Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
3f0316df00332a1f952b6fd67ef460ca_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f0316df00332a1f952b6fd67ef460ca_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3f0316df00332a1f952b6fd67ef460ca_JaffaCakes118.html
-
Size
7KB
-
MD5
3f0316df00332a1f952b6fd67ef460ca
-
SHA1
15f418a9298f08bd52f4c860391d825782b314a7
-
SHA256
cee64ab59223c0c8315ea45787c0fd94001e5ee8d7770b7e8479ae48c779e1d3
-
SHA512
6a1bcabbb0ffe6c143f8bf7bbcd6894487ba2ebd63c571eaa68bf80736b8d4988e0358a1565e1cb5b1385514a5dc2e46098a3a2305d6b88f75b9c8fcc53d39e6
-
SSDEEP
96:SI3LrmTpidJVlwZ2Vgdy1KbyQl8+eaLjY0w85q792x244y4Sldy:SI3mTUdJj5Jv+BLcV85I2+SlY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B44D05C1-4098-11EF-8C3D-F62146527E3B} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000f572955ab8ac8f50d8dcd3c5094a76f98cd5ead94817aece231d3d4a10e64c61000000000e800000000200002000000092f736064b334b7d84957fb2e05824ed17e94a17edb8c3c6681125f8fe73eaa9200000004ea20dc258390d6a9b3bed73f236fcea100e084d164b6838dcfde55361a9faf9400000001850be0b1a1923c00e56f984e98fce5c8bd536cfdc623f12bad2566deabdee1367291d20bea2143f3e0c8250050487927fb551094f28477c8073899861054e34 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0912c8aa5d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000026b256332db239f46576f1ac1dca0d7d210c64ecbf077a54d1f0132c790eb32e000000000e80000000020000200000009deb10d81d508cf888c0ee7832e41ca2e9b1da8029a6f69fb9f4a021c425fe9b90000000d87d1190f97a84770df0fe5163435b07501eb75167cc29c30a53d5236b7d87648d2ec6daf84e53e6b74d3da07c131b493b614a9250c732a2fa4bf9dcf780a524cb9582cb3a41162d951541ed2bd10591509d80a7c249dad44ac73f858fb0d4aed3069d4a0acca699cacc6bb3ba259c8aa6497f5f15f0ace53c79dcf35b64f9eaaa3dc408c6c145abe72e6f8e6c13cea740000000a94a6bd1f8fa719b21295c2525209d7643f268f79eec0856b9cf5323a37c01cf5053c6ee18346af670124769c24bebbca9719b5ded7d7c91d9052650517f413c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426982875" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2776 2436 iexplore.exe 30 PID 2436 wrote to memory of 2776 2436 iexplore.exe 30 PID 2436 wrote to memory of 2776 2436 iexplore.exe 30 PID 2436 wrote to memory of 2776 2436 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f0316df00332a1f952b6fd67ef460ca_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555401696a4f9be1213cb45e8e217943d
SHA109adfb20c6cbf38a30ac9174234f1e8402b3bf5b
SHA2568ffdcf6e689f75a82d96129cf8e6042d1acc7f4fbacb13526b84b8e656c4bfd5
SHA5127e559880413ce5a9f29355985c25609d6d28267e119739529ae139d089a49291657d04ca84c95fa34a7e3217172c7672d9f0936a412f10bcf0c3e17b80f7085d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd0471779ebc4b834c9c3ecd96dc7171
SHA125bc76e348fd90e9dcb483f20726f8538f1a62af
SHA2567aa0add7184c4613437a1508737c770438ca9c0a7dceb81cdc59930c89fa51b2
SHA5123a4cd31536d65e0acc32ed7e1974fb8e33393c5624bfef64d1154a7834c2e29c48fdc7dad9c8f840e60dd97290a9b186b9df5954f1ebd7318091baee5f9c6348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de982abdf355f763e6558deb39f689d2
