Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html
-
Size
38KB
-
MD5
373365f76c6a679ab2e1ef9cea9d1286
-
SHA1
081d745d02a8427d782d21b301f34943b398f81b
-
SHA256
3de8d23640a2ef6fd99106531650e16c8a80a96bf24fe5ca4532f8bdb9fbe95a
-
SHA512
e8c89149b9fbcfd7b291017c92a0f74284d377998052aa926f5ace06be3adf2d0ef4a22437a7b1e7d2e27ed5776bb68ace970f441934e1e9469ac3568800f1e4
-
SSDEEP
768:FdtiEqi1ptIx3wj4jQbKD/my/XwGhuWyd:7tiET/yws0s/myfFIR
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426823234" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000009c1f02a0226ec17ee28c06e1b6be143d537536d5e8532faa8b9e155aa9fb74ff000000000e80000000020000200000002c3cd7b5ee30c10c102b22b487e92c2b641a7077b8baeb8a668f5665bb1150c79000000020cb43395dc3030aa6d517905cc9b84219a493b6e3b844d8b1579847b77152309f9c2d2fd6fa40d69c8554f27f40fd791a90dcddac2262721b96c89886733b3a0eee3f7705628135d0110aa910b3dddda131d449952b4bafd7e156f67b4df2fe508d4473251aed77c67bbfba373362c2eb378c4d3a013653bb31cd77f7b4714d89512b1acc50c6745daaf229f6da3b93400000006d93b9e71d8ce0786776e590382ee9f00efa6de4d4501f596e85e849a38c591d45f330508afef7c1860fe3087c11db44f2b4427835f74f80365efa6905b47b32 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000001a5279a59a89c2003b5c43799975edf17771d9e716a11955b43698ff82b17ca0000000000e800000000200002000000047320d506c11b4ac89943432d3493a2ec87ed7c12e6c3327d18e5b03dcb51e6220000000becd3133aadd9e2d53dd4b0fa940028281eebc4306c57bb3876f33f0c378dd8340000000c319e260715991399a031992d86954387b5ca53e8f3aa2bc919f05959642eda37da5d374c59468aae87e3b20ae519da331cedfdb9f30f51ffcf8f479fb8b4247 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{014F5961-3F25-11EF-920C-D692ACB8436A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303328f231d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2540 iexplore.exe 2540 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2696 2540 iexplore.exe 29 PID 2540 wrote to memory of 2696 2540 iexplore.exe 29 PID 2540 wrote to memory of 2696 2540 iexplore.exe 29 PID 2540 wrote to memory of 2696 2540 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539c00855d8f56f0f3755132c9f0b8def
SHA1bd0726a9d94097ad109da324baea126e148170aa
SHA25669775f4cb87783e6b8cf103ded1abdc55791e0190f18d2929f65309805d6dfbf
SHA5124df80be03966da2c14223aac803fd258186b8274616c76f2a5061368b09420090c7000a3015dd1de3a1e6f2083118b5f6fe593c3593c429225fd97e9930790b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e129e5a0e888637bf7f6a73805cf48c8
SHA13b414134a9b3e24bfa985488e13104961656d3de
SHA25681cab6af9a2bc848633685c1625c00bb954f2682aabc42e5e70668ee7346e41c
SHA512acdce8ddf514873ca06f6a3f6b6ca97d789f08f5cb7da11e96a02f1454c611f93ffd096cd1326fbe0b186c25f4243ee407986b3dbee62bf8a05ef7fb26959bfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513efc37ac2f18a49dcdc69ba7f3db851
SHA100eca0b17f665ce082cf217c9a586f23a4986a78
SHA256c4b7805bd7bd8ac9512e05fb6986ddbd4385ad66f45c76d04902ef82e49dd27c
SHA5125bb2d98e268f4d71b4cf208f04446dcbe27d67a6c304ca37c01c3819074333710425eb1f4638b12845218e0b227374d4718c73c92069426e45a42fd9d203cc79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d7e852a0b76e3de52fbfd20a619e008
SHA1f97da8d3784820de6278f3f39998e3f0a422a95f
SHA25615d2dbdf9f41408b95770838a888b1b09373eeb4d881b3ca2d84322ff9dfe289
SHA512cfa5068c21f9f245ecde156eea8a60db21d671cf5a77c9d8aaf91c6bbe1ea9abfaec7a9e1f9b39b96cfea4faead2fe5a85b2e9f21a4d81944d6defb784174385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb123abbc7ca5dcdca8a4cd42aecd0d0
SHA1721f9c7ee6a4e5f7ecddf0e85267275ddf0b2626
SHA2564bd1dcf781527e401f50d057b6cd31b36bfeb85d64d58aee06cac3307270bd98
SHA5124df5c7e37110b526c73efc064e7f058ef3c3d0c26102ceec49f2ac124f28c52aab7569cf13a410ffac3a5008d308735398a809320ae65be445101043d663af52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5879e1f09de5eea4e57db9655a11cd88a
SHA17eafe574c21a052accce590abf41d32394e30321
SHA25692ce80188446ee8c6289cdd640f1078d723f32a052a9f9ca8034660274d43c8e
SHA51261aa3b4b7acfcd2e69035686b1b9114152911e3dffa6ba635d0bd4286c68f088fe58611ea042893d92102a42b8978ededd17c6744a56b6e6bd844850edf5983a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f176bc7e9ddf3d2b7d2cd45219fb5ec
