Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
3d9ce90a65b36ddd1e7e1d44a851999a_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3d9ce90a65b36ddd1e7e1d44a851999a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3d9ce90a65b36ddd1e7e1d44a851999a_JaffaCakes118.html
-
Size
30KB
-
MD5
3d9ce90a65b36ddd1e7e1d44a851999a
-
SHA1
790c18deae929f0dfedf3f2d09b983d40a31ae50
-
SHA256
246409d3cd10a52b7e8d76a5156a468e5a72ba1f3b74a660a08dd71fd22814d5
-
SHA512
d1c504f37dc31646a9146ecd5a25c6b5836bbd68cda8e60b56709f482296f0916da4630c914c3c1594afb37cee53b01156365cbb3ef7c8d32fd4ae2382d78f68
-
SSDEEP
768:QpUcMB7+wI/mWXFRNG5EyvHaCoxon7Y58T4:QpU/StR1KEyvVoxKF4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000074c4c9da0953ebc813918a9d88042a2baae80fed2753e131fc126fbbbbaf4cc000000000e8000000002000020000000616e9604c81f502b4b421b27654d99c4d8475ba41379022262adc7e7eabf89d290000000b12a157d1cf14e137c11fb281a6134ff34512caa86f43567fb2dd31e14d6fee7173079d13ab2077beadd3721338270fb8c45f34e62bb5f5ae797dd943e354bedf323d53b7c81273caff88a97eedab2b6f987075a956cbe597865875671a84204f31ad36b3d6fe9860f2086ec8b3c0dd142965792251ed444d0cc28bf55bc2716b5ecc702c71e1804622b263c1f91aaa140000000aaeb0234b54de1810bcd5b2f031bbae78f2b9f4554e5d6d6b1078d5cabc4ea3454fce5fe754e6418b0486b2ba843afe5b54054be7de7c14d7ec16bf69294fa22 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421816685" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000203340ecc6adc1e928d0de203216a3dc5494f650d4c18c5bfbb742aca4b2355b000000000e80000000020000200000006f55fb57a6398e4c9dbe0c1211c852a77492c5d38cd583e676008d85666f710c2000000036573182d944a6de70b5bff2ed9c1ec90ff21d1e1028fd8857144d7e252df9074000000097ba9bcdd0b54c91065f53c37c83e366294d3416e6688bd49a1147ef1a0f02c1485135e8d43dcb3ac43a22e0cffc52b5783fbb31ddae32134d1215186b964c38 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B8EBFA1-119C-11EF-AB01-4E87F544447C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101e4110a9a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1484 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1484 iexplore.exe 1484 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2648 1484 iexplore.exe 28 PID 1484 wrote to memory of 2648 1484 iexplore.exe 28 PID 1484 wrote to memory of 2648 1484 iexplore.exe 28 PID 1484 wrote to memory of 2648 1484 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d9ce90a65b36ddd1e7e1d44a851999a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6ee9cea4c3986c225b64aaef9253610
SHA1ad7dddf2a8036ed1888a3bdcd6f4aca6d79718b3
SHA25616598b833ca63faec4d26bfe412e9975c368ee4eaef197c869b78a10270fd7a9
SHA512d988e2b72d0c0ebbab778b839ed435dd92021cb615da2e90b70a98374b00bc2f9a528f50be7ae2129843f420cf5ae72629afe66783c541d77b2d45e09ae96910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528760c75a72bef36fa2baa444e73f643
SHA1ad3756dba0d9065a0b303406386289369d51bf58
SHA25677b3f779bbcee1f0a7d276197fe22b673a2f42dd7345f168fe8bdb962e3e67dd
