Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
2e76830ef9a44e600662d4dd324b6f5e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e76830ef9a44e600662d4dd324b6f5e_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2e76830ef9a44e600662d4dd324b6f5e_JaffaCakes118.html
-
Size
57KB
-
MD5
2e76830ef9a44e600662d4dd324b6f5e
-
SHA1
048b2d31e34574f25024232211585012d0ffc37d
-
SHA256
95b0bab3a4616e7ab0967f48f6b1bbadb74fb55ca7a8096867e67767f405bcba
-
SHA512
add67a9535dbf41b51f666f8a1529ad035ffa6141af09ee8a0810a0a0545f17a4a4c08d78e56981a720c8f11d3313bec3dd97044c8ec94c5482967cc3f7b4709
-
SSDEEP
1536:gQZBCCOdg0IxCeuOGfIfXf1fmfufafMfnfufcfgf1f2fafWf4f9fyfBfofifKfV6:gk220IxSQ/9uWCEv2kodeCug1q5AqiN6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426668252" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2ACD2481-3DBC-11EF-9168-6ED7993C8D5B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000037008ad01dc6ceb2f2afac933adb91b23a75fa137b1001c20c2978909accb1f7000000000e800000000200002000000022008012486f8f4b299cd1c2a1350dd71a4fc2019cd37a0c2e50c907627a151f9000000020921ed6729ac5552888c4ba570e8a357007207fb82588492ed00826a15c3b7941f0c850558e3051d1ffb5c07807851902c0c77271ccc8261826444bcabad0bdf0d4a6848093c54d680b1c9ce13d320d55eab7bf7a7e3bdc3e0bcd0888272b9ced3ac97de9a2d917f90cd35450d756d263c34eb598c5c89a260e737c941d8250080f006823120a000493acb940c10bec40000000a03c90ffededd3afec1c86ef4f4e82671895b255f9574e09b8e0a25ca0ad0b799073d5fd75e03b6cf34db05bc464f33fa1fa7905e25a8a20ef8dd7747769a5fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000d9fbca9cf731f3bdbefacde50f7e3aaf0a54083a82a6c4a2996f66247878ce61000000000e8000000002000020000000796cb393552d1bff99d03b03d0a436b2d29a505c39d44ff8f8ff3c1248f7299320000000b1b89ce97f5307354d13067123b28a6b0bc17f7b4c0fdb3f393e93c6ecbc057340000000bf94bf73b1be11ea3fa906ddf42aaafd0c27033fcb471b6dd1ecd0a994b7e5a882ac653ff77f2f0f2979824780af6d21f6c7a89bcc2f38680249fa03c9ef64de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8020be01c9d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2180 3032 iexplore.exe 30 PID 3032 wrote to memory of 2180 3032 iexplore.exe 30 PID 3032 wrote to memory of 2180 3032 iexplore.exe 30 PID 3032 wrote to memory of 2180 3032 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e76830ef9a44e600662d4dd324b6f5e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554527433e35169179c2463e80db8bee7
SHA1524f64868dbc8193bebb15289e9435c034957046
SHA25605365d73125b8b88611720d08eacbfe0c3296e2a50b178dd3e9c179a7433dc70
SHA512d870607b9f02606492fa5ea8ff6d6e82a3e46cd0c865b1f68556a27e0790f09ffe316abc5af859a4dae9a941a1fd5368ddb90c70733d46051231f48f39873683
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e259bb2d819951708fc1f8320a0cccb
SHA11fe72403e3071ff35de9f5fa246a017d5e689bea
SHA2565e91f8fefdd2ebc0b1383acb9323d33b406a930907a47ff14f1bba00f1059908
SHA5120ee4ac7127fef3c40d1c2d77325303d3669f5db15325d25676553e195c6481d125d8e2d3ae8ac21938a428b8cfde1e16f7f3629cc2ff07495ebcb4664112fcce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567896a99979b024e62ca15bb814a0da
SHA143b865bc9a3fa704304bc9d843f34e6e6067c805
SHA256aa02f6d5752d4b4828de3c1c7a78d2e2d2819d912f6196ec16246bfe5deeaeb2
SHA512c3931da900bb193ae77810de86061c96a7e9fd394e3341b217712b1865c504587c4fc8f18f5a798b23e7eac10dbfb3529bfed15f7d32c2b4ae77e7695e08d29b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5518232d1f52606afdfc8dc0e1eb32c1c
SHA1b74018240f92159e73bb87a2e9f01ed90c9afc43
SHA256315e9e659bbc697110e5aeb246705c3ed170d3a76e44bd487039880c25bc1f53
SHA512288ff9936641ca1cae124b2d815d22947108bc9a9d23fc6cdb6d9f3db241632b85f1ea172d934f77ece09c264464bddf7e87c4c82d844cfd27d9186df6446d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57af2e66ef11b205158b1b6061b8bde01
SHA1f11d586bfaa95ad5e0f7718ec5a6dba5c191e55c
SHA256538d4296040aebeefc07b56f03d1444116e1b12180a4cd9c5a4684d5b14d12bf
SHA512c8ea515ec5e0a154e88e6054efb4d22cac4d4015117c34909847284303e2e1bef665c4ef7042915a9bef3f94d9e2e3a667210bdb84473d608aa733de46bbeffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548f96c0159953e5276caa58144ac3497
SHA1ebef6184afda69ebd9c2bdc15aed7a36eaeed4cc
SHA25641363d5a4351f2bcd2bf904406349203a6a26220dbf5e83ed7d8cbd56a13530e
