Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
3a33adbfed37b6c1c776b11b94d5ccba_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a33adbfed37b6c1c776b11b94d5ccba_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3a33adbfed37b6c1c776b11b94d5ccba_JaffaCakes118.html
-
Size
6KB
-
MD5
3a33adbfed37b6c1c776b11b94d5ccba
-
SHA1
dd2723e81a0d836bb9430778f69ce3ce6aad9ef2
-
SHA256
186f72992367f66a3e05c5ae505198399c2f350e9f2cbe5360f65de86276bbe7
-
SHA512
46d2f5a62799a0da6cd3ff9c7cb95f32e4f1843a08c2609704f13c9fca601c7c6869bedda1baed2a16aa2b883de39f3fd02644fc2356ccd6188e161507ac0bf8
-
SSDEEP
96:uzVs+ux7w2oLLY1k9o84d12ef7CSTUKJ/6/NcEZ7ru7f:csz79oAYS/14Nb76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000d46977c8bbdd4ca6fe39348703cf21963898dc4e51b1de3dc13fcce0b1d7370b000000000e8000000002000020000000ea6e376468a2d914be0d5f8169d18c0ea9a9aec111e3f04dc7db01d1607c9c8790000000a6347d834a76cc97abee5d3bc874b441d01b3f2cc894f6fbf69eb666b0f3d4e3f518f95787efab6e4ef8fe52cbf81b10e3bbd1d57d8441badc634d38a049751bcee448ab52c2f036d047850ae310d4d4c34bc2a923b8122dbbce604283e0f3932e5da117b0b07604b94a87136101d426f665d9220a29ac48d1a03e5f34fc7d59325e974750a4478b25d70d38fbd9e9cb40000000ccbb90c94f6237b8d38a918baca8bb884d8811e917a8bffb85cb4eb76e0fda06e351d6333275a92e26959b6e19ec5ef06ed28ea9b696a17556b0dacdb982d876 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DABCCF1-3FB0-11EF-90E9-F64010A3169C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000371252637248c0394b2bb3626e8fc1eea33fa4c2f43b36fcf13daf341ecf163e000000000e80000000020000200000002a69bc915e9acaab51ff5cc984e76889f928142a7ca3952c6dd158342ddc71cc200000000d8deaa7b90c00df852a9edc3a9e6f659ed59098eb3ddfd4b631eec9c52f33fa4000000024192db5cdb083d582d1f9fd8defb0b65375de7f7cceccee25c43395ca7e2878c6e7ff521913dd3d0e2ea6adb680f3eefae8522915379c7e1a09d4525600588a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1043d62cbdd3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426883032" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2500 2088 iexplore.exe 31 PID 2088 wrote to memory of 2500 2088 iexplore.exe 31 PID 2088 wrote to memory of 2500 2088 iexplore.exe 31 PID 2088 wrote to memory of 2500 2088 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a33adbfed37b6c1c776b11b94d5ccba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f56cfa6d48317207e65a984d3ba4735
SHA1dc20f0de1b18bd0d7a5978894ea80022e609407b
SHA2567b50b01db3667f6b5aa276b87906986d3d19aea29e78e845905b9ce1989b4ed5
SHA512948d3b5ae8989b56c0b23b3fc6e8a0ea6ad5c6005f9d62c312488c3505fcf531bdbfa67a34fc2f052e2439a237a4d9e459cb3ca0c90d68495778d8441860a36e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6dddedd4a1a59a770386e08d9e514bb
SHA17079625f15e1679a9cf03a92f4854e375e0c66fb
SHA256eb4eaa40c475d993d4588ebd15f682e16449abf7ea878ab3b418f74deeb633a7
SHA512796904f4e0b9cc2719a66a6f319aee1ae657107bd2ba36a3a3093e83db76ad00570070b6a8e7a8cf70e963473076a6a624b93116540d75dd4ca452cb4a5c2c67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c857af241a16720545e536172f83991
SHA1903f0d4d436308d11c268e07ce0bebd8306ed106
SHA256e7c0ccb4885d61b3960993dbaa92ddca2b1c6a10e39be76ae0765f256ece4a96
SHA5120088f7428647c2c50a6111b7d0bbaf48541896c19d85017d758eee82f243d12bb8693617727ae0af4ae656d0b96e18c867af68c19533d785180786ae9e9650e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bceb3622126b86b2db3e5803003d542
SHA1e39c66241fafca6c6acf910bb39968f87b41ad17
SHA256f352bba8b30f923bf0e6c320e8d214ff8f43a3aef95b8b766666552bec29ae83
SHA5122e8209e86828bb22b22f7f928b5dbf8d0d034fd8de064f88a15ea395310939481479ac1d596ae3a12997ce9b24c7fd9778f7a700caccb0af86a3d4aa8d281087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b64c5fb818fb9fb3cb7ef5208f7dd8a0
SHA1c3a71d4c3fb832e78afa93c3d753225787c98c91
SHA256bcca30395d62c31a0563d07559b6de8628decae8a72367b4596f1be16b77b8c9
SHA512d2a6f1d4e0a0d39a67ae98bdf9442a63a9ffdd1591b829c1114a93748b509d5728a98dcdcee09234ec9065da2d727cfa0ddd570d17d1673527526295a68b3809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f75a9e5b6f10c1d80b5dce3d387ca9b
SHA1e23890c1dde6a9a9f968f2154ed6498335dece83
SHA25623a89b80c7a41625fb2c13f203616a71941922325fabdd5e6afae57d8ff9fc25
