Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
2c2a310b5b413be5c8a6e0448f6d26df_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c2a310b5b413be5c8a6e0448f6d26df_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c2a310b5b413be5c8a6e0448f6d26df_JaffaCakes118.html
-
Size
258KB
-
MD5
2c2a310b5b413be5c8a6e0448f6d26df
-
SHA1
d4641f7e06dd70936c2b5edcfff4ce91ae65ed6d
-
SHA256
1586623c80fbdbfe8795055740fbfb2233d7c36212d0b20a314225572d5f195b
-
SHA512
eada8ba6b011d9882efcd3da654b9934153b894f76fe6d39ecec5c6aed13c90780e3ff5c089439335cc9e218e867aaacd984ceb378460bd2bd61ac7636ebf27b
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fc/vCHAQ1my6kLWOQKuIBooYKSzcZp4w2wp:s9F/LQY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426626160" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000009c1812cf920a1651573a266a0187e44f978db082e1c2fd05da18ae00e0edc6b5000000000e8000000002000020000000d91ab94927f17d94be5d629401af7f058926ae8436a499dd6d1f715e74d013479000000019f78aeec47d196676044cf5b01ac1df106b2dc0d74bb3ae17a3edf25234559941cf2fc0bff6c55279a5a4f49dfd71c0c8c52a6a7e2ac10d5a0eee701945aff99a2dd1c8e389ffab32603529b757097f62b2848f206955f6a447d308fdc3f6f546839bfc9b24d1922011f131547a537cb930551c08d45937fb56ae17d21c3bf5298c0f6407cfde8edc266eb2f8a3a78e40000000560aafad0dc5f3a357c1c8ed3f58a4f5e42845c60a6e6b1d4d9a625c71fe93ee52fd1bc0bb7726656bfde76a2886ed8d432835099e54cd20baabcf1d1e148dc1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000281c5a55a6fd3d83baa9709c547e8bb72594a619e0c482d69009aa593c1707e1000000000e8000000002000020000000608ea620546d636feb176838275ed73cc8e865349e1df75a99c255e693ff46d5200000003d6feaa329c909cacecf00b2621a3464d924971035ff6289c8f3d821989d90b640000000aae10d6aeb35cc72762edf17ebd52c26f3ed7d9cf860b6698480c0b6be2e39c455bc264bb7126d3adb8ea8b4d13a1e3cf7ad84503d11feabaf7a16a97c2cd7e9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f073c31867d1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2978A491-3D5A-11EF-9051-EE5017308107} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2412 2100 iexplore.exe 30 PID 2100 wrote to memory of 2412 2100 iexplore.exe 30 PID 2100 wrote to memory of 2412 2100 iexplore.exe 30 PID 2100 wrote to memory of 2412 2100 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c2a310b5b413be5c8a6e0448f6d26df_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f517f8c029534af3606fd39840e32adc
SHA13cd40d906d133647d5edd521cbc4097fe4b04612
SHA2565c1994f2a81c277539edc694e02dc3a36e323ce46bb77478b5cd36e79dbaa642
SHA512742ceabbe6c8f7c3cf9cae25cccde9be8da619a5c739a7cdcfbf904cf96999ea0d8cfe6ef1f26cb947af01b79f9ea6af63a005bf19c9173502b73273721ae419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dec642d9f33b37648cf9be4ca9495870
SHA1884c252efb749c197e022185330dd763b5c08fe9
SHA2564e3c878bcfcbecfc7b623cfd6cf97b44dd49e20833a3f10508e163b5d0d45c3b
SHA512fc4e96dda5b4b329659065107f3d8557556cae83a58d62b6b255ad71201dcc0d4808140938ba4aafcea1d7f551bf41271fc7d9081825c694b3b930b06da4ec8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d59a7c43ae52320c33b6dbc343ad0f87
SHA1aee5c710bd5a500ca95b7f44342de9974322fdb9
SHA25681d4c820df74ac957e11a4ccf9f7fe69efa56677ad770ec13451237fcac2cf6e
SHA512b80218d2ca76053501f5f4a39a5a10ef5464fa50146eea8dddaa4405c44572c551547cd1c0227a4e599f2d56249a5f7b6347fb7e119e9f1a5cba105f29689003
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5217a2b01ff852b61d414d4a45b37ee69
SHA155d61b8a50778ca086cbf5c4903d2e4afffd06cf
SHA2567cf7961b5d051ae790c3c53090e76fbac711067294cc1196b7fe98211ffbf876
SHA51298273fd499499ce12fc297f7ad9b70b8677076bf80af009af41aac5d0cc49b62972ecd44cac3dc7dc3872b3621f6d23043973ec2afb0f3e541214a09aa420934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecf96521c5fe588c6679b45ca23effa3
SHA1c06ef30bfcf0bfd71da8c170763c7027f7b43b37
SHA256dfe1a8dc07ac20466a20f01055269c7a7b9fce1e0c891f18a6140097656b0d2f
SHA5126381f6aed3cfaf2360af95b829d7429fd6793093f33cd15a46bcd6b84db36fecdc83c1a78a979ff5b4a42e06436ecc2fc5d9a044e55eeca6fb1d121adfe8bdb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd1f2903c3230e3a02380fab9b7bb547
SHA16891bd5b60e6dcb0a5e4f117eec38589d9c3fd28
SHA25687a29b792354d590081df97fd94d59da364e77c41a3b9991e429f4d02f5561d5
