Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
3841a5cd02042b2b9b790283eaca9cb4_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3841a5cd02042b2b9b790283eaca9cb4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3841a5cd02042b2b9b790283eaca9cb4_JaffaCakes118.html
-
Size
38KB
-
MD5
3841a5cd02042b2b9b790283eaca9cb4
-
SHA1
9760067d55704fe7938e7ac25ec798fbb6b12696
-
SHA256
caf07550f17c6eaf54d18fbf44b21fe7cd0f077be0a83d27b9a92dc6ea53620b
-
SHA512
af489847ab91e6af7ab3318fecb06a93df6fb3d5b02fc60563123e24aa49b9cada98a1a73cd030e0dc269ac9470cec91389e6e64fc446abbb9d35c88dca3880f
-
SSDEEP
384:SIZJ8LxmsCyp4KxYWZt+eTTip2yeHip2SXr9+isU8c:Slz/ZkeT96Ngc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426845696" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FAC5521-3F59-11EF-826E-EEF6AC92610E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000b1c4efb0a7531702fb50e420a4b9a2d6992c3551d67c8091d462d932d34fa01d000000000e8000000002000020000000bbf1a4ca321efefe4f115a0e0df79be43ef35538030dbe630aab2c4c661cc1bf900000007310601abe7ebb4ceb21fb9a6dc645f344d2f12fc04bf3cec278277809303dec0450bf80dcd61ad7fdde4cb010656abec80bfeb5464534c2ece527d3affa1022f4f5ec5139118ab98234813be33bc0872ece58a2d4c66f4c3f8491aa9d853725a6c091bdd5dcc42fb06716709f80d611a62bacf57594824edd1b15e46b3939df02ad37c1609fee3fb86d89afa4bd25c54000000090e7e0e653fd1e395e821cbe26f98b5de7d85ec0979028d3936f867fc4723a9a962fae43f20b245f31e376e8eb0351cc701349e7ed4d54a5b299c2ab31f982c0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e4b1bbfe72e3f2ba70095a840a8c0f530ff461a137a60da047e0a0c4490ad120000000000e8000000002000020000000324caf9879387b974216e2535573cc7fcac024d92d4c3ff56574e9b1e88ef95720000000c8c157ea6d65d75cd08c797bc6ba96e8e08de80a49bce9d7bcf093f638a44a7940000000755d28e9deacd57051000e56c33fa796a0a55b01857d7871dcb17fc35c854f7514e0ed2c8c8622a620c5b2db0807b1701bffa962283cdd21181bd296dcaa5577 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305e413d66d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2820 2164 iexplore.exe 30 PID 2164 wrote to memory of 2820 2164 iexplore.exe 30 PID 2164 wrote to memory of 2820 2164 iexplore.exe 30 PID 2164 wrote to memory of 2820 2164 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3841a5cd02042b2b9b790283eaca9cb4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae031f076a1683676cbe531605080f13
SHA1ce347c16c4bf4e29629ba90e7692576b41944d79
SHA2566e6b6543f7d4580375bd2f806e64a38e821ea66d8afc99eb691600001ce81ae5
SHA512dae148f902cd5855f0d8b6d4450e88b0565059f420bcf771cb95ca050745467eb4dc92f8a0b2c3c238ce320ed580bdb95d6ce4f3568d4b83be1c49dfa2930b3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53db3cf6157f16115c87ff1197429af87
SHA19fce2663af9a96dabaf3a44a263a753363a5a87a
SHA256dd0744f5a6cf673488191d9838de68dacf5ce9ed4a00f51dfdfbad92b8391d49