SHA512c35944dab1c0b9780b909d4d245b4aa625f1a4f46da434ac549b2a612d107736c4cf785c491b82b096124d371d4ca41eae53835c2869a07b5593d735628efbff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab0d0b422d5a7f6be418153de308189b
SHA164e52ffc37622cad264bfaf47f71b9eb5ade926b
SHA2562a91bdf7bfb64ed1c2c7cd6de46dbbb8de46af66b7d5380d79f280d21fc7d00a
SHA512cd93e94c9590ba4bf0bf526abe213c80c04d924a5fdd4a1945db0fbee282027b3d7e1277af35465929513ca54bccb39d45d674f0d9890aaf94d50f1d83476629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc395af3df5a949799c197bddf1810d0
SHA166fcc1aed89a4bc6366d1999a77b8f914ecbe1ff
SHA25606e1302d9a43bc7fe68019b02e6e8dc40d1d21d731e1aa3eb86f4d3cabfa7a4e
SHA51262a2ba117dc27c4d07262a35afb1a855db36ca722d3cd6a33ddbe416a18e0ec7dd1d079a3aba2b295c73d37c4aaaab53a72c9f517fea5f5e2271a4280d631cde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f62b5d518faa523e7e30f675bdd59245
SHA155447a64a9005bca85fdc620126fedc00f667990
SHA256ff733faf643d52797b13231874bb9e4b74f22fb8cec80ba3e42ae0b1a1cd3f0c
SHA512aa5566a95c599613c424bbb08ae9d20ee7fc69046e0e1d862bfa73d6e6c92442682fbccccaf80a9f28163e20fe5d20390db6905323055f12b4c33dd112769c89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c17e8fe13ae8c4d3013e6e7d80579562
SHA1268516554d6414a9254ae782357e9b5029466b34
SHA2561cda94035255cebbb6ad59cfa9e65024e62911873ed0ea0d4624632121881ad4
SHA51287292051acb397a0bafcc4a53896c58192c3b4a7b44ec309cb685993b2870aade2504f4b81f8d9a99088af27ada1d2ca2099e473659e97f919734d1a5bbd28a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be7d78900379a9f5987342a1602c6032
SHA1b11c3a506ba742e16f70d2c711738574f854742b
SHA2561599ae7083c044f1033ad7159b9b6a8fc51d3b3e699c02dabeff88d4b3356635
SHA512d8ed9144114760af88aa972220a08f1dff638339ae7847ec97706058fcb6206217145973575ad289899cdd933d18973db98346159f531735eb2f456a4609a197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5924781d83724bc0828368fb5c9b9266f
SHA1727674d3053a83df0397bde3fcc8cb9325cfd723
SHA256f7d04b5cc3d1e8fb4bd339b938718af2fc210a71421fee5ac003e7512ba1113f
SHA5122a36a55e2ee3df2b2376664f1439a4d882828df2c5c41ebbf06131c48673f6b6f898db014cc78d5cc5cda0ea39877e69ce049c184607a33fe2ea008f65f15cc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d34cbb9002751b548c40a0d5aebd923f
SHA12e6b7c6cef689361dea134400a3bfe7a62dc144e
SHA2563e5052d4e5aad1efaf44ef2cdc9a21e41bc6385ac62796524d4f5467d235ada8
SHA512a293a6c5f8d11d984da6f4d9d1e49340703865c6526017caf276b94f048da98a4d6143a90114dc9523a03c954722c7e746c0ea4e2a38b27c028a6a59779c1bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b8bd2a8a7e44438079726ff675e0dac
SHA188b8a42066be3c633a58539a54cada654c3820e3
SHA256b175e45de5660c2af4e120446ce1b1dc832be6c4803d3981041dbd2996886073
SHA51284fb11fa1a247803cf1d14fcb561db0c28caed2c55a68deaf90baf6fc1564824945add80c7f193f6d8c10367ac6f62a09ed69943cbf00b8e634115cb0b7cbe8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56429d26ff03f7a10cdebbf7fa176fed1
SHA1d750013ee30dc86a02d26b793b531207a91c928a
