Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
36674066a48992e52bf11c92c8b784bc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
36674066a48992e52bf11c92c8b784bc_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
36674066a48992e52bf11c92c8b784bc_JaffaCakes118.html
-
Size
109KB
-
MD5
36674066a48992e52bf11c92c8b784bc
-
SHA1
77bc3a289b64f7e64301bdd1c548c87e158469c8
-
SHA256
5646bb834594e6e105c85a1759f3d127507b1b715b4b74718d6b2a329b7cae3b
-
SHA512
edb2c8f251755893208a9661cfdb8925128244e519ae577fbae9c820fcfa1fed4bd8100cde8532b4c561b099d8ade7493ef7a8cfc1a6bb3578f004f3ad4e88fb
-
SSDEEP
3072:KLjC5aFf2aKlWN9SQY4ThzEkHhTHS2uOFs:KLjC5aFf2aKlWN9SQY4ThzE4s
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426807883" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000009aeb558b05fe00a8c8b2f27d73124439fe60a350f3d6153e83e2f81e6c83b149000000000e8000000002000020000000c8011461e0f0bf9715fd7a81237c20b2016774bcbd878a9709bf83ba3e26e8b790000000bdd910f4729b1fe85b852009c0b81b698d3fb706d0ebd046da8162a828f193e4e44c4e1fe706ff0a56d32d3400ae5dcfcd9ba2984ad122191a17dd7d6785b52051e3d6d2f72242ae0b24fb9f0f5ba74dfc4ff968d948062b83a08cb64a0b0cd124277b683dfe05e3e380c444be7a3b12ff32963139a6585ad32d10d9e28cfb271d6c560925368f2b6f14fefb025e075440000000356b9e958649bd5800c38f9043ee12dc9fde99ec3f0f9623d42d795e2d9ff69d9359e45c6d51d7ee6f8a021e1c4e2318c4d1c01f09743b84efdc426f1a775a9a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08cf2190ed3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4562C9D1-3F01-11EF-90E9-F64010A3169C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c72d4027add8f69ad4791cc7b99704526846f7b01e047a4f9030e269033dc115000000000e800000000200002000000056b609c306002bc5b529bbe36f050fd707e303d3f72d975475e8b6fc6497f793200000004715ef521ab08d7cccdfdfa4198ab73ae7f63d65764398e576c389f40f0df2e840000000ef3b082b63b2b0084f51ead316cb2f3d19026fc8455c7d0f90828d7b1c33e236054c6256cde1fd285f405d7f8fc646481a3500b9bfdc47744ec175dd5a1b53ef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2488 2088 iexplore.exe 31 PID 2088 wrote to memory of 2488 2088 iexplore.exe 31 PID 2088 wrote to memory of 2488 2088 iexplore.exe 31 PID 2088 wrote to memory of 2488 2088 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36674066a48992e52bf11c92c8b784bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560f332cdf408dcd2a7031998a72b5118
SHA170391956d53163db6956f64c5125d5292feb845d
SHA256264b10c8db84abf19099c2b3e5613b04c101cb498a325214c0d4db297f9190e1
SHA51260fdb69845132d7f7ac446022d984c3220b200f49d954a929623367de7ff162a424b5c1fe4904ef5b0f96843c764aa1c7b063af27fddc92c34abb6030973fb04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53530daf9381c2b36f864c19380547d37
SHA1dd44740a18fdaf31ced3cffea554f1dcf5db1a48
SHA256ca3d4f972e35e6e95917531f9ad81e3104700dbeec42f3d7581df8a708189d46