SHA512ef95fcbc4b6a0df7497ebb758cb0b088674727980f2c6dc93b1c1b12f3cf17da10c652934796fd7dc99083220cc914e231fcb884f50d8c6cbb967c28cbebd19d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db432bfa2f0d9f382e4c27311ad1addf
SHA179779bf9b5fbc6244384f7506eb77c0db32abe5d
SHA2561f0b76e7d72338f888b8615a77a142197facf97961c853c297582d9f11f5e12f
SHA51249bcb1572b4d9368fa3802d2de242463ac5d7c9681914ab8e922fb8e725629e4eb3ab5221105c8bc26c25cfd79256ea1777ba79323e0ddf451e9e1ea75bef189
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517a5c9fd0b74b243b27445131fe69a77
SHA18d0f177c813d55e1685b2db537d44ae95ec50415
SHA256bbe3f6af3394cc1ac2930d479de2a1670bbc803d0b28103429781c657cf4244e
SHA51278938f281afda7168d8c7b2addf83b4c9936f6df86937c5150069daa734836a00e2776a9cce6cd4be7fb1d17a4296dfeea5d199a3e19fd2b0b82ef882b95ab64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e3b1ab59ef6809c30c0e444fc48c541
SHA1b29e6ac13fa937b088ab7739e6d000895fa41dcf
SHA25660819527125570cebdf5c807d140341a472abbb23c40061f02fe91ad208f9f65
SHA512541d97d44f9693cdccd8c5d2f873790b316586bc07c0a7551920d5e528120cf8d44fcb3b0ddef0736f3fe3603a6047336057626dbc6a5202f6102f09c0fd4b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4f412bb17be1c57b65a0d05bf239e19
SHA1f1ad8aeae3b1db5f472d04ac501bbe583f6adc13
SHA256176a2ce5af5a9b13e1a19638a8f18ebdeea5a159a12ed502bad5d8d30bcdf857
SHA51218ac8c025daafc1173d284967d4ab73f1a9805c67336e36739234810731d7f352144f5226b2694f00216460361a64fecd95a035a64c802a1deb431dc87b9aa3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5227a44c69f668a96b337e10f0f8c5538
SHA186feb7757e458799dbc62cb6026a4bc673675e4a
SHA256eebdfb795e3a351b4fcc768f2c9d42b180e33c2c949ae5aa012b140a4faec13d
SHA5126b8e5913890a52ae5a03e8122483184ab2e3fae70c23d3ca1c0cbd1eb7ba333c3f236d2f6739cc2a8b4cb898b0fdf0ddfb59f289099e61dae2bd4deb4a8660e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce0e907d732eba5c255aca5d6a510bfd
SHA15cd5b3517e380de3a927a18f1336c4ea83e86f12
SHA2560c57d56017cc87fcc757b2098f7d708615612b0cc7f9e9328865ea5daec0f651
SHA512400ab1d7db49e71e38aa62f6646bb6364421dd0d33af7eef90d55644a875255d6cb488829dad35ca2fe288582329f587715dc0a30072a388bbca11f923cb312b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbe79a22b87c0df4ffaf787d2a3faf6b
SHA1a4bcbac553459f5e7a157f42a47805d6dec22f01
SHA256b8a20ab87dd93389c21ba26ebb0da84622bba4b1c2459c9e201ba6bdb0e81141
SHA5125d81ab39f93c141a35e6a353e6391b23acaa0ece05726142d1dba59c03b1cd4f5c85e580a7cb458039b9d10d60cf792d833bae447524c8db5ed6cc068960f911
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50812aed9ca5a70c21336652bdb801733
SHA1457bd165999ea758845fe568c433fc6143f6fbb7
SHA2566826066d4e916ce575ffa17c1fe93340aa269c53d345c25a818173896a711bc7
SHA51277173819f73c42df1593f2fb05856ce4c0db8ada5cc35500e455f84a492836b0d03470b202bf1f0e35dc3c40cbed28ab2df5b41cb6e6051ce1e0a5ede1803680
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cc7015362b562765e6e57568b492833
SHA1364d04bc6f0d60a36d4d2a488a1f78cff95907b1
SHA2568e9b128954da83db29750772ec1425cff86a6f1bb64098cfa4e5b1d53f1caec2
SHA5121407ca3af1eab0479fa085efae271bde146ef2f3c7dd232a3fdc3f21e56490dd1609fcc74210162adede25684d67b1482791f5592b3e017d45dc1f0401e90445
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ce0f63f6d089053281f18b31d334576
SHA1e6a220fadded587e3c4a27833b351e9ffec2eacc
SHA256511bc1a06ef5eaddb1dbc7962455ad2c4de43a0f585948c74b6f0ba9667debb4
SHA512f5ec3d7254e758561603604df6e9dfa9e04cab454f322921d7cc7d53500d2294925f2bce37db03a875f06bf9f0e301978d010a5ba76127d9fb6fb8646fd5af6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0760ca31cae505aebbbecc0858196d4
SHA1f0c282452407fe2d35f2097a18b0e0df773574fa
SHA256554d28e451b0f162f00f36a443540cdecf75bc5f9b1a324f330eb8fd6fb8b5a2
SHA5120c2cbcd5a447f215e6d757eefc627200468f7cc5e1770105a2488b117df9bc4f68f7df9dde8f0c77cefcfacc999dc785b6f3671a4c01ddbb757cc3bac70551d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d256c2429c4a111181806b01edf9ac6
SHA121ec18184b5f4dc8a339bc293e48bc6dab32bc2b
SHA256fb212c2db1d4e40d6284f0400f19a5ee170625bf0706671f0264476fa2a4e628
SHA512f4d1b8096c1c8c640282d9c61df6f32fcf2cdf23ae651558b891a33ab21dfc33efc9c490546238386219b7114a44ba7b852f04f717c901a1bc569306c8e55302
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b