532542a6065426d46a159a2d113aa4fc8
SHA19d4257387da48c261d2a663f6f407c80aa22c5de
SHA2564d01f77e4ec0e8e773c433569352c5f4c657cafb52dc6b846a279cd32f65355e
SHA512a9cb6b9cfc1e077f0aa442d3f33e2e93cce71eb5738a7342ebf411c0a356d38d3204c92962d44571e972a648c33c1bf60a3fd2d156ab93db13be5672edfcea24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2b4df4695e713df994af50dc4d11dfb
SHA188eb4befd9ba548a530422af51b5e3bcd0bccffc
SHA25600169f2ab18fff4e45dc4e4872197dbc97220eb4fc2876562d82c386c1909ab6
SHA512ecdc980ccc044d488fe59f88f80285a6da2a94df070a88accd36b2ef2e1cbdd5e807d19eb074179730a8275d437a15b3fc9ea5c588917c2d423f5be10288d608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d2d2415ed7c377ea76d5590954c93b8
SHA1f678ffb042e62ff46e622bd7d65b9da780df0d9c
SHA256b3e3890f05ecc8dac8c547852f495511e28d007b860c041ac1efd85dcfb23416
SHA512750f5b09a0cc7a181c53bab061e40d5491ed16c5b581c7a8d93cc01ffdb8193825d41b229bfcbc623002300554f0b47cd2c1eff5049f59026ac22cc096fca764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8944b5ac55aa62c245abf92718da9b8
SHA108ebe690ef438301d667254b7ba0d8c3388e9da9
SHA2565d62792293ce3a69180af48d2e208bb03967501819af9405fd1536945ce65cc5
SHA512653bc7b2f99f1d682b246d1b5d5b6fe931a3577fba87de1043dbdef72fcd75145fb1247fcbfbe304ee353d8bf5e5962caae6a0cc409161c808735cdd8e691344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5940569e9f1ede75c471d13b375827bc2
SHA1dd547ea7cd1ec12b4b7a9a20310ebcbda4afc22d
SHA25618a416b525c27f9ddd27a3f04f1b5462944d16404cc9a986501efc96d21f65e6
SHA5125ddfb01446328ee11b84361064fff51b4c590c435e536d6882d09a416d2c405f0d3a1d2a9031718e085c9bf92839ac9999aeea29d4eb0463ee044b8b51786019
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5370400ca098b5eb753e2720211f12f0e
SHA18246c3bd3dd2817f2c6ab95c0190161d630c6813
SHA2569612ab31e4cb5c613946b7e485b54292a78905bfa5e09e870c6647d635e4e4b4
SHA512e101ce4a1b0339f94e69c5294011139bc5501875171c0f233e9eff524e810669c53f85db985d1c57ccf560808eb2d6fa71cd3e2a984c16cbd1a11f1bc6fc9c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac0bc60e78eaec3b38dd3b27e6959af9
SHA101dbdfbbe62add0d050f0985d50f0ed2488bd8f5
SHA25643db20c9d260c752928b6846fb938e7256dfc1bacd45eb1b9401536cbd2b6a4d
SHA5126963a9f7117e4b1c3423c78255447046bb0f68fa42bcbe04576b6ebad3d5f65559241d59b4e0af692c17b61c21e31615be341fc09cf3362ca41441fdf1c18f4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcc1769b2fa3d23b8ec496ecf4326141
SHA11112e16a2a49dde5ebf91d76ad8cd76375d0b3e1
SHA256089b308c4ec6e9d7ef198f40e49af2aae6ff7befe2874c5acbd6b56ae58835e2
SHA5129d42bf8dd8eee249957453e84b1706287edec0d5c1551c6240dbe926fefa7e80f5a713295b55c8f4b30c8d227949e94a709bc3517f501cd2dab2d81279b12d97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dd2a2a3ac868764328457a02b72e918
SHA113149e0b095bb01665c8b94b97932c6aa4c9b378
SHA2567af54a24a0a09a66335c0012abf71991729589e2dd7170fda3a59ed1569f0320
SHA512f84bbb1f91edd31b621b47ad64993e9e9d507f0d765c347e5c09896d545a1d81dddd084ed7ea8c556db3441433e8b4020c083a2725dfd6f3e1ad3befcfca9e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5806fc4625a55acfbdfa13239c23b4e4b
SHA1094b69743f73d0859c763fcc7b3d69f278cccbf6
SHA2566e098bdc7c53a2becf9f014af581e26a6e8d83a45050837bf7684bc4539625fc
SHA512b6736c1c4c705ea5c27814f202172911f911253ec5ec2187b51039f1d46396f3a2f0a6702da85ed2a9b7fe05dc2f7417562ca2f880a15c86a60b5cd8cb7bcad0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cee6f076505370da8f2c19cf1aa6259e
SHA128636c2f628e26ccb0e65939bf6ad4654c24a01a
SHA256702231165ff64429f5a0de9542acb52da87cc82cdde557f090645feb3935fb34
SHA512cff6854cebd66a691045586eee54b5d6c9e1356f4d2fcd9125a9254eb2b6a3d306decad1ae10bac2cadc89dd0d85a2b3136397432f7a9607e1feb9b62b87c1ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579b780042a60e61bee9c08c191d11be2
SHA1aa40965f59c7ffbc10b700f7bfdcba8fd7089af6
SHA256a884b0f038bfe84957641bd7ce2f83dc32f2b8d4d5ba072067aeaa1078094fb4
SHA51213628ab4e7d55beec3324d6ee627bd2a2a57ece47f812e37d51d520b89db24e5dea099db927b164ddebf8233b9fd53c44d0b44b8b768825193ff26990853914f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc76fb5b648115b396cd293a1e48073
SHA187faa2bd7b6d16faeb1e1bcc94075861af95d087
SHA256bbb3e8b1bacc02af9afe58ec0269cdc8c028c6ead65ae86e77fb1f4ee75c5b86
SHA51246d07d3689f13ca3e2c70fab767643bc7d64d2729092aac913ba819a9d2eb3b0af92968dad14bceffd4e1e03733a3fd11097e2ef02b0fd390b8c2050f43354a3
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a