Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
367c1d2205592259f56b761a294bde08_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
367c1d2205592259f56b761a294bde08_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
367c1d2205592259f56b761a294bde08_JaffaCakes118.html
-
Size
122KB
-
MD5
367c1d2205592259f56b761a294bde08
-
SHA1
09ba6747f88a0fc12f1b05396dfafb03c7a5186c
-
SHA256
2af228950e48a78bbadd4a4370dc9b955f7db69516827f6969bdcabf48b95809
-
SHA512
ea9832b709cfd6e184d0ac55b10f05d9e146a543a82a9eca708a37b9653a5b97d04707cbbec9652f921423ac5cc04bc746c183c04f87b857425266f8eb0726ec
-
SSDEEP
1536:SflzlgVuW9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTE:S4YMyfkMY+BES09JXAnyrZalI+Y4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f022309711d3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000283c89371ce4ccf242e2cb26394e09e352f260f40ba91366bbf80b94f9387d0b000000000e8000000002000020000000da21e2f862a8b91f8430ba37d717c375185f3e75d009491d700b9252ed39cc81900000006627c2f117fa4bea6322e12460240582948ddf4001b85ca4eaa80886dbeb87bfab94aad0509f22aba51b4e3a0058c9b1b51e56d9546bfa95b8332e75b385d6d2411166421cc975975ed8d461b8ea2a27e8285a4cc36fb501a590b1b1b12ec7912f5a797df79111f07f39a7932c2da0d4b4567196077ba1aeaba2cd2b9ae5fa2ee14ed257b26bcfea57f90fe35cc4c28e40000000dca42b9c3a3a0d26b03e073ab57490f1c9e659aecb82d1cb9025fbd76577b25c56b5e8be523cc4acdc401351da92dc53f020d553773aa31f44d4bfe1f39caa9e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000678b37453fe78863a0148c03d20783f144ab77e469354eb01e5254ae1fa3db3e000000000e8000000002000020000000839b3634357b97658caeb6d160f45cd8a94e4abd793b53aa2b5c94b265fa86b520000000bf53e71180bdb1df22dc555c3726b2a04ce0b10fbcb1ec519b9149e8c2070d564000000080f30bc346f7d09c0d3607f3f8085eba9bc02de3848dd6d5d8bfc1d504bd4d02f3f27e1a6e1d9eafd564cd6e903cb11155c80405779ec1d1a8b19bc2db82d4fc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8319D4F1-3F04-11EF-B49E-DEC97E11E4FF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426809278" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1956 iexplore.exe 1956 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2696 1956 iexplore.exe 30 PID 1956 wrote to memory of 2696 1956 iexplore.exe 30 PID 1956 wrote to memory of 2696 1956 iexplore.exe 30 PID 1956 wrote to memory of 2696 1956 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\367c1d2205592259f56b761a294bde08_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5ca4fadd5e609c18ef6101790ccf5f5
SHA1bf159f54e7eaf4377c1c09684208e7834f01097b
SHA2561c87c040b83d9871d513ceef678764d20e22a65f42ae92d50612104fc31aefca
SHA512f8ccaf54c69bb9f0b9882e276d57ba80c6055fb625b257447080bd13c2d28026d61d4b176017bdae2ca4a48f1657a27fd301f54edfe11fe3cb56e442981fb37f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50741428ec5836f8f66d46e040714b7d4
SHA1a5258a7ec0d36ed029cb50500f6bf97c6b4aa18e
SHA2568130f9617d19d0b56a35ff5d1d118e32986b06c44d80e6657e63545cf796ee67
SHA512bf0d706a83b0762a239f04faf5e144cbe119e65162358efba7733d3243b34f43d42c0b4ca2e0ad8db5ccbfbf36064762797da639c285f8fbf294a02e3a0147e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bdc463d701135038b1e5aeeccb8eae5
SHA1249928a433bb47ddc1ad7f5b7997502c73f5d858
SHA256d763f47d86671ffd27e885676fbadc37b87dc4dbb78be4eb98b72b9fafdc9884
SHA5125bd0cd79e2bc788282b3511bb8930c3bbeb239800960c2b0977aec45f7da28fc6cf680f177f3003bdabb23bc7c590ff9e11005da6bb5997b67be06bc36eab45d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518397a5919c67d33fad1862a367f7162
SHA11e61ef82af023ee04c3cf0014c4778cf77870381
SHA256e491e3b9a108ad094a7093ce8f8c765a9a609f776c89ea700a286cb380fbeeda
SHA51262b0d80b349f22b7fb82e0047507576fb4fcdf3f4fc06b2d7c221bc825b37bd6c602feac8605a37682a5d16fd47c73855c4fc9b500162cafdf42de7233a4a259
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558bf2f83d8c5e0de92f8a1e1d36c8348
SHA124d4fa58165bf5ce8c2223f3c84fffefc16d081e
SHA25614ce42f06632bc3bd13078816ebbde13e582fe368288007a0a2792ab728dde0d