SHA17d2b3c1430f81838bbe022dbc6d053396895fbf6
SHA25652df9a99ee5f13f1ad0e816b32436c451c4b8d031f8fb7444aa1ab93214428f8
SHA512873fc9d55e2bf3e0b31aa2468a5e340fbb7f2e17e1e6a7f00b3689c4ffcdb5462d3e0d26f016997c98db6a1cc435ec5a45e786730b90f1ab495e9107efbd021e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e1214b7b6427ec8da6b88b74c5df1e6
SHA1f4644a5f8fecd3485f62e1f9367552f245ad7f16
SHA256afcfb3e80a8b96f50c1e7f7b08573c5738e3a9221f91281d88997fdac4112409
SHA5120c6986a504f066ab1b1a5e9b7d6805d9d8dea421e1dd984b7511dc8019f6fb5e28a26ba3d024d002c33eff0bf346b69e1cce8ef74f1c8c67d66f7894ef6f93a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560b21ee079a8f0e87638ba12f049f8ec
SHA1f6b8e8c130e0b36daa2dc0a6ff18b1f76352c68a
SHA2567f8bc235746d07574eb608ffe28281773ffc0506da809e24c7c092f45d783a19
SHA5121cf1617a42a75e4b0b35313bc920569fcf19a6a1a7f7e0c8b950fd10d179cad0b33068332f9959765e25bf5d89d3f896605a4446264fff87ceaf6e6b0a260c23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d235f6d8d015000f6142a793a21ec4e5
SHA1c29df0ba2bf0aa75e4a086b56711ca22c6fe745a
SHA256995da6b8c282926206427ff674b39bfeb82badf58ca7fbd1ed1fe6e26855d0ef
SHA512b8b7a28ce0977c136f069a613093a9943df8a63a174f5d9e3d6dc58425ee76c085407eb105ea69263e49cc7a6cfb6564d3552b3e265d09cbe3ed0a1ec98a4fdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57368aa4102e399af2533ae77b582da62
SHA15f6a6033e32dc832d8e2438e7986e5ca18669001
SHA2561cb537c8e5c67925f3aa0bca852a5a72a3bb067573bd8d13349d78fae5e56bf2
SHA5128bc2d1c73dadf62ccc79ade52add6f28ccafbc7b0e8e056906701b6a00a21f48e3935392a48c772e7e6cd78097ec7f910c09a3ea12765b8844ed236bea8d1d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b5883b71e5711dce62095d8892978ba
SHA1290ea584c3e43160395599fc980e9d279590eb42
SHA2565b3c412da9596d2f2358b492d1c22c9aa0c17becc0898f6d5aa3a0fb180751b3
SHA512be2a66bf99ad1fa08de9bc9aa7bcd0b104a8f7bcab7e7d2d87cb62c669f2c1c49512f5477c3fa5fd73ecb2b6347e26d367fb8f67f2aac648b602b36a592bc0a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5157dc0ff1fd9f4611d4d9b8b1eee5f58
SHA192e79e6e65c5e35e5e59832966e4cfe5d9c85d8e
SHA256e16d2b9c934b5d2af95550fb494f5081ddde2c92b73498854bf9d13092243945
SHA512e627441487cc84dc46b37a3ff7f52d3b7d5a209aed10da5d363ad7bc5edd20cfa860f522fec98711cb7e3df7bbe24225ee33483e046f89d130635880eb7d6669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a83d33760fca11964f8c826db03bbfcd
SHA150a5c2f1967ab15aaa5baf900513ecfabf0f46a5
SHA2566519d3e4e696239e91bf16494d1159e52b6134f6a2c1a0d988a98810d14d4723
SHA5123e557ddec7400e8dc2e2c50fbc88f51fb3804ae76ff0f26b44614bc1f844b4ba6d0cdf743367b0c93f747cc3e54286ea381edde834a0ff082f3553ff183d763f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a3fecf8aa8676c2bc123acacea17fec
SHA18124fa616017fdd5961bdd7aee8ed433d2ef6472
SHA2566b70d75e92be3c2ecd989df8f636855ead32a30a506205955d1cf5e95214b9ab
SHA5126426363b9f3c0bc02d80354994bffba089535424d594770cadb9041caedb2bb652413f7a4f044e60e69fcc15d1272ecb5c89f037aca142a7f4a3726a7879c60a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52560a38191e5d2cf06072e61135c524c
SHA107bcb3f25be460066bcc69cd26e9b6f118618efa
SHA2568a2c4876b7b48278aac290fdd295be598ad8d926a657b6fa49516bbc3c7c4efa
SHA512c1fc109c3290ab99f4c5a972ef924cd1ffa24d7666e89beec047e7b848775c918e413423d730a755bea8a099eeecc0735a39865e5fcf09a5bb187a655ca3aad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8e5a8d25fffeaf570ce7dcbd3bc4887
SHA1655110d9981e998ec006d5aac7e243eed9761f17
SHA25634a5df03c473dc86b8619768f753c7de9d8e25619975ec747e75f1c752508832
SHA512f2979fbd222033b0e9c480959ac6d013e7dfc2917190018a5fee65fa278279ac12d391072827a5d9e937ff31fcc9da96440026befaea39cce6a0a79966f645dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5189148423fe669e550a5e91981b1ecfb
SHA1bcdfee12e6be23bb8e735266690d7637379d6225
SHA256e455763416bcd642caa22d266a75fc4bc4777ab27a9da442b6810ba0a704393e
SHA512d5c623fad5d19953edf64997f4443744eba3017247f084abd3c84d6f85359a0a0487d24da7baa798c810726c1439b3a667249db601c18d1ccd1231646059131c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b