SHA14d5448dae2e3fdafccc41fdb19bcd165e8b736ad
SHA256cfa816aa4292b6a2ce994b2734bf2c2d4f9c129d28b5781b42a49bd4dfb21135
SHA5128854a322b64aedda325f945ef63f8f459ea41db0604170c6a9cf4cc6ccac6f9b6ee8d89a97dbe22784d4cb301056ee70a8bd0cb309d1f6ca570ee1ea0f54b100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c91c843cd6fd14e56f3182fc7769438c
SHA1fcf12a971262f24303d982cf3ef36212652b7e57
SHA25653c9c690c009a4bc25e265ef56ffefedb1d2d27d43b77a93d4877a179e6dbb5a
SHA512ae1d45bd93989ecb9aeaf0a9fd57860310579f868c11ca1cbd1c3e4c2a788a58e7ca4fa000c470dfe98a151b9290e45945bf288a94e6944620625b27810f55e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2f784083ab0080dd769a22fb5d970ff
SHA17baa272a74f68d7e4b484d0c22f7427d2b1f5e44
SHA256764dce3d18d967f58ed6ca766221ae1177ba281a15c9f72ff05deead9bbe277e
SHA512cc647644bef96a0ab95c9aa8b6222c76ed88adb019970d22a2d0662463f8594d4f0875df640ce6a2ad0cb4c05b9702e1582e6175e4db4cc765720621b6379211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59567bad625db78163c825e34af0e77ee
SHA184ae71deb399fdb45cf8d4a6e8f670e96b517a8e
SHA256f900b2daa820c3f7424de8acdf605b281050460733e244fb7eca883a41c46fb4
SHA512873d4d0bf0dc90c5937210871cce4d5b4eab527155d401496056fbada6ca1413b9843455c788740f64679ae1e5d2150161e96bac91cd1c94d22cb3766d0ddc17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e668ae52fa550c72f549a428e7272ec2
SHA1a47d3f4bd0441455e2767809c718e3b117a94a5e
SHA25626c4cf3238d635fd402efa22744c23dd87d51fb935225fc5d0dbc9c62bb9f1ee
SHA512c74942c3254d48ec4bbf04bf2699e6644483e5ecc09a6b051c56a43f91244df223795156b107a9bf1c2cd533c3b5577d0478f8f726c3761c0643701426bf1877
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b2a6b41157b5fb7f3547dad9f94da1f
SHA10c9fccd87f528a6a937ed31c5c7af4a42f0276ad
SHA256d048f20619eea29fb3499270d374010497f1225cb54cebac763c194ae40f5e8e
SHA51287b703d64e7164b3017136cbe826ce1a71cc7e41da45b19c296f5ac454e3341fe88d2de0b41a77d2f8544f38391d7703c7906296898c4b9509a8372a0df86c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59526f7c0bed15ff27b5adbd6a9d7ab06
SHA111815daf629811b6625985fa63af74750870fc7c
SHA2560f8f52dd703a9f4ead81bfc835c62792e3c925396dc0fb1c80133280eb38f38c
SHA512008364610ab40d0d171591c8335d239c8dba86f6ab4a06c3493d1dbe3355df5a1947f2e42c53049b51dd8080a70bf6a8b34b46934393e4c3f7e387c3096936bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507f3712e45d5a02668f348e25005dafa
SHA1614ce5a361951400af92f23782024001c882533d
SHA256c3329faebd980c4695ddbe33d8afc34b3ef51024ec6dcbaf5e6f50b6eb63f7b9
SHA512e33842aa5d0c43e0a9170fb3b384b37ca6aa1fa0b9d2a4bfe8fb86cecae757ab1b8ebbffca204966733c74329242703f8fe8ecc694f29956647bd8b5297a167d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573c8b15bae19c90f1bb30521a9bb5518
SHA1f90cef164949e858871403e416d1612804303e8c
SHA25670007b3bd3d528a15f0c779cc9bc028080038328aaf0c36761846c0239eecc63
SHA5124774616bef667eadaeefbc60b3593bd8bbfa961d91f0a3a7862b5d3290897907683b14af10cdcb399475019c125dcb35fb5c1964a5d92f5aff044718163bc2dd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b