SHA512fa56765e10e49fa2ee4332e1b878c19350f7ea293dd92aaf96fad84953967e1682d5567f1c8772fc64f8f21178e24740652dbe2708b3081d1de4270a4aade745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eeaf6ef9c1db65fe6c3ce69eb9cfe527
SHA1202f8f6d7df02a84235411c8c882d80bc683d0aa
SHA256a01aadba677764fcb526b6a072438b972a37475006c8938240a315eae0763c92
SHA512c261843203d3ee3b64c2877a9e2fe286a5ff2dcdbad98abcf2cc520d51a4863fbea5621be1d5914e8453a9a7f1b90173060e55312ce1b69b255c3cca0a224418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6d1af41f6754fe84fdd38bace8da237
SHA10e2bc0971a571b351fd38941618bc6b79c9fc4c7
SHA25663c39c32fe6a7a004f16d8555833be3182d496ffa9ca678c6054e77b51cf6df1
SHA512b3fd10546e60c4c1a7f0d19690da405dceb79371ea3d3fbb85771886d34fd8abe2e2e438409964e0fb9c70dc48b3d9af504f1838c029850454287cc6635002a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bef7509c961be146d3056c77085b5a5
SHA1817c91ef569f4951bdbd3c8eec74c9c9c2e98885
SHA2569670c96be1039bc1986f1baf00f0a3cd4486dc12bc98e51bc97a696f9b2a6129
SHA5122e2a218ce97a3b98c9fd5afc01f158e7daada83581dd15483ac90bba24833681cbebe87039aabb97737c55624167312e90d27cd13f84de738b50a56a061c975e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e5706b13d4241a017df3ef92cc66303
SHA1776b1b4592bbb3b6e89fe6bfe57b733d5f0ea0d6
SHA256a64f3a6c4b415a1c6bf05e0787cb6a7a62ae5a2ac27eaea3ee427801753e8df0
SHA51256c122c89648617e8229692b077a3fe00bcb4cd27fa022bbd299356fc6c6e114a524117325e091fd918b0f07679f04082ca4abc6b4928ebcdbdfe6065fa096e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b329f6269a97b4b219906a808b8d28e3
SHA14c259274ffd18039bb24033e963c67b91a4a6633
SHA256a290952982483096c5d8542ca78d487f7c0e561b0e700591b2062ac51329a9af
SHA512e950dbcc9fd7a6d364be18b4bc7e00474e396748fc12c086ed13ccf21d869dd0d0c6f06f20ad0dce586a8b73dae16de660fe390fb2e8400a1a28be99a4b112d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551e62a2b782374281c34d5bbf29260ee
SHA1f49b03fe32922fd1ded11002ba8239e74e999941
SHA256252995383dcde9756253aa5eed24ecbea55a39d31adc56bfb5a6bb55a3498780
SHA51208450caaf1f9187ffc6c7dfdf08f9f45502c39e66ab1a82075178dcb3fff8502ffdfaf8791f31db2f16ebe66d10744b162d833d40ca5277e7c305e8b86af2324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587f56ccf63f429ae328278b2b84d7dae
SHA15a6f2a122d54286967f9ec7b5bb171a4b2392c8c
SHA2562d70576106d1ebdc535f110e255939a1dbe6322f69a7657a26cc9fa88dc9c7df
SHA5125d927371fccba06335d8ec3f2e5ea3c330f6f379232efce3dc360a7ff048c1299aa9ffec8938b7244f0418781244305dd8d8058af16543069a71403afe3f02ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d53e0b5392e6221f7b13bddc4cd96e8
SHA1c62ac48e04fdbf55a0766e59a19d7a4d119f06a6
SHA256b80e32f0e638f91d1fb48db2279ac9ac9ebd04cc606aee0ca77aad5e869d5b6d
SHA5123d0fac91e8fd2b58dd9ba0b9830bf8062a37b2fc6b8e7671605f2d8ef8fcbcf03206f25accbfe7f550996fa3a6d7b82175d776f61b4bc462d031a86480fde5a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d79729ce15b9c6715428a10ddf42ce42
SHA121109646fe5309713710c0d08dcc8e0d2f1d0c7e
SHA25655bf5ed036c5d806c96ad07dedf496a76fc21fbaab796409d77f093669486754