SHA512648bf62d3ef508b28bd357f96df0f36c14b5f54d15d8fbfd468e049911321da123ec16a6349e562b3ca74bc82b50f94c05527c6f92f2841abad060603740a44c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512a4cd01a85167a61962ef867d321103
SHA17577cf0ea47e2dd2518084c1a7a1672212f4f3e2
SHA25614391d3933a0e1f78003d80865b36141cc8d0b78f6740d5d921cd38b1a7acadc
SHA5124760ce46d13f538b3dad44867c42ca66b9858183ee6123ef247ffcda6f220cb5aa531b879df8850f6bdd0b491eaac212642fc191480d770de454d164a0366bc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512dcfdf84d9cfac2584c254057f288bb
SHA101e564e1f008bb4a6a4fc2419567ca6a5918186c
SHA256cb8a433bfa0ae8d00b3507b30d4e2f570a5c90eb8f59b68cfabd998320535d7c
SHA512b1f66fdd9ac80b59779136f2090d8a2f156dc7eddd4634fcb6672ea4139eaf64bb0311bf18884b8bc535a8b47ec3cfc0eb123871bc29612f71d2fc58dffb13d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577606085f6494b49254769b052570b59
SHA1459304982ceedc431f525f30f3ebd40aeb152ba1
SHA2566f5d9103ebceabd2af454ab8bbaef9f0909998355978001ce7c5c4dad545a4ee
SHA51285989bc9b7239327f344eafd8d3159ba670fda9ede0b4fe0b180f158599f9246fb390688a6a833c64a6a5b20bcd46002f93bf8c19c64e29cc489106beee85988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c77c61204ba1b159133400b16bcf663f
SHA18f16720c9ceaae8fc546a2ab42f3cc20ab8e5975
SHA256def5acd4ac754ece7e74f9e2753ccf131c3044cd1c46377c57f7039ebefd8284
SHA512ec3a2e46808fd22fa9682abdbc551cbc49990046fa6feb073fc2bb7941173c1de4ece70879ecfc3317414bf2d9e7b2b1f4ec54a889bdbf5e5345e64a09008bf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53814d88a919697d1568e09de61df67e7
SHA146b2e6af639f89c2e4f103cd813028a94224d29a
SHA25699462da6827b28499ec2fb8016c0e52aaf839014be767f87eafb787759f6e354
SHA512e813f899277f708eef9e821207c4144fec00945e7080a91c065d5949d0a19ac9eb49b525a2132ffcb5afce623e26b10fa6ec8d9b8341734cdceefd8b749365e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56959b64aa8e33d8e6d4c17bc90ddee9a
SHA1b36bb9eb60205fb3d54340f2a01a976f06aad34c
SHA256f131c4d202143417a8be9c75bf89821c0846b3206bb7af0aedd1046638228447
SHA51274c9a5bcc5e72bf61678f65f1b81bdf69bbdca3e3ac0da8f3571e64488195875854f0cd50d1a883c049df74037a83bfba131fc696b528125332d72b00801a9fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4c2fb8a5b67aaff5beec8f02dd302c7
SHA12260e14564f07ab2feea0e71760f232675b3e87b
SHA256ea9cec26e22b2bf653aa16cfc6d732059c667769903408eccc643ca7df375dbd
SHA512907ba1f50de7be5e2ae78ce7f90f1e8c86ef25413256e2d6fccad02a868e1090c9d616c774afb7c8c432fec7729efddf0f28448eafcd3120b1e080fb1f504836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551e192909347da588524d0b1948656b7
SHA1d9d0b26ebce297a246dcc30c5c2090919a6363df
SHA256ee03aab6a3821b38905b583ef23ed004382774452c15127bb1293fea3d0d7f78
SHA512e3c67a2f9c62ed910657cc68c31e52c02878635a20b2f867254e785d908a7122756c99f84154cf93ae7de6c9c1d58e0cf39cdfbe4a61af301e2a7b6905fb2e12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577c7eed99e24bc811ee26e7a56ee31a7
SHA19dc0a323b4c3322b41e8154ef4d1459020ee2f18
SHA2567c80b97cfb1ed93963a30ef65c90d5b5b8818ee1d0bab7d601984cc1ab5d3712
