Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
3496025c8009d1b2e0f6efeb6546f7bd_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3496025c8009d1b2e0f6efeb6546f7bd_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3496025c8009d1b2e0f6efeb6546f7bd_JaffaCakes118.html
-
Size
11KB
-
MD5
3496025c8009d1b2e0f6efeb6546f7bd
-
SHA1
ff021f261722acec68ebea82101e5dc0869303d0
-
SHA256
4714507dc9631a91e7119a5606b9327eb07c0482a11d0aeed1acb718f42b8fa7
-
SHA512
d98a987612dfd2373aadf09d1ca89f6bfbff71d0e803007ab806b5fb7c3a893a967e579daf7bd56e955c51e7d1a420ed46d89f9f63504fce95d86f6618d490a9
-
SSDEEP
192:2ValIsr0r57M4Wxa/T8I+/w1wvqa11AuBuLbdU8d:salIcIQ4WxaX+/gg1AguLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426773988" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59CE45B1-3EB2-11EF-B4E2-F64010A3169C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000158b762b5fbe5c01706548abfbec575173dd17a48045a6b215843f3be519ad57000000000e800000000200002000000039beb938aa75d7b59eb94ad64f8164814757618ec29908f27fa8cfaac20b429a900000001c72167dc0d35fd07365ec23191a422b4d67ecd6cf5719b120db22538a18c69ab3ec8663cdb9e1d2653d9a4c4346d9f704ff4330af6c12ee486f71f918e56851e921906eb0feb432ed0de266a8bd7eb32d9c7817df540e81eaa71ade289f98be4bad658611fa80234fe384ecd44f2bf58f2feaaa1b52fc51d2badf1dc734f8a7ab17546bfdaaa034ed8031074d0f983f40000000df4177185d52864579d8a40cb790862c06778ec8e48d481608684d8705c7e38a4173f229ed93573620800277688b5c8dfadde348a559c4921f125cbe0c611dec iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07f3975bfd2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000000ef358506002edad5d3e79546e8e9d48973cc77c2978677c6e1b07acf15765c9000000000e80000000020000200000003708bbcb2dac3e3a77c64aa3666748e9a4ddad026dff076abbb8a39f05cfe7572000000016669f855b04ee13ada1d5b4680ef2fb1f0782a8d6c80585e264784765a8a4e74000000067a6105ef8ab7fd1f666d27a41210d7d913761f9a6246cf7cf5c9d1b9a49c90410b53334877878bacf9475665c8e9bc0e2ef42907a6734fc1895e7eedd65dce7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1780 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1780 iexplore.exe 1780 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2680 1780 iexplore.exe 31 PID 1780 wrote to memory of 2680 1780 iexplore.exe 31 PID 1780 wrote to memory of 2680 1780 iexplore.exe 31 PID 1780 wrote to memory of 2680 1780 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3496025c8009d1b2e0f6efeb6546f7bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d056fcfb9154035a3520d1f63174dd96
SHA12cd75a967401fa19eada8869abfacd55c3bf1da3
SHA256296b453247846ec358daa45cdac2d50970c97aab2f88752917db5b07e11aec40
SHA512bb2de98b703da7db2b121ff03e5ddc404ef07ccb37d2bdf0bd71d4f17fb2d7e8a09d724199b7084bfaed9190e0b829d66465bcb43158c09bce10e427113eea5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6fe514c95894c6f083b6578115d3312
SHA19206cfd5e367b33c22d415347c27749b095ce293
SHA256a15a3e9231345157119e65c70c07a6cb390cc741e0e10c203471542ecd64fef4
SHA5123422b8355d52a600cc1d3fef42dcd68b346590f661e85471b72248f25013a3cc024f91f1491c43b3074816a45fcdc5e15eaf6625466bd71b44f390740ad73b66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fa01f0f2202900a3e205fe01e2ea6a9
SHA17bdf4aa60a1cc9194708b00c30e8d42fda0728c9
SHA256a0c6ea592756489595b371589d09bd285d95508b497140792f55ac61f613f07c
SHA512a261316cd14e73bd2834810d4189d56a40074ca08add43eff0d08386e1340821ffbc92569e81d27d179188c5736cba8ce55c5a429911db3d3894742c04b98b78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a427e9044068a9382c832f929963cc32
SHA1bbe040cf8692b29b5acd99766bdb7373dd4d0b44
SHA256c0c84420565b9860e36a0c955abc79d637ac73d3352380569ef918cad0674e79
SHA512f99c15d379d7f5ab94bec357860364269348c427a356cdbc1c3a00317738ceb84bf2ed256af8548ae238e94661f8d8840f20f5e05293a08d48823dfe283cbfc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5256d946a1222eaa503708dde9d0def8f
SHA130812a5e0f86b689c7703f82d27c43a5fa13d78e
SHA25697e69ad723c795305cf608b7a8640b2f6a768e62bb453d3fc13792687ceeb1c5
SHA51244f723403d8f01d822097a5361e63d7b07575ed5bea64ad8271f1d1aee9e7d15066771697a8fd36819c194b23e6958ca307416bdd2fa6674a85c3405f039a751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517faaa95eb022888bdb0583c6acf98cb
SHA19e58367cf0c1fc4d6e824738a792e96db44cd3d4
SHA256bfb8c2a5333855b98dc32e8ac1797fc8b3a04812a6822abc4c42196c578ee7cd