SHA512897ac864c93cc9755a683c7fcd9caf19857a6d9abdd0dccdc0bdf03831f57c368dfb6968ceb74f41b07f34892d930e22c87f013e1fcf13bd6df16101cbe38407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5babbd3f6fe16975183f662c28e502c00
SHA112603519a96c0f48bc6fd8863b68c9e4b1d2f820
SHA256e36ab718023da900e51d53f87fa1c44d523e84cd722745b1a589c9b6d82207c3
SHA512d4cd895e93f7d8a5a53518f5b2ad0c64c2818c17b81c508e1834e1804a6bbc3d54f19e07a3fb82e500968b928776051f98240e859a5c37d8a3f663e58c71e6ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e976498763e1f7be51be3bc0e4ac8b70
SHA1889a44e0b9ebaed69d3dd68b3644bad3e2cfbdfb
SHA2564899e2fd30c239f95132f18285e17e3298f94db87b409afe94e9ed7febf85b10
SHA51267c58631c7f0afe898e4f59069deb98c4553e973cb246da086b3c896075d4db566c91d13e8fe9c5d84a165413de0c4f5faac7e47731dc477f8101188b25e4aef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5274fe2eb9363d3e91ecfa8964f9688ed
SHA1e825fa7f8be6c856a02718aacebea9f4b48fec08
SHA2560c154a79f4e3d0c614706e34546ba81cbc9221bc43810d404239b58d249e4820
SHA512c4d3e864382c15a1e95e90aa060963ea64c66f81ff5cc3991b9fa77ceece01a48a606bd7d24b31f824fcca90306818ada5878492b02870f6cfa388a07fe0b31b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c66306144b1b1201b8dfba1cd8e6c0a
SHA1b830c7419ae628491c73fc70c88e95ed43babc93
SHA256cd5ce51dcb8afc8f405f462ee4d6b8d60487d1c78ece8e1ff921b908dd492322
SHA5128ad9f7d4577e9b54f2b44521035a43d6c605ad45b860ad5e7c03337e86cf9c4c9e3e97b4a919ad88667cc806a9ef64d1a13d83f30c5b5bb898bc0906e9cd7b9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de2179d90b6b4c707e54ffd2d7ae2362
SHA13a7f230d6de95c37b9c693b750a54a56e838bf7b
SHA256489c718c51557e2e4be77b83818d0855737b88bf6332161c09122c12cf3c1b7a
SHA512aba00a4e78ed736a48e9b80f641f85b6a5f8b7edf0f8b8a4128d9f30de2f3e289584368baa97212d9ef75649187b82e700bc64dabcef62b219a60b601240cee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54df2e6fdd91e658a3710ec3ea6aba4ee
SHA1eb6e3cea38a85dd94bfe94e2a1e99f37adf0c7cf
SHA256b5a156fc7a2ef20060245d846ae9d1892f71eb61f167e98139afd521bd18a598
SHA512cb758b43e8278e055a4a6d04d7e2b591211b9e9b86f6218c746ff4352c5a2af852d78bfdffe039e7d32bb7a0d5b4d744c05db7fa51f487b6e8cc91ac0dfc4bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585f732864036bb901f4bbf58472b6c79
SHA1a1c937e6d95f7df784a0deb66d0a5b475bcafa86
SHA256295faf9053f5150bcc73f25c7015f3e636b248574496211ee0a9481ae0ef7ed8
SHA512e782749c70ef7eb7e20ebff7585880474ed48291e9365e3452bb5bd7de057f4566214965e7ddb561ad95a74da69118c2498b6ae802102deaafcba27ff1fe60c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b19b2264bb61b94f736a19f2eff8c65c
SHA115b814e96db4769ff81e35e06f736b432a484d48
SHA2562ac98a9ee5029edb289bc18f350134241a148ad939995f186c46ce5f839e7f40
SHA5128dde45a16488a8252416330804fbace8ccbadd000bfdfb01175743f6e299a732cd58969fe7d581010dfa8e652b5c3feae792f413323a624b8efabc268159c45b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a0eebc436089b1dc96c5ea6fcacfa11
SHA1f68fc9ee63446c1c9cfcb523aa1ce1d271f9a87d
SHA256f86185f38657fb2ff2daddb92c187bc16634dd15fa167585080848a9bfbaca8a
SHA512ce7313274a116f739ce20b94577d9aa1566939fed75e596f299593b0581f196638562e51274faea06044d6bf5f539e154d2b823e9102fab9dd78a5565a8162d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c19fb1778d527eede3a9c6786589470
SHA182829805d2038e1217ef9098b7a90b3c2824c50b
SHA2561f149f6b20a12f815496436bb510e61216bea568f600c214f84e4297a5e693aa
SHA5123ab0b35d2a4db87225abe9b6e7b28fa533321d3ce69a64d47fcc72a8ce320710dd8209aa70896211e7db93c8eaf85045e8d3aca5446721d2ded326e862986443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5136df48f40597e15e3ea483f613eaf56
SHA13d5ced52a91efa78c796476c843c9bcc6a6c96d6
SHA256213970ec3f157da69e9ee1fc212dad43ccce4b1e30179e9e4e8c0007335fc75a
SHA5123b6b5ff9e4e104ac9068e7bad3d2a7608136b0066b06aaa63d88070267fd22d11d95a37069f8bf16526e22193b86136cbd3b37b731feb0d7cc9e5f5786bc13aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf7604102068415eff27f574ee42fb26
SHA1f94eb32fe680be2a82c24e9fa584b1d6d1b0ae88
SHA2560527479431bb33621fa1eab3e91f98931a43ea3d4cdf452d1b08aac34cdc0483
SHA5121973af904098d3766943f3c327c6367ff2aff00feebb36d904cc304362cc60e104eb4edda6ba5fda6c3b67410b4cbe051580d000b8b212927f7cf9c173dcd31c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b