SHA5121685850ad1bce781a774ce7b1bea75b4d075974abb2e9aea0df712f50459d163d635e919fb9b7e41075a6c686be6f9e7a03854383ef2ee204d35bb1f16571600
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1f03964862f5f0b696d27d5c3e8dac0
SHA18765681d8d841b6c582179ea4daa83a69a6cc154
SHA256391c3dbc41dc698bf5a9798833a5ee8f562c18aa279cc7aa745d9c83be497a71
SHA512921a3404d2489bb200166f92e14d60d59de0e713ac785c9e0bc1740f47416b125041f7cf83b1fb50b10427b7f06738680b9d95e0f89e36b5d76cc1405b5c0f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e1e3f08397676b03a59aff794d92511
SHA16f25d4af85417a17c14a2a88b2922952f0eba084
SHA256046d2f23f3beaf42a54cbdcf51f35968e6ad711fd750dfd85553591683bba8e1
SHA5123f424edcab470968915ec920d7ac3d689f9cedf24d10157e4995de7f2fc16a536067a396c889a915318d22d83fad5d5d0e76dc64253313ac57af330fa65f670f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1b41bd61000c9695b6510cdb3d363a3
SHA151f73b5f9c5fd1c0020e3a4083199e441c5e2be0
SHA256a5fb885aba03d36b2dc3f73d19197b4c1bef121459848ae6d721c14228da169f
SHA512ddda2303059c3d8cf83f7d712ae147e19fdb4370ae05c266f57fcdc0664258d8551f2c358e4da2e33c9cff94dc1eac90ed57b0f8bf202eeb1bcd93ccb6df9a46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562cff857fb9e9c535de1c99167017070
SHA15a3866ce8d76bcc9af59108eec83e38de3953291
SHA25666e313d786e5829702ee1d5e418598f6fc097ae3d3e9ef02d7c2dce172adbe74
SHA51258df946851f2116ad055f1a1bc7bedc27d524670f0c425d85bda118fa62f330be6e7cc5ada01e7965569d2e53243c58f37ee746d39f30567f010c992ee6b154f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa738addf0a703c9a9c984476ee527cc
SHA13792ffdb3bc34600d747f87e335eade8c6a1b90a
SHA256cd49f8c4fd0f1e696b6c94313ceb1a9b33a90a9a5dd5c5c7700e0dcd7360ece7
SHA512cbd9850a2914ceaf6bab59811729183bee452d734df3ae00c2b9e3fffb73301b8c184e513210b2c412d7185259509bb2180d61430104084d24ea12f44d4329f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574b41b311167c4c948632570ff00acae
SHA14c68ddf2755e29afe1847ad02d0a5deaea36e680
SHA2566659253ada371e7039e2d82df3f34c81f42b0330b31b1e967e6fc13fd0b0b1fb
SHA512e513edd240cd188ca85479ecda6f93d405cc69c752e7ca8eb8765de21c361a62742ea884835cfbce2f215c546a0580a98c83ab986b67bf730a9abb9065128ceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549227ae0c11c472d436c75c32b942802
SHA17cb5de9f3183172794f50186b7c6915d8082ce30
SHA256c27f8cb06d6754d30cb7c3b792c8f7835b9d4a40b1584ce5703d9418b5f2512b
SHA51233d0253aa5cf2a24e638724f1e257e8ff07370092d2a2532fccc624ec55d8a58ccf582b911cee9ff665ff23945d41dd68e9212c9fa4f1f61d639b984c26429cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554b0aec2bcb7e6379c1873620cf7cc50
SHA17e114482fdde1648f4c1f6bef491b8d88bfc5db9
SHA256bd7563f3d81c1083e520f478199cb3ab9ca2feaf66845c1aadda8de0a4959e25
SHA512e705ba0b86461cfcc6def2335475e746f6b99171936100df0d3acd227a91586314abd0058bb93a1dd139761ae5973c2136d8bdf6b24a2b0a99cc17c0e892381e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b10ec42b092d63c7780d841b0067b244
SHA14a96b3a64ec71646c3e594f098bc718e210cdfec
SHA25646b797392cf7f13e77e21a07cbf4c73f2a079908b801699179d12b2f8ff11294
SHA512b1e3f0b052312b7cc4f823d80e8394bf81ca26d7e6af9943d89f169b4f07b1fef66b6c34da8725281d40c8ee9674554c4a0a2050e4928f520abd1b995cd02969
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d4986cac420cd6c226b12f9956720b1
SHA183a72b2489f48658ef4da826ba52b2cb5cd0ec32
SHA256429cc17a802bdb860da8c05cdc239abd373ff2e81d314d95053aa6a8d83c42b7
SHA5120ddb90d3aa57a8f863517c53a86ff82bb12a5a4e22a97a6e687b25570698fb3eafca9d7e0f451fcb4c4271cd63b1e74dad172a69da7dfcd4e29e01de137899f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bdf94431009df0ce7621273bff28e8a
SHA1334cd0754ce1d0ae1291792317b8fa9c6c1d7bcb
SHA25671e4df77be5cd94691bb2bf5cb67854477c9b1f18f5f6eaff58488258318623c
SHA512bbebe56ea66bf60fd9c75685221bae8846e3a5948271cc91027bc9275db0e271a2092ff868b7870f6e42c741b49cbe25f1bdfff3b19bb5c7a4c1fff0cf70f90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b