SHA5126382b9b5404e486fb6a1a2c5114e7ed2e39685e8bf22c8717b534f09c2c3ae6b7d3ed24cc4fe3f05f1f9220d4c383350c6588a94469343223faa4151cd5cd57f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54120af0d91d18ba86dde280b2ea826f1
SHA1de93888350a72c1b636d14b53e523a7e4ba122ce
SHA256b193831256df08593b99acfecfe3fe0422ce0a2fe5e6ae6e3312b0fae81ba628
SHA5122b09f61d895de631e5dfcdd154fdb8b7031c7d56add9753e80d7d95f96ce67e16848e496ae8bf835069a596edb0308f571e02054976979702be3ccaec95514ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcd83138f653e027ddd1619245295beb
SHA197dd323c815535a165e319457e4946f57d6610be
SHA256bf026e58be533d5cc673263c4b8325709266c5ac179260a27047832d6d33403a
SHA512d3635294f72d4b965bc46a87924452638b04d71d0ce4260e4f7eb2092db87445f44851e8af1372625bbb591c90246d5f9fa552e6b3c910b499fb1ea182b4c116
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510f7f53ba92c5eb24422e925128767d2
SHA12bed6de527f062b8e79c6801097f09ba19be5730
SHA2566e23a0dc781a1f0d3080e237010b77f4458154c3563a083e62b36eb0fc76e4dc
SHA512e170f9abebe04b2d00facb6c83cb6a0b5c951a18aa3ebf8679dda89a59ee35b64de2fe5631359f5c926a0d51a69e20e95779e8545e09e2cc92dd5cdcaa83d811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaa81e8a7367fb0a46b55218a661fbe0
SHA1f02024caa9119f611a4f0af76999aae04bc1ccf2
SHA2564466ca29d6c284069c3fcbdddba74a8fab6b9f0d23a3b39f2896be335576bc07
SHA512b38c27fcc6265e4f192bd254cee7cd27e20c64be12f2af678d96ab8a082d1c7238b7888cb5dc047c7b3b8f5f2aa4dda46d493f79fd5fce5242215629a3ec027b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570f5582c824de9b8ec779cec7c1a65c5
SHA12df1c365f162f62d83196891bc80f42d722cbca3
SHA2566e10940fc9fee2caeb04bf4419a0c93ce3bd64e4dac5e59b574eae0fd7b443fd
SHA5123f289c2af3bd375d7a7ed7dc928a59de2d362180dd7b18b8824a18d5bb2b30602bbd0011a6f57d7da641e3d01bb2cd261df2c846bc59b1d3fac80a7683abc765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aede869da3642593872986f70accaad9
SHA197dea29ff05e90edb18d089229bfc03f274ba20d
SHA256f022ce9d453d712bbc8e909c36f84d68aaa25c4a4b472fc57beff28299454779
SHA51298f3135b7f30250fc0a2ccf6211aca7d5f640b5a0fa699ff314969ea04e2f0772d80655cefb44f6e13bfae6812ba230da959d06c5037e055921d35bf41128984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c827bddca34a1bd5f9958997c3b3534
SHA10a57c957667c1a174f009a70c4571db33eb953ad
SHA2564f9e2c5bd40c556e91b4d0309f655768e7b8b60f7ace334c6a41d22bfb53a145
SHA512592ec10fdb4572e18f1662ccff4f2030e1094b0543a98272441f8ee769eaa67beb6f125ceb9e95696619cc1a96e1218a44062caeba416b46ba4dfcb2d13ed62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540b6e4f1b2f1840bd062daf6df113339
SHA17fc2df52ca6fe6d8e839cb352ea2a5f50ebabe26
SHA256dc5e05f106ad0625d21978646820d817d068f862f43f9e0689658816d4f1d744
SHA512424955b4aaaa8c4b2ac05c901ca5ed2948e730ba2576ebb9038551ed73f657478e2e392ff6246fd49aa60441154140dfa825885cb6b42fdb3ce5d0a417ef3f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516ad797b8813ba56cd49ba5972efbcd5
SHA10bc2833b3483fd68d2b8d86c8b12695149e1e257
SHA25604b8068c2183cdd03b771a939613e7acd3180329f16040a415798aaf05dd5e7c
SHA51262d0d084f82c603dd68ff9a66343af3d5e4e0cee78624fb7e4367ecb9e43991a97d533ca02679b8b17260b07b5d89c6e0cfdcafc1d3c6b0a960a2ca5e386339d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555c87bd02415794b213ef841dea45de9
SHA1b5b82fa3dcab6da86e7bbe40b567f1421d686617
SHA2563315214136ab78f993abc934ba5eaae174014c417efefd422511ca600a31ccbe
SHA51235bb9e8bf4a57b330a866ca570ffb66fc39a5ea6978461f49f4062279b5bdbc5cea6064f7af02e3d7d6f1811c1e5d06be77d85cef70fc50608deab8b44f624d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a012595c658b03de71dafa5572c2fecf
SHA15204b300dc35f8ef816f60899957ad6885f55e1e
SHA2565914536a37c3b8b3d24cd779740ba923e850beb375b2571d1f77940c6ca736c3
SHA512af68f43d9e6de1bc78089bdc7aa17dcbb0d33aac2f5293e3579b6dba914327d93bceeddfc4f957466032fa539721ff81968bb06eea5b050b456c3c341648b6a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c97fec57c8fc6336ac40db7c9f6f835
SHA10973901997fe7299bfecfe37e19e13f425dfc59e
SHA2567717a331874d73d65b2c0f8b4951defef0257f4bfee05a84e422a4df56fb9532
SHA512d4abe249340f63253ea6d388a4435da326fad0867a943aed08fdd15b05a299e67f6d864d0fc0a81c73286e4b9cf68696a9a7aef9fd152cbeb02d96344c98b220
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b