SHA5124f5acc777ef38494458e71e306db99334db52f6f83b3a9af3959554351de0db939ba7b906fdec2fec3827257b444fa2778f524a8b14e8e7cf9e7a8b3051ff679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d357355637b4c40916ed22f7ae255902
SHA1b68517fae662b10a5053bfd9cf7371c25cf3289d
SHA25631852e244ae135b92b0a0f74dc866015526620016fa9acbfb2dce0b31457e346
SHA5128da4630237af08b2b407e636efe9bf6ec097194c6a2536d6485ad963079e4494d194f96c6af1a4449ec3904c5821974f0ca50eb0ee1fda480a3a6cb9ad9efa09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbe4925b4120131adf415a3c6a50cc43
SHA19e3a73024ab8b143e23d96c65771828cafbd8656
SHA256d491750d3ace60752e8285f4256c7d1b290c98aa8821020c68ef6161dfe9942d
SHA5120179dd1151664aacd0210c2e13c84adc788c41c9a42dcac29e4fd29bc1561b2629eb678ea1b6ce292a942c37e12400a7f660a848523f37accb59564e57c262a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50488be623758bf39572f77e66f7685a4
SHA19507a3242a60b7cbeb462deededa5762c2ac97a1
SHA2561cb57a55c41efcc2938c7405c1a903806a92922c8ae97e3862ea343506a1f177
SHA512a49a1413eb29414afaee4fc0a0a7e00d13c35a8e88f411241c3356d5fe03f89f1cfb341b8369ab742b847b3f6af5d56fba09b195555b3d422f25a011cecf51fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0db73f9c3600715e9c6ff700210dbc9
SHA1437790d37e15fad1a7136010a94530fa5c8e8b7e
SHA256cce5028a94a57c23596f52531b5ca765aa4ebd16b211da7d0b199634f77c7f77
SHA512f11c4df670619e6b258d44171c8f8d97795bab6a60cd6f5f688c1f05162f8df53e5d4b656e4ffbeb4f01767edb54a57afce9ee97ffc38a9f9ef45a532da8044d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57db59246c9aa705c88de60d6b3fff50e
SHA18d33d528a00f161ef2b72884409e689d2044ba0f
SHA256d5853f93efeb61ab5f781b766ad4bd4bd6a4a5cf94d7798c4f53c9601d2d72e9
SHA512d5caa56665492cbabb74c46d90d57abf3f915b6a7296bdad024c7718117f111110e705e67ad77f0fdd040677583e7588b2001f1470f9559c40908bada23677d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4d3b409852d2e8623c3ff24dc486173
SHA1055518305dcb543d9f16b00b9a9ac1fa13a6aa31
SHA256795bea9891e5c7a9334e4aae14bd60afdf4713e1b07989b0fa41fdaa50642a71
SHA51284e9cf47ad5a1875e1f576f7a144764a1a82f9e9e55a23c38f75479229013e8bf624b21cb0c23225692a4e7e18b3f550ec54e4d60be13db41014c127b4403121
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50db0c673e8055f0c0ce81a27c73fa2b6
SHA10e6242f34a210952ed153c17c705a96ff762ac96
SHA256b6022cf0f60ad319813e5f236a06b1dff99780d4eba6afd4c86a8bf4f3c3b0f5
SHA512e0f77c76930866c1bcf6181b0ba67b86b603fc2b44a6ebc8c80e14f66efb409d0d841f1306d35baeddb9842f5a87b6a1169a5c072c686d020e003f776971015a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9517ec10613ad07273336dfe3613ba2
SHA141ac3063ec3b48a798121af9be2cbf2ce02d2dce
SHA2567d87c8281627785b192d6c2473785d81fbb2219a277372063a12377c1688b2b8
SHA512e61e40a9ff484fc929115ef0cc41202af71053e35ef19c636930f379451de2948e914622ab3a5b17ee5969db03e4b7f3c88fcdd81a0035414dfbb9c43344ceb4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b