SHA512acc24967569b28d785c2741ba941b35526fe47904b3d809070e07cabd8292fa77e61f4411d6dd7ce91f5de4b77b6b1eba851556aba6d6a309a7713a57709ef60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebf04b3ca365ce8b11219ca8618e193e
SHA153e47d5854459e46e77e906cfd13685fe78281c3
SHA2560eb549365e3161e4202202f1f304cd1178ce14dec1b5c101d64ae8ff01d1304e
SHA5123e1c8dd935be6dc51ccf206203916f0a0d25e4dd39715feeaad885e8da6004f17bf2707959ca3e39012bc3471ffd540ade1ba3a5b7a6aaec0328195cb260d6b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558061f3eb0e2a1283822ade643e14a3b
SHA14f26476ea40bc8b2ba3dd53e9f2d82c4e44e418b
SHA2568b17b96b894d02edd5c93c80dc529301bc18519442d65a8f706ab5af42da7b30
SHA5125c0ddd5ce7778baffb3b08b6feb355c6ef38f8c53f4fd060f71d7537412d859e03fd983b421e2e5ee906567f1fc9ef60e7085a00be61c0381db16e03162133a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b947530d3536ca16e1cf44572385dff9
SHA1d05f130bc3eb8d575ac878c771ecd430ae75ae04
SHA256da58aa0ba12b657de01da72b78be3abed94918dd0bbdacf2c3dd11d2270243ab
SHA5121ae6bdb28c653f24f02cf63247f366670acf3a1020de7e71feea6e8dd2062f9f7feffd07e1bf08badeb52159793fb1b2c972b4699e893ffbc565df9694d44b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b9c808228b690e44fe4b8716aeea04c
SHA1dc40e2766d813e91d620e9f910f6b95e66bf0196
SHA25642c49ae8c601fc50889fae4084fa5e34f5449df6196792edb271a697d11b30e9
SHA5125d6bd26327daa671daf24c5c1f4324ecc3971fe8930979f1a23d40f53f062ce888d4cc5ebfa2a9880d9c716b80ec41e2faebb8912886e3dd0ed3815e425d86ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559f9840e08b998303b45b885180f0cd6
SHA121c6710ec0ff9719ac87b5295ed7ef0f1d34e5da
SHA256724fb2e918d0088ea331fc9f166622fea38c4f8795042239efccbafdafdae3c1
SHA5122a36dfebb11cd17916cbcb32066ac2d4477c1e09356b271b49b52bc53e6c0713c6be9cb8425b020f5bbc83c09accdaa72f6ba32ac503614697231f94fe39556d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c6698f1fa6bac3eeb2e4eb4b1a93f8a
SHA1455a1588ac272db593a1c586bee00c23ea14920b
SHA2563acf7c58f4db77b38902d971854ada7bb979fecaa4a0fd76887bf7e6b18f9d14
SHA51286248b0ee3936919ec54e1376c77c958ce5abcb5d0f58f37adac9f09f25edac82254163905df2c6d1fb4dd23642407061ee328a59242ccfde410868bb88f6424
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59574c2ee1dee81ecb4151cffe734c0a1
SHA128f971591ca616a71bf3852a4a8e574497267466
SHA2560b620caaba009b0636bb7dd6b69700543d0334e00aee0676e15c54503954d069
SHA512231a3e0c118d0ea2404e664ae0d515aa79cb99a49cf46d6ef5d855475d6c46f70367c7ad93d6eef112ebd8471eaef03b7be3968771fb017269f29a5a458285d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a107311dbe9c42e953380afe7bd858fa
SHA1f398cd67349ff210e144be2fdd29d1b7f24d1d05
SHA256394578a191b374c5a4dd94f9ad002b5df191ffc018b7aece52221e54f44c957a
SHA5125267fe80f09dbfd21fb0413cceb074c8d75cf3118df66263d2f4bcae136bfcdfbe92728cce1ec302b7dffde19f1e6a28742a5ce520dad72807e7b295b0672095
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b