SHA512acbd7859c732854e09b74349dd080fbfcb7161df9d45a9e7bfdee457acb20de68fcc2b008f822e82e4aa69a34eb477db07019377618aabe5ce5f5ecf94622008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53451eda931abbae608183293609e8f58
SHA1e85b1f420a6df4f78eb247819f8dba2f5f2e8a26
SHA25654899c240c959b71605cf56e195d3e5ed097c879b4027c4e2f9d5f07daccafe3
SHA5125f5eff890b761c0eee55b84155960799255a202bb8b60aa76d49a2c6280499bbe75b119c994ff5b62df501c4e6fa9e795369fe29f61025f0bf6ce12cee51db16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e6adf63a9323be3d9ae630a5caefdc7
SHA165e702937b2d97aba1b35a169be8166a3ef59580
SHA256cafaada5b28199b1756a611ada9cf172fdd40b189053003f11708ece1957a3df
SHA512f8f0f778f23c0b2e7aa14eca2eb96bcfceccd31533e1c239bcac1069435ae196c915eb414c254323c020041db074d148ae658d4cb58f393c06e7b39519f6f95d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a53d189456b73d7c3177ccd0d9205211
SHA19649c5fcd562d17f94282e5226117c331ec9214e
SHA256d3e2a09bc0eff8e1959c13b7203c959150f2813c7360ca36cfcefaba931134be
SHA51247eb36b2f2e3311f2c2b19764b0612598456a3e843ca59e6342d6bd71d9c8ee8cb8d9b2ba444f9b24119a3c3353d437fc8edce91fce2b359b7cbacb052543987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51896c6c01701ab1b71353b1fc6df69a5
SHA1e6a8fd7f792e65c11d5b4dc9c0e23bc683ba1a30
SHA256e81df5a39bd1c538e4a0c9e2e4c5577e1aea8f5582aea7fd6bc35221bf2d8d52
SHA5127fc7bcdac3ffe7c2823cee427b7a627dfcda14a1594461027c895c30de0dbb50140d2530780259376b6ba957ae5276501066ad9b9e0e13b556c6c65275344797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a0b6731763d37c7c3e4bb9114226bd7
SHA14918d9f6da1bb89bc27ffaa95ecf0de853837c6c
SHA25624b41264ec83c82e38ad4a7094f9cd91729280084f2b2ad874a35dd7b28b32bc
SHA512ed8e6ea35b82945f52161ddf50047ce0aaf876efae44f1c97fc9c4726622ad2c5579b5fe68d4bff07a7df26aa7d1df46673dfe3cbde90a6f4ce4591b77425dac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532b492a9b07810a352d923630457ca83
SHA183f7d35858b4485c5653d5dcd55c925e9a1bf093
SHA2562ef5bd43a130caf19519322a929fc5728f74e5881c2088c5ae5c446e65dda4c5
SHA512204dd093852137af7635f692e94a06f7ee66c9cc2795c8f35aa52610b5613f09a80d3b8ba0aa0c3b5febd00c3273393d5efceb60115b0132774ed2e7bbec0dea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549c57ea779c5ec9d67578c8a9256701c
SHA14c317fc9ba41596c1af5e903d1fa68f099384853
SHA25613c8bf395260bc69a38c1b94be6fa2888534067dd671e146fb8fac1b56024664
SHA512981d951353214197c22c23138e0b6ac932260c87c7b55b73f6cafa0101f0e944b24f522e8fa0c4472b4e4f3230f64cb3b7a10c68bcf689842179a3309c190ba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c20d4ffb739bb55be18756e9572f8b3
SHA101cf821e1ea4cdf5aa78773a6f01a3e82a465b09
SHA2569865bd061f9d004194e484e8e4e667562864bacc35d95ece2b52192dfed9c135
SHA512b6ab0a569f6471a947aabf628588c08444911209b94fcb0ba53a0b6a4e64acf385915897970140341e08e36f3a7a4cf6c07ed161741bc73116c3afe46e5c7aab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5860d1fe87e47316398ffea80b5fd5fa8
SHA196ee7456634c4f19ea8432cb1fa44d13e1f25b7a
SHA256569ffb36da8b960bc9d58fca8aecfbce0916e655f1a9bd96a52da6d8ada2f2ca
SHA512266d3625643cc9fe49fabd235f040151ebfa5523c6f0619831a23aa70882f74e88ec5bdb0c4a6b376a4526a714a9b5d2ed3dd4de64f75b5e59855cdbcb79e7bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57662a97ed4cc9f22caa6d18f207292b1
SHA1b4545323d37e8f03fdb25c8d1a1363cfad83563f
SHA25645361a587bd6eb445502a2f4e54673f7c60bb799327204d55977a4135c4e1411
SHA5129f95214402437053be0e1d7a5adb8717506cd9be52f4e03903de88f614392196dc1882c37b10760b02822192de7d095e5f1c44d655f40d2b0a979a91e8259c7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dbf7a2c9888f0cf08f68cf899781e25
SHA197b0a75ae9414816758d92a32707f6f62f4fddfe
SHA256bd6796e80b2c3e5ea7bd60214d28fe6895da1bfab0223f51461b87c7c3e0139f
SHA5128398a568fa0767e45c955a3f1ab28452f586d53d5a17ae1a0efd52355c5fa646871c7dcab89f43a6b91390dd1288def3d75ecaa4dab20b893d28917e84b8f947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5619bfe95db2ddc6f1b110e308445f1d5
SHA129161e0bd3a24016976055bd001ba9561add7826
SHA256a28b420971fcde277e07627c97c4a4c4a1c59463eb01eab90e97e68be5fdfa8a
SHA5129a125e0caa4c8bd3ea1a007715285dc8435e83e2e18aece178025f13dd8721ccb34a583f473b845825ae57b4f7023120a2da18fc16e373fc4176ea7e50747342
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b