Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 12:37
Static task
static1
Behavioral task
behavioral1
Sample
3066616f549af748a88e6c8a09465642_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3066616f549af748a88e6c8a09465642_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
3066616f549af748a88e6c8a09465642_JaffaCakes118.html
-
Size
91KB
-
MD5
3066616f549af748a88e6c8a09465642
-
SHA1
1c567d5eade7c30b13ec35ab118bf26c2ff57965
-
SHA256
c469461ce4fec3aaf04089415c34336bb0505356c651a2e8eee243357c8062d4
-
SHA512
a01cd760d74c2f58fc1b3f65a61a4febba305960ae9d9771e345797cd420612adfa85bc2e4bdd3a5f58e4d2911399267a410e99c996645905e7c2748da127c65
-
SSDEEP
1536:gQZBCCOdo0IxCNFYAv32KSQ5hp4f7EnbvQ5l8eqykOOVZzjmGUmflNyVDm1B3pDy:gk2m0IxFPd
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000056118da487a260667b44baa91c1b2cb5de092ff3543dee332812a048f3954c8e000000000e8000000002000020000000bef77c5d1ae886cc06e4604a057b4ce8c6c5566617144f6f246fd31cd838ede32000000021fce89ddf077526ce707ea7c25e9c3ac2ea3d259c2b80a514c14fd54cb4c63940000000bf91dc770a4004be7fce761b13e626d6b16b893f9c6a8ade090079f68eb9170bcea41b2c3ce8edc94686f306ba12a8188b5107a458f13ebcee539185003b1518 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426695625" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e5dbbc08d2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000005f37f2692fbd5cc09fe683168fa90789377f0a380a3f2200986fc6e3daf74dbe000000000e80000000020000200000002793f5c435b455d4d0f33c456fecdf289d411d1c051eed243f3989295b86eee590000000b1f0cbbeffcd8ab9f0f5f905b76f8042ea933e746c6dda0c53f88417fc0c470ec4a989e3451c97f8df4269cf08730ae12f590c5595ff5423f6fd10376715e0af3872613aaada28e4cb241fa520f526374a56800665e4ea30697c34f4e1fc79a52a826ea5c653056d8902cdb78fde7cea8469e85a328860ec4b910dfe5ed6961736aaa02371507da41487877bf944b5b0400000007ed47edb8da0cfff3e0f319bd44ba3fdf062409a592d37f14f2783c9b5ef33b8991c563979e60e874354e2b1aa978d50f7d5892cf8a8f3ed17e953662746926f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5C7B9A1-3DFB-11EF-BDFE-E649859EC46C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2392 2296 iexplore.exe 30 PID 2296 wrote to memory of 2392 2296 iexplore.exe 30 PID 2296 wrote to memory of 2392 2296 iexplore.exe 30 PID 2296 wrote to memory of 2392 2296 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3066616f549af748a88e6c8a09465642_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5587c2d3c03ab7e1d54436a83b09bd1a3
SHA157388d50e910aca3488a7e445351690d7f5d356c
SHA256ff5081f50365e4da04f602612bb67856101d3509ad0aedb68d8be972e4254dbe
SHA5124eb29f6f8ec4dc0cd890aecdf5d241e5f16a74c4889ee7c34c6bdc905666082881210e0d9c632618357cf481f2017079b1df96d24876d8406e8541302430740b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547cb5f1920f726940c1ab69d04cd27f3
SHA10bf902b50009145bf26abf5df33b1ae337fb6001
SHA256f6baa0a8b3e632d9f8ec3231c95d9242e059194f7c0b33ff4dc265c678dc085e
