Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
35da6f00c3d1531d8c21debe24b40389_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35da6f00c3d1531d8c21debe24b40389_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
35da6f00c3d1531d8c21debe24b40389_JaffaCakes118.html
-
Size
64KB
-
MD5
35da6f00c3d1531d8c21debe24b40389
-
SHA1
e490a90cf1ceea3f60978e9311566afc0713bd3b
-
SHA256
cdf6192d8387e702e81cd7b3111036e076d7643244f107ea2b7997411e946d45
-
SHA512
f7e4a69ce393467eb1960ac9b5bc8b38ee99eca2bd6328d2c87ba56e793bf26cd40671e5173c32e937a8ca754e36b27759b10d7aa8fae7ce9c73ced210907eda
-
SSDEEP
768:Gpv/pXtRkd2B7u7ciJnwDWuzxgx4waiAyQCLNVDIg4rn9cvWHrylWnarggrU6xLZ:GXxgGavWHrylWnaBrUE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000a35f47955c93f3326afbdefe1b56d9698083b3aadcf3a45c65dd5727f34b092a000000000e8000000002000020000000358aae6fa1778ebac40e2394c0374c820d98c8cf2690cff5f852dd8e8d92476090000000d62ad6ffaf96e45ad9ad56b6bf9634ae929d178af81790fb00b2c0638144ccf20d34a1e68cb35320c9f9865eeaacd65f13c74d227f62b32da2032e74bcf30f1fa26b323addd1e843a039e5c60e7000e50a724c9a83c662ae9a4314842b9714d19ad4d40dd63a91d4670f6cb5ad24863d95efa9ae067db8d12e90398486a6a2eb6372de7148ffdae85572fdfc7b83508140000000f419fd10c9843adb01b2f0625c7669cefee44260fc83ba9326e87c8e2ae456de3e0aca62539bd6c3dc740de8aeb6841e02e7edad7471d0b66f738de703a3f975 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A7F61E1-3EE9-11EF-8FFE-7A3ECDA2562B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426797531" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000056ffc0d04f7c8141553fb2f5dc8d8c76ce97877aa5f7491248c09d8072022b19000000000e8000000002000020000000a6f82c371e7500dc390d00fef7bc0e852a9b97820af3b57a4a8d5dba54ed74d12000000074049d7a451490815a1014ca363cebecdcd3ff66d5297732a0f394ee48ac3ebc40000000e267a1d3a7c321807c17c3fb8cdc9f0edd659ce24e51d7b4e90383dcb8bb9ef3431def78ef43d7677d67b3a0a28a3f26f22e3c472ec1e479f4db445cd12a10d1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e31d35f6d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2832 2272 iexplore.exe 31 PID 2272 wrote to memory of 2832 2272 iexplore.exe 31 PID 2272 wrote to memory of 2832 2272 iexplore.exe 31 PID 2272 wrote to memory of 2832 2272 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35da6f00c3d1531d8c21debe24b40389_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5490f01f44912e46104f5ea2dcab015f2
SHA1170dfee900a2404fca1454b9c057e0380a0523d8
SHA256164ca764f1228866ca900117bc8b670718a866bfa5efe69917e20aef4fdae1b9
SHA512caa931bf6520d26245deb377e0c1032d69ab9beb267f5af0ec4d9a0ae55f94e281efb6b08c5bac46994f19ecf90eb4c1e2f494d8a567c393db05094197491308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e04e46c91b2a95a6c7f367304fd529a5
SHA1246be9c2ac64968ef3b3a9683c1d7f7b83c7825e
SHA2568168c37a61fb34f73d21afa27b6ae4c0ade6ba5adae8985fa20dc6e1cf831874
SHA51292b65e893f2439b07845b65ad0966fccb24f0ad743ca2db61cd0130fad550eacfd4a7d8bfa8d1206b6fc606ee9ec7f1af49726e9edc24e289eac2a06f885975d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD531a016baeceafa8d5c96b83e4114c801
SHA11bbee8a407abb28ea50c84255feb036c7140d306
SHA2563d52ca5aa3d5fa53a1b3eadfa5e48d82f4c338f994826e465353799ca3f62ca7
SHA512f0422db8ecc473167783c007771aff15ecd84b92bfb0470ed38832e0cb43d9f494793fc5805bb4c1a03a2fb1f99d7a887c371776ab6f42e57b907507a64d8fc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD551a4b4411f73f40933571eaa60a848cb
SHA1061d9d635690feeee32893fa5184efcf19f6b07f
SHA2563f96eff87019891d29b560728b2e6643d9bde420810901d7d70c9472eb0450a5
SHA51232ab715f94ba110000286b4d346ba2acc1ccd960c137031ef7a5fde55d3785d540a57853a172519a86edae7d1467816becf838b2a099f56e32dc17f1ff4e75b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD533895faa5c7996aa6554f52fb1de254b
SHA10d2f56944dfa2ea2b7fe7b134dfdd94f831546e7
SHA25660f582ae69683842ca59cbba70c1e41871b71f54f5dc44ef2a300778bf03b869
SHA5127f4e667c94fa254d23d261b95cd3608d20cf9cc99bb9bc5fa43c52182b7258f765d660c05c3cc704b4b54b56bef0ef40318ad8d1771d570d2754e5454fb5769a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5544f41cccc3ec355dbdbc4e69eb869e7
SHA1cb9c618818b61de85fb958a0607f1d90184e5603
SHA256a6d5dd9bd2b96ed9d4057f360cc186f1cf672eb9728f029863d3c846ad629eb7
