Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
31bdc4dd751f96bb51192542cd7cf6a1_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
31bdc4dd751f96bb51192542cd7cf6a1_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
31bdc4dd751f96bb51192542cd7cf6a1_JaffaCakes118.html
-
Size
58KB
-
MD5
31bdc4dd751f96bb51192542cd7cf6a1
-
SHA1
cd05993cb4911a1b569d45e56cc798a518e9aa07
-
SHA256
826c93bc44fd1179b5d11f622f0f47b1e88976285527302cc8e5a95b7467f274
-
SHA512
f879f467a84b13eb30244c7e719abf242c4a2ce7b4d709abf3070c2ca2c757f4a51a0b4770f0d461a9bd2b6cee40ca89d8bb37688faa0935b1f860fe60778e40
-
SSDEEP
1536:gQZBCCOdE0IxCQNzvf3fIfnfkfCfnfxfuafXfyf2fMfGfJfrfFfufufufPUfmfrn:gk2C0Ix5PAvM6PJrP6uUuRTdmm2nUOjn
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403fc87a3ed2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000c43695d0aa4678c9808086aacdc0c6f9bfdc40a87f14a4637685c1d19305d811000000000e80000000020000200000003e61c5f150173da5d95110e0e713defbf0d0c0b0eeaa1f10fed939d77f08e8c190000000c0073e9d050d1f221bd1e16feb5fd34bcb7f4ad43e0f4f15218918229d95b601723f80ac9235445fea689989f89edd77fc022138430562299fe7ff32661bac0ce584d09248b90f36493b901729068645427b1935e0c9cca5ab9611f2a2026d062941b76835f6d63d3003fd3f65d36e26d4e759ccf635e80eeb58a22a2e666344836a6732418a6beeb94e613f1bbf886240000000eb2db369d37dec1dda2b69e4a09df1bb6b8e20d981433b7e5bec7fb737ef743b9f17169703d4124b6b6c4be289bf21af8cecf05989a661f16a8e791ba6188b9a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3C7BAB1-3E31-11EF-B707-6AA0EDE5A32F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000001ca677ebb7e7c2b8fe44e428f7805ca471a4819a08925c01eb3f8724c692286d000000000e8000000002000020000000bcf9fc450b8e1675a0b15be24c0e0ce399c05fc18faae290fcb2648049423bc3200000009fa0baa99df2cf13d986cc76ac12114205d676e0c454da1094dd77a85f41efda40000000e132c642ffc659ca0b01ad371bb044a5e6cb4a2166d2168f7617fc1abdafc1a1b504ec70aaf92d7243f1f8ca2545ad58886c9bf0364fbec670b300f04500bbd2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426718707" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2416 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2416 iexplore.exe 2416 iexplore.exe 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE 2436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2436 2416 iexplore.exe 31 PID 2416 wrote to memory of 2436 2416 iexplore.exe 31 PID 2416 wrote to memory of 2436 2416 iexplore.exe 31 PID 2416 wrote to memory of 2436 2416 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31bdc4dd751f96bb51192542cd7cf6a1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518a091938cbffcb88a9325d32b6a96ca
SHA178dffd6138f88d76277b05f0449a5ac158f8f281
SHA256c90645701703499b31664e1b7cf83eb9066fdfddc5769712c221bf929f8692ed
SHA51286726ce345f81a7ef1654398f725e6b2987d149fd7fa0400b85d9b2dd53b0ae2344f96a85fccedde6afd7f3abe637aeaceccc4ec91ae038bacf5b643a6cf0e58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5658f5e0128698b3a6725d350f9aeafae
SHA146b4f6ac5893b12c58f483fd80b72c9daf698fd8
SHA256045dd8b331aff9b0f18339b94254ff1ea0af711e648842bf3d631765b5318e5c
SHA512036f1858343a917257bfcfdd185d2cfda9968a3e2477d9055f8599d2d19860a6d1ddff86813b8c314889340ef8b614bd0ae91a0ea5ce4c6be2a316b38a0d1e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f15993dac0bc63b747b386ee0dddaefc
SHA1d06eac5787f7dc385610582cd54e57569eb8283d
SHA256601ce19146a0bc90a96f72fa7eedada4df48169f3fe512a08ebed81fad0b8e86
SHA51212bd74640dc6610962a6cc0d54126362b032c59821a1e0b8e6d961c4432cbf799b7c1a8c08ee1e1f00d871856ef495cb530d3437e3dc9dd144d37171158a802f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5677e2a537510041259a44d08f7d2cf05
SHA199e5e4fff56cd6b137a303efe8ceaec3d90a6e23
SHA256c624fd79a94fca9087698634590997d7877c5c760d72a8a17bcdca7fd0aaf3e1
SHA512fdc65eec852a4c9cc5ec944979c8ed68317473d4254290b26d5f0d0675ba5fca8f4a8dffc298de244e13b103c1567d00813890c7e22449109617d3242a8c4069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d215bc8a2cfcde3fbdcdce9e8e2d757
SHA1efc2c0170e62a46b1ffe9db6b16cb0b285ee12f2
