Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
378d0b52cf876e6dc7424ac48914ad83_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
378d0b52cf876e6dc7424ac48914ad83_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
378d0b52cf876e6dc7424ac48914ad83_JaffaCakes118.html
-
Size
6KB
-
MD5
378d0b52cf876e6dc7424ac48914ad83
-
SHA1
5468c1f6ece557170429794491a9265f1cd88c06
-
SHA256
18b2a5355afd7a75b238f6dd29aa56083be99617a282493ab671485def55c223
-
SHA512
3a773a6e3c208ec91058204b22bc2d956ecf9579e7c40e729d95090f316888f2d1c8a289522ccd670206050bf00165d062bc3f0e31e718f3683ea8cb1463b3b8
-
SSDEEP
96:uzVs+ux7UDWLLY1k9o84d12ef7CSTUiZcEZ7ru7f:csz7UDWAYS/hb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000793e0d3e689b50489c9f14cc8b9b864559a0a8aab140e123843613bbf22eee59000000000e8000000002000020000000bb18eafdb6d274e023e923352467cd8d0b7dbb0d3452810bde4b9bf19b4e52bb9000000044b2ea1b00c678ba873c30a8699c078f30d81307e0ce0d858ca9fb4541280e4bdfeed751fd9d2e4e9fb2bbfb652880a594c925517592348463d86fd44687f13998e966da9df50c27280b4afbe47224f7dd18ceec6946bd488e85e5e63cc7307fd1222aa4aa94185607c67d5fd261f363453bfced53e17ed641a4e77a56d3eefb802a7ec2e0eded032a6aab342f98b61440000000a84b520d14579010c64cdb3be0b8d1b30857755a1a24a2b163d9a3d5d945dd6b783aa29b1f34af0e8dc769f05d2191836dacc788f3b5392362dbff92ab75c93c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55472321-3F36-11EF-8031-C644C3EA32BD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000046cb8c7d5b88c3d3fde083f84d6cfeac53cbf7e1dd9d01c270048fd68fc4ff3e000000000e80000000020000200000004f60c795cde8e15813be4a4f6d461a09c96836e67048a7532a00636e5126608220000000d9900c52024d04ae574d1fdf4c671ea3890307f7d47b0df3686135b062ff5602400000006acf01ba247aea045bdd7d3908b41e776ce3676d0876da694bbd1568dadd44fa2fdb9c90d95580cae506a6e0e81e06a4c1707088e1283b1e01c1150fe0fa16af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426830674" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7005542a43d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 iexplore.exe 1732 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2240 1732 iexplore.exe 29 PID 1732 wrote to memory of 2240 1732 iexplore.exe 29 PID 1732 wrote to memory of 2240 1732 iexplore.exe 29 PID 1732 wrote to memory of 2240 1732 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\378d0b52cf876e6dc7424ac48914ad83_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acc56a621d32f17086e7202f58cb60f3
SHA11cef92ce312a212f0868bb92ac34f5607d9e055b
SHA256f804cfff875a83f809c7ec54eaf6b9fef4ac524d6af2f0079278d5a23774a310
SHA5128af8637f8a59be5cc509ffb76c1b3edd54799e78420ea7fb34875d409f462a8490d5da51997e7fbbe1790e711b0318326c78d0bc948c062d9163759f5dd4cf65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebb745e458d5620abbe717cf79ca4572
SHA1487106ccd02e06c1fc82e1d369079c67711dc7bb
SHA256af8650ab079a2e3650bef822f42ba4dad245b9c39ff5da6c4e6eb8073d0a2cdf
SHA512bde33cab97f6a18bfe5b79e90ff4063dc5052dea5c5721cefc47644453ebc54f61c06cb2b64de82f3078cf18293e992b2d59047237c3626a976db3ac4700d3fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3ae2bd171ad9fa735f1e45a04e2bb7e
SHA1959514e3c29666575647699610096dbb5f076721
SHA25661dcfe5d9b92dc221bd1c0bf63565a8e6b14f5ec6c627ceadafc7ef9d5c26500
SHA512230402c9eb1a7e91f2a777edf72bcbc2490e940e8f67e754e9e7fac2f5d056d0fb461a1092173a1b0b7a09b136bb5c1e5f10fdf1c8572595514d003a37433cf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f382bc2cb1df93eb40078cfb08805b8
SHA1c2bb5ae3776f516228265ad435311afe2d0fa7e2
SHA25680d3eb7614d9ccb2c2efbb68585b0c224bcb80607f29dac9094495f96b147858
SHA51284426e6ddd1ed69f363864c6e68936736a6b3ae20b95f456fe56f48a63a89c6767582b22ded9df86687a836578b8b6846076592139366388b7f713d3ae3a74a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b80456bfbfd541527a5bb4073898273
SHA120ceb094c7a0ad1c6d01c2924eb4aa83ccbd569f
SHA2568a635fd45affaa91f315388b29b251b81e269b3f0a981a5258100c7fbf233398
SHA5128d09e33c1f0a0d1c341edf25424d5f306c60f93b028a9fd849b5b55468a5a4a00cd250c15f3c662dc03f59579b8f1a4594a5d7a9b0863bd2189cb3e081411cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d975e29a0bc2a8aeeb1ddeb9863cfcc
SHA175b80b2f27e631ba1e9b597c8f388e35ee7e68c8
SHA256cedbbeddf8a047c43ee99e9193385ab5f40571227fb96d7703ec53dcbb2e23e8