SHA256556282f3029943fb9c5965be332a706ef4cc2b8240ff6d27a1b3655447a1aaf3
SHA512c618a78088b8671b55ae10123b9be2a97c64bec8b7ef3f8786e3b184c24219d5f4d910a43a1a8cb52ef5d735dc8134d8c3b4526d4574a05fa7a8c9ac07adf103
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fe8896152789462ada52959ac682b95
SHA14c192cd7828dc170220349d874741fd485ab2f25
SHA25629d062bf8d34aa2f11c021ebc09654044b2b5fd608f9b084ddce24c730c2cd66
SHA5122649ebbe0aae32af2db0a7f1e06629746b23fd2f184be1efd47834252b017ed7ee0e6569e95dfe0231a167b586691ee2d05c1997922ee22744d4f8c05363afd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d0d210b5d0095518234dfd829dea7d8
SHA19a1d09bf7261043bddc30a1ebf21a766adb447d8
SHA256c5ac8586186d10cec522f27df207fa3e70cd14b1d82ad05f3dccc9ec66241869
SHA5121393ec6e2f63d9f9622dbd867b1a017e01672c97cd82de09fd39c7811df02a4a9237885071ec6822ea77dca072240b81d191f242dc3e109037fe70026164c088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca4fee866e1a07164d7cf4d1793af8e3
SHA145237f45b92699036dc371f7af82ee8c3b22740a
SHA25666af0a36d03a4acfaf83c2bc6a25836e7de67ffbabef9af06572328f1016efc0
SHA51282a650e86b5905d9803842d2e46afebdf90f3ace42f5f83486ec1a61f947f81400557dabcc36041d267a1cd404b286244a684d7efb8138a523e95016eebbbeb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cee68d7ece396397bc1f79127bb37aa9
SHA1501b6c79ab1ece212a351bfd2917348d35e4c138
SHA2565096104411b43e220976c0bee63ddd59cea5a8387728ac8b3d3cd8c71ff1eeb8
SHA512cf85b51493a182bfeb63390da2ecf51d8914fea781a06f49af8cdb332ed51b7609afa6d805f0781e4119d0ed870e8aa0697ede1cc1678824364f5c8276448f47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572e8bd63658db8fa373d682d56f5369f
SHA13643135517bc8e5f252184aec117638119a0501a
SHA256902a2eb20c01202317c8119ec61aa5f2177d0ca6b8682c718c219274fbd891c5
SHA5126016f474527a7d0de4ec78bbddaa271eb455a79d64a8dfdfa28443d7061e59290b09ab85367b174e794660eb4f3f1472ad2cacb87dc3749eedb00894923df46f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50901f645e3432b0bad1e17a8aed992e6
SHA105d3c803ec70ecb6da7c7cec56e7c6b8bbbc30ed
SHA2569d9e9de5c03c9b99c1f5e4d81cbf2060794d5c51d37bad087feb6ffb6ca04c82
SHA512caffad0a17bab4efe5f73b21800990561ae12da06fb2d438804edb4963532cc077b4087b55e0e50dd37b68565d1b337bcd53414c2ac28316cdef2b578376e778
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec017476b57b6ca430c0aa2e47ac07dd
SHA18442cd236c4f9f2cb63cc4a348c611a780cb97eb
SHA256419fa3401fd453e95638fe1960d759cff1c4f166801de9a9c60f247e269d4a09
SHA5128a63edd03346f004d1c8334cce257067f1d749ca7000038ee6eaccdcdbe5175e77e80ab8c547a051108540dcbd785deafe19c1c78c85c89ba6101e9d72ec8252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e33269b4ec8d34ff37f5e7d94ab3de5b
SHA1dcbea8b23222762b5fcc5e461124cb489cc130e1
SHA2562bcb8447ccf2f2efd1dd9d926a1bae56f32546bcc273b2c6928dfb65ff7f82b4
SHA5127c52947536252747ac2e2255ed89b6d099a26fe5ff460925f76447c1c1dd5d7428eca259c22a8106aae16abc7c36a0f0a343c0b0068e213c40184c30cfa91448
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a