SHA512056d1b5dcc8a7d385cac68392a6fa66834423695de3683c6ab876d0a8cfceb4334e9c7641126598e51df16352b704ff3e4aee264490acde440e0b0f7b5dfa4d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d42c4c10b6590195da265c981f18e81c
SHA1ef04af1b0e62bcc342341b3faa9d6454e5d699bc
SHA256f8a80867226b065b21054113c9678a34bb9fa27cc20040e7fc5a662952973bd7
SHA512378d409d94f0e193bc50128583b60f83194d1891b877d88d8bbbf4a0f4fbe1d30f4688d7fe127bbaf38f53c4d828cb333921e936b724cf3e4f91dc3afe9eb95f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1498176d151109a05e2e75281a9c2b5
SHA1fc82b4a167ad3d9bff66be1c8d9baa7634c27080
SHA2563093801ebca970aca0e19049368655a93b33229284d31d803018efd51da8963e
SHA512718f59836a0fc3d5ea134baec916848c8dfa751de5a07d4c11a3ff8bdb5fcfd6267e92f5436ee9a9bb6b358b33ae9b83419e1bea44210ba386334f49bd44b847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6dc257d71acc41fed51f7d9625554b7
SHA17f99dc4e36fd45a28d7fa80074b737ecfe550b6e
SHA256a22bc37693f3b428506efb460659317e932683e0d8e5f062896272486322b49d
SHA512e9ca84bd7c7947f196a911d25686eebb35678ff6c5f860b559c62b77cc934ee46e57d844fc730111594664576faae5186d9100c8bd95d1a5a36a6480ba94eccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3720ddcd182a8db3bf8b9445bb21576
SHA1da5ff944c06ba2347c5bfde1700d01355cf2698b
SHA2562af5416b032a7d70cbcd3a1e9569095a292b66a723989f4634d93c60d4d4c68d
SHA512a0a9593e2b3c2d58136a2edc9f5086a70795b23483035b3b4394ad67b11356a501fc5e13fd9f358849b127bbbf1f515a8a2eb708e996767e9373c3ab8b57de94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5638d25365e7f58cea99c7b2f90f33e74
SHA1bb5b5b1bd0af92ab7947b31f97810731a12c477f
SHA25669f850a53ce33afe7de5c3e5b3974d234a0ae9ce74b3f367274b99ca8f98f13f
SHA5121b2fe952356fbfc2a9019c4e95615ff82e28e90e0f75dac369614e316a710d2f7fb3c1d647eb6ed2575853c8c522f224a1303efd3b1da9df3adf9272f9f9f966
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52202389635d8b4bc7532e295de6513d7
SHA19c77648e9b7f656dd03d85c2561a456e0f45070f
SHA256f3d55aa17ebfc80f45dc9871c763630edd216ba7f16a338c64c464cd7037062d
SHA512f05c917156556c5421e96924c1587cb2fd7ffcee06afd031a34767e9aeb538f9822a45ea63aca87dcce6b2dbf7159cf0783640a3dda7f4350fa1d2295a33b334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d29fe1a3c04d33527079f237db0cb7e
SHA1264f01276f2a9c0ec53f6c9f6c449302953db7a4
SHA2560ac0d5ea19b78d7d60ec7cbb8498e5c1ac2d1bfb2aad37ac26853d637230d5a3
SHA512d54647d0d95c28f93c707d6c4021028e53b92954271f069cee847d9a9db07578fab3b278580717dc5d074d87154d85c0719f910c4d42b4a6af841d23d6bdf4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9c0c13d704c5d5eb2823e6e1f0a5e24
SHA10604ea68f60065235718affc802b76217f3b737a
SHA256b5c336f0026e2a09faaeb4cc45fab0f33daaf3818c7a8e1419ffff0c134b1036
SHA51245c826c1643f58e92dcd01b9813ae57ead9b464870d03fbb298324c21106781dc385e714820982e46e3dfe43fbac8dca85b11d39ebcbbe6efcb852cf97bd3cb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efe59a068090ee1196e5e937fc854ae1
SHA1a632912b91520464637a3c523c242b7b1d946f30