SHA512dea61f173ca70326c91d879d1d42598647b2c0d0015bca45f0bcaaa0f7d544acdd32a461e304217e859b7ce7f600989b8677750e841412c4af9156313ce1fca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51248e5e31116b14ecd7b06e25513b908
SHA1093e406aa97dfff035559b044525be01d509c004
SHA256f2323b88d55ce6227aac9856403e03367d563cb064a0d6b00e377511c1032ea7
SHA512e412a12d4f9da3525d97859c7ba1d5f819ef72ff0682c96346a1595e43f8d034aae1d67a7a9e34681be454be7d3dbe35943bc18b4f91d81ca744dc414964d252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5362204b02ea5a4f0649413267d7d0b04
SHA1ce5755fed4a62a2943a51b2cb190ce6cab55c67d
SHA2565a5ef53e9b86716050aec283249a8a816978d42dc792cb3b7ef16bc16b8610ef
SHA51210c1183b8310fee3ee59047df3e9dff1a8f3a7eb068ad77ae68412de7ee103e17bf7ad7697038919304f0bdb1f3a24c118eccb62307e9437573423fefa9e22ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54ff4103a7cf5090a4ef985e108f47f44
SHA1f9d7b7911957e992a3cde8b367a47031a13bf693
SHA256991b63bc0c73964fb89e09a8ae168bbc71cbdd9ad5fe76fd9af144c7dbdd7407
SHA51283621a0bfb1447f3eef2dec5516898ad5517e42d8b0f568307d1c84be7ec1c9577f250d724a12b2acc0234e20ce939e7d4e205495e470644578acc450a290bf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57d81326a5f4d67d5219f9ce8f7ba8df7
SHA1f2abee9d8d6106301a9c99684a0e7f2e0bb8d3f0
SHA2569de028f68c6dc334ec64a3f9fafa1ad2c92ba51e9aaca2fcc635706423c62c4f
SHA5121d06f2a382fb9be3029f9140494bfe9e448f09efcddda6551e7048bdecc2a611e3ac923e073e460d9338baef33ed7ab42f6a95b0bdb3559b570aa1c4f47843a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD582a7c20e46c7aa47b6a47f1068763de7
SHA1a4bb820ba8ae8658123ab8728ed76cdd38dc2c7d
SHA256aa0277640607f9aa53583bb839ec06c1328afb32a7bdb63eb07cfb0d5f07fad0
SHA512a099b9acd4b8d3e4e7e09e8d7d5dd08800e74eb2055b63a6db892d5b837111babf115de6dbaae70229eff7ed70983960ed03b0b4f6739307073b31f0f6dda82a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ada506fb10941ba6659f3104400e428f
SHA1ae2c821bc2e079a86e73629ee56aaa67d4223fab
SHA256861b59c8eeecd6da7038ae6bcb56f8073c2f4aa635934d68bd8a13479356f65a
SHA512ece187e78f564b21f9efb0e4cda4417967c011681948daad5893a58bda328d40b74556f3d6d7f4f590681123457e01ba9b10b1f61b16330caee7dff4c6d6b322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ff8ffee1090cfd76e7a5b19ea2f0cc7d
SHA1ec48412631ac44443b4dc6ad4a75105c9a8317c1
SHA2563ab6c1d665e446cfc4bf58fdcd906fd38644b45a7c3c68b8459899eb2864c8b6
SHA51245d153e6afcb0f1001f6249958351b38069b0a00c763bd669988090a2a504c7c8523362ca30325b7c6d1ab41bad1ac954fdf87bc879cb0caa8718201eaba3bb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55b4d93b6638d3873d1cbe10cd4a68cb6
SHA10d416a9a37014a683a49b230da8cf29fb43d53fb
SHA256e6a734bb7c1a16a4d8d4ad12aedfd69de60a417ca1603f3e6510ec772f057c02
SHA5123f2f94e6bfa4e07343c82b9fb34ebd488b31bf31bdb21d35206e4518d425faa21ad5180d5a439a887f32cbad3c005c87d2fe4267c3c7bd4c5200585208064bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cf0c1f62a0051d53ed44cff4efc3d0cc
SHA1e64c8b553fb8026ca6d2391eeca6f5626d74e953
SHA2567d91fded61fad550e27c188aa6719bf71a0d5add7c0f71e6fb24e26ac7214faf
SHA512decdf2e8a9f6755292cb9e97b1ca1ca9eb1c85b1b29e02b40fdb3f23483130e0be19eba56d094072e4530d81179d39b3bc77cf6904d7384f908fd9bb5c61ee8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a1e72604354474ea1b1e99a4c2095f07
SHA11d72663695b80fba07665aecf22339ab6b68da03
SHA2569bf753a7c81cfd54e8070821ba8578ee550ad6fdfabb30bab7120b241c1b20fb
SHA512dd62680ab7866387d2185644a26df5d971d0892b9b1f87e30d4828f588730cae1f3259dd78b54f58692bb44d1e284a72ecb7af023a35f85162886e5aca89c70f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57ace6bf3a13e4659e36f01d69a43a1c0
SHA1c4f271f77be31c1c9996295379d9e6b9c396b516
SHA25633f34777a4477e92a85b56b1f8eb3d98657e0ef5dd46900360ef3f0f6c528f5b
SHA5129d850ff83e83b933d6cef01b88d9c3811c47d636eb96a8c17308fe1c1260422bb99eee6a85381080f57618e0f59bc165324055a8052a33106cc69ea7ff2b795c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD503846e9d31f6c79083bde404bb116292
SHA1ab658986b27d8e9de6930e11abb3060b9fa77179
SHA256cb72eac5caec55217b609b0ff09c576e2363a98fd18954968fc3a94715aaaaff
SHA5128e1c26fa308300328ef705eef760aa890143295661bd320d201dd7ecf6436a986437b6a7df9a88e7e5c9e9d9c15f3db8facac829dedd4b974c97013a8ae624cf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b