Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
3ba0155f4d84d6106cd34e94a2a29f4d_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ba0155f4d84d6106cd34e94a2a29f4d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3ba0155f4d84d6106cd34e94a2a29f4d_JaffaCakes118.html
-
Size
36KB
-
MD5
3ba0155f4d84d6106cd34e94a2a29f4d
-
SHA1
1adb222994ff37b15023e8cb876764d54fa2f528
-
SHA256
6254dbdfe09d7d4094e07884840a285de126d82be9dc7b093561a94b11641a7c
-
SHA512
660ef5ecc01535b73b6d23670c28457cfe563d0792ba58ca2865dfb34dcae8a3bf96b554897e33a0b86f8e455cf9d280e8661593171e044a5ed70855d9ab8928
-
SSDEEP
384:3r1P1C5KolonoDpoio2oBo+o/ovKvjkHhVbJ23qpB7WJ2BhCKxLYy8YxyoUy5cyq:bImu0GYZ/o7/7dr
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{369F3BB1-3FF4-11EF-8BBB-46D787DB8171} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000afc8a20d0c777de7e29646a050946b463f780085498a10fd82d31ff16a63b223000000000e800000000200002000000023399845845761d9025da06ac913ff39e765ca57e7cecbec23b56a3dbaf813d420000000c814bfe26b2c09436738e1dd91e58fe41d9689392b46d35c689f99a36d9033394000000004eea047ea93918ccb417ab77fd6ae78e77274d5fecb810c04eb89b26730556cc04712ef19782ae74d175ebd9ae513b739c38793182eda6b6bcdacc5be769bc0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426912227" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a343bc5dc07b3b1b2f58c5ec88a382411307172e465c32aae8ebba5717b03a33000000000e800000000200002000000017e49df264124aaa5f9f30fc66cb4719743daff6d6a6b93498c277e178ab9214900000000da1bd7b31c2794756621bee1c24aa65820635d1ca7cb3b582806c2f1c5c6b2e762597975502d1be4ab9c6405a319b214758ab68fedda227ad930a1020035e22d03906b2bfdab68a8e1421e9e940205112faece223f3c51669034af7ef7331282243f05d8004ae79af6ab597c883048e39a81e301969e4d231b86fd5847c62fa6b33c4c87769f0286b62f2d34d227f4c400000002c250000bbe704feed8c1efa261825a4cf8761a18fc885fb32284af9364caf211820095db4673af5665cdd9ba482c9f2e4466623cd73f90c5a8c2eb06eb30e6c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e097c60f01d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2324 2272 iexplore.exe 31 PID 2272 wrote to memory of 2324 2272 iexplore.exe 31 PID 2272 wrote to memory of 2324 2272 iexplore.exe 31 PID 2272 wrote to memory of 2324 2272 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ba0155f4d84d6106cd34e94a2a29f4d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579fa94864e64cb6a94a1f3ecd4a25d46
SHA13877f81e6dc1f3218f4bdb4b27173df7a2e4ad74
SHA25626b97d1137dd67feb8a308d148fc6f8b75d8c3927594d85f71966a52ccb97a6f
SHA5122