SHA2564f681a70dd538e85eeaefdff99125b13385cc1c057b9523efd910335338ce041
SHA5121b4a685d3f8f5b79ab360ea3ad49c5d8db557f252ee67049715e9d139672818c278205e65689ecd7aecd52f0b8063866f26be6bc47ef0cee504f1660fb4831f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563341e95a010aad82406a48c2afd1153
SHA1924e86075eb11eaee086dfa1e85ba1b32051377f
SHA256c62142b5241d26b82a4b9c696ff42f950ab9f708f5baf489ef5d90f3327954a7
SHA512d3c49164346257c73f5db9e612eba2887a44abbe166db903d95ccafeb0610634776229f8e3b0f07a16f28d43076253c9b34403ae226351d727799c81afda342f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a68c6354aa4f6ac7ca46c9ec7e9c5b7
SHA1cdceba2c31961590e093cda61723bec44d252262
SHA2566f4ce06ff6ab7e293db68d83d5b24ca5cf20799595f6045173e49790b7e92d22
SHA512d028e2cc5213f3e3557e02154c00af801fd35b1fe28d5d9efc92f71e34a26949c204c85116851d2b91277497abf4f778ffef116ab96e5e651ed2dc18d3350581
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574a4d85268ec085b2144955cbe27df94
SHA1d0ef1f6363614ae1c01cba70c771b93a165793c2
SHA256167bbba7ea021ccd476fcfea9c547e4f8b027193af81e71da0d0a37f8159b6a1
SHA5127107b94f00fdd0ecf0d4895158e950772f0e208a2f641b1bd9e4f180ad39d35d999b2d6b13564ca23a974c6690319515ca2a8b22189a02e4f026ee75196b4d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7e9e637967306ca11382c926bb8509c
SHA12699f64bbd0aca7b800309b26ca3c9ea2346d32e
SHA25641f3a909fcfe3ce3afe3134e71bb6fc180df84f56eeb5e15351f1d637e65d6d9
SHA51263b1b02f2fb499a4851f49b98749b26ac1848112b68983b10f8b58fb6ac7631f4e8f0eae835cd538f051b7d49cd37c5aa52fd71869beb5a58f27f38523e01457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5cc9391d8b92158b417b23e071f60e3
SHA1affb8a73259d22458b7913ac92d51ea11bc88191
SHA2568e0ff25d5a0e947a96c851669d3df131ad1728f2430bc3e9667a727a516c9e09
SHA5126fc5c18da6b41351bb4c02e95a19332645eac37db5eaba6505acebb011ace9de98a67b5686779d474c30fdb47631792cce5845291d66ba5245431f7090db10f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5227e9b9d63f7818534cfc20477fcf88f
SHA1b762ebab707e3d0382684975ad9db0a3d429ab3a
SHA256ef38d99a69b8e77a7efb0334866e1e16d185b0c06d170248e92e6b593e857938
SHA512133e89a0fd217bee74d5367212776bba2e3b1ff78cfd8e20c544e950c655f64884942f1f9505e955d4e6bcad6fcf1e51f8a9195ada5d286a9ea29a01618f0144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54295108aa9cd498717dc904ea9039e15
SHA1c4d1f0c2f9f541138633e53781826bb03b8f7d02
SHA2569c7fe3134545bdf9da4bef47b11fe1343896d50f93c4a4cc3618209e6b116fc9
SHA5121e652a26aecf7d90b9d92aad77cfad6b3f83cecd9abd6c753cbacc8b52ade9048b68f16e99679a53b8c8c5ac04c9c37a61570864afef8080342d0def60007c89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c2d3700e0be4c4f8083fedeeb1df8ef
SHA1ed4e47a51fad3a2eedae86e958024ebda30a05ab
SHA256a36181d2529d4c0fb5cff557cf978e16855f1d58dda7ec6e3b8903030ca7876f
SHA51209ce611aeb8da8e1b60c56716e845f22a557aa66b0c55cc7e7e8bb49fdb413452ec9d99029c81e3bb03f6055547fb64c3b7397737647be48b31a81d6cde84509
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b