SHA5121aecffc051fefeff576c8b834c2b4e8097e83e07552ea46b2f756406f106579c15cc8cf865408a0c27d6abb88229c7dffc033ef6548cc5789f17982786aea55c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553500dea6fcdc3ce3949977316b6e2d6
SHA1e2d86814a6a519e28f0ff9a09aee68803fbdb7d0
SHA256e00e4dcc70caa7fd4c592dc014039091148f6f96b906fde1909977de8a7dd05c
SHA512190f1a3fff4d05d54318ef5a3db4ea786027bd78c2d6557397d4d1b19e59cfdc8fc7bf4a2f851988942159b279cbe76130440fbc616cd90d99920235a21b65bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5292002c75ca08b2af6c93274a5e85412
SHA1d6fe2e8b44927d19fb10c70412bc9aaf4b308686
SHA256a33f1349ea2ad66d57f4495ed5c9f5a3496eac118e61d3d5906a6235f477d9ec
SHA5126bc9efadf62385262e3f7b3ee6e45a418643bd16c26d13d5ac39f110eb066765b2876080fa5d170248b12ee1e05746ae9954fdd3c8c60f014508516b3440e308
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57541d99c5915afcfeccb76f6d039195f
SHA1f6247801978abef9345cc333ba7a0b9c87add8fb
SHA256857e6095820ed69c0db00fd841a38466ae2e680d1b23c6cbf6de9b07c649db41
SHA512563a4320f4331eb3e7d358c035aca3e47c388d25f462b962a24c487207a5e358ad5300da8aa78dfead9e28bfc6c68759346b04a961c69893af36f0fc8e36573e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad331ac85028a5b838aee3f8fb4008e4
SHA10013d480776d449a80553bd23e2381cf060b176e
SHA2562050f610ab70eb798ff9d958774c27c2557aff702fbb701d558c617a0664f6f2
SHA5123c3144e6f4e30e3f6b28dc5b4be5818f5a40eb69985422c5a38449642aea9a3c99cac6b7a19aecc086eb39c3d700e3bc1416a09643691aa13ad70d853c5eb64d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dca5ccdc1b24b8f2979283b47d4c885
SHA10c90c0ef0a8963854e0e287b4dc9ccc04bd930c2
SHA2560055dfee00c7cd91ddf7b1deb1f534f4fe1bf42c6215d4374db5743c3d9f9d01
SHA51276c6614061434029f540dcbc1c6fab4e8310c7f82a2544dde4a32435622492254b63945fee10a99e64128bb045b32be5fa9a8e3b24af11377f127a459124ea20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec21e1ae81d03a6d84fadd4049e302a0
SHA15de2148973f4aa0cd87f10c5b9f958bd2eaf889b
SHA2560cb4e489a7d2f5a4e41e4a244311dfb1b2ecdd86ea9dc4559ce85c5a5c471e17
SHA512a3850ccb1c684a98e63765c1bea4478cc9b478f6708cffcf256f49691dddc55e97b8b8566d475b2282891fa98ed7f74385aeb7944e174f93bc2e9602b6f66edb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de6709c947c1cbe6eb136dad55e73055
SHA1a4440bec13168a020a7f1fee082b79ac94090d0d
SHA256603f47d4efec53bcd89ba81295813ea742be310fef218665e9748aefa84480fe
SHA512ba49e11513d9cc06ffbed53c3d0bf65c5f8fc4d0edd4cff1fb0048d8687ece1aeaec6bf1933f442929fd7c45cd65284292e3f3f8f777060cc806755d2fcbe1d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c9d874dc4e64ca383aba0607f7c26fc
SHA17d7ff0a4950c928dc8895897576d926a8c7f33b9
SHA256cefe6b5c9fabea5f146c046e90990b201d06c68d0723c46f5546e42e6ce04e43
SHA512ecf001549fb1b3cf3ecc265808330c0842c8c0caf579d94f9cc0d1ecd886c43162167e2e9f7f8b32d0297edc5667c1d10964d76dac4f294baf0fa967343effdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b48b13821df31f1e17da8b625c4b49cb
SHA13a6f7f3e69261a32d03eb9c6c4248fcd428e5a5d
SHA256bd6a22a8e8e41497b895629ed93d2f84873435b2680cd919de6554462fbbd3dd
SHA512c6f7891a366bea6e601c605fc93c790d2f1b0805687350afcbd6fd75416f7c53da3d6fd508d1fa9791957b190db368d4206988a9e47e12f84f0227edc0d1ed12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5095eb59271fb0b379bf0837c9247eeb1
SHA12af1e5bcab13978b7ee069c8d6661af941da7693
SHA25626ddd83f48ef864c1ba3479168ede2980bd90aa5de0931cd4cace1d3a9abe691
SHA5121fc5beeff165da45b1ce46af3aaba1859fdafc7300e8f4fbb3982965bcbe94f589b27b9267222bc52c220263bd8ee03ec0c00a9d5e0545874bcbadb79bf707d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576dd5c92d6e224ee2586a13453cc8244
SHA17963e4f74acb7f7e963c0fbdc47896a5ffbd8b29
SHA25668cf01e2620d700f779c667c42186c879874964d5f4a7234a2d41f2bbacc4583
SHA51213ecfc236f4eb1186c7185baa552d285a13bf8090322999d5ffb00c0844ad3722f058438f8de9bbcb71d3a403a5ea6d517937511191cb2078d21203d0a35ac69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5679c2103d20c97de677c35f31dea6929
SHA1a3ea3c8245500019b773ff8a8f5e15ccdfcbdd72
SHA256906dbcde5298f59e5a69e007dfbbe7ec81f3a561f20bcbfbfba8ff3b41f167db
SHA51286017ad49125d74d8cc4f178a61acd0338dc955f72089ecd257083198f8e87cdcd70327697666b820f9a3d785a92bbb96e42d456767ca0fd570298696a3abf3a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b