SHA256734e889240498fff556afae198c883e67e42f616eb5b3e3a5e12f5cbbb8c22fe
SHA5128f872fa5c8aaa66f2c2087a1eb5ab6832fde80aa00a292c0dfb6be693d7d272ced64700f1c9417525193b062247347ba752dae6b2eabf30d6e0edc6819702cf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c9b79bd0d8475249b139d2f709fdd6d
SHA1ed9d9dd557d4a1ffeb450e96ca187910bcd97b2a
SHA256c573b8eb7386a0c17d2486d4632364941f5bb546cd13361e8f082304cd1680ff
SHA51267146e00c53813bd232ed12f07b4d3f4214e158dc506bf23484ed4248f5fa8fe39358110c9c90b2d600c1bce912116c3c5f50bac33bb0583df3641e18279f530
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a814b33c66e33fc15ab2267e4dc9190
SHA1f7178c5855338e9116df9d19ad0fddc9e9d42895
SHA256c0e511d58442b7d9a79043b37f77185433f2b4aea5e235284cf62d833cf3898b
SHA512228a760848747dcf286f96149ace561ba6f38780aa0962937187dd1ba243c78082ef0e21b2f311e0223eeceb9c1388b95576545020ff19c1dd308b90e2c458c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faf9aee29040d5a46051c8eb0507b133
SHA16e16f5fd9e66dddbed04d3cf217b464008e713a3
SHA2560cab793e9dea95dccbc23319e96ecf41f865d715d9e1f8483e2928f335d590e9
SHA51266fdf946234d9a3fb77198159b4429e2399de60bf9523cc8cf1d00ea74fd6600df6bea587d290b04f3bca9da6345f570208bd310c1d1ed95842500a22e16e7be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572fdc52bd3f0a260d77c575dd4c78607
SHA1f80a23b965b45ab882b1f03a6e466187ad1d3e66
SHA256cc1087e3bd6c43db6c828dd6d6e298981f4983ce31f9436695c6fb471b87d352
SHA51293648cf7c896eb88b9344618fcbd22db7beada6689562d4009231bd10c58e00eb26c49df8a717ff9d9d4b3d9928986d0f0c2a25528cd9530ef7911a633b512e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9f01b4500400b180a4d91cd79688ffe
SHA1902c640a129021924490a88e2cb18781cac621aa
SHA256b296b3e0b17713c1bd0823ff17107c0da1f20360e1ab3b34288f0bf9fd49d9ee
SHA5124ed036f995630698ceaaae109e3864a36b746cae6013d376f4378fb5beb94b1f4e9de7372c4bc4878cd0ba2aac2f4be65f388a6ca6acf56429cc72626a09083c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f97a87d879fe387993b3d793799a0c1e
SHA12ca87c95c0bd56f566aef1b5c7cb3c8baf7c755a
SHA256a284a67752aef6820f538b25da245fbd7ed7076090ed0f42eb1619a842df660a
SHA512252a275c7ac543b9dbf2a1900dc1ce945290a8c594cdad8a9a78cedec59463403aa02be013d55bab8536b34389121e909928dd3f5253130a60e0f6c19c9b395d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa1a4ea4123f858b827f200bc015b668
SHA11d7be54c6f3c6e6df06f9e7ebe88c5fb69568cb3
SHA256cbaa4d126910dde0dfb655949dd7a8a29f5b4415c2ecdc74652905734586734f
SHA512d9b4b3dcae4a47ebfc16ea0d27a15db53ba277d880d356c1464e7786847126061e091e03df0992f61f0557ec71449a8c815efb1f91ca516f869701ac13ee8f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de12547ba88abc8dcb6b9fac83fa5a3a
SHA1e6b99df3a19951b59ff612b7787ab1dd5f83c4a8
SHA2567bf09dbb46ef9ebfbe80859d52b759c5cd182d2aed0f6fdad9160e433e8ae1ea
SHA512dc95577c1be0ce7a172b73d3f132e70e7687da4cc12c7b1f4e220329f8562eaa951e7b1a7cf545f19cf3c2b7d77ce223665e5953f42a26fc059317e4c5323a11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf17d125e60254634e13b579a5743529
SHA1692ba296037b8fd593a0e14d161de9ee556d130f
SHA25679f01fd09dfcfe2e8f144868745c006e87ebe072a23a5f8d3be0f7759bb47df6
SHA512d2e8d8b47cf242a8619cd8f58ef149fad58ff8dd0e3d43b339b81e800f22153e9a5775fa9b579e1bbdda30191a99a35dadf67162c9e2bad10b71326bf791fe9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4f53dfb905efcb7ebad7c14ab5444b4
SHA10f630ee41d85827e32ce6242abf8b39b442eb544
SHA256aac075cf7c99f48379023e821f09e6e1f2142aa3ad72e4e49ecf5c879a2bc3fa
SHA5129ee517c990daf5896c1b42dd0e32bcc3a1d422dd3cf25e10c38c580cb439b6a9a3c696a4e48f29c17e86789da6692537de140f0897525afcbc85dfbf8f183dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540224772aeba2f154b832eb43a6f6c91
SHA162024b397d71aa3ff1c324fdd103843f0b88393e
SHA2564c7c085cc6e9df083a2d962faf88658782644f229d7881168c2e139b49f05d85
SHA51290daa48b6ebe519b14839d63975520f415ed1c13ee90a4de3a1465fcbea9764f8f9b070ec440ca772ce2006c51048ab91119a5def0942b535ef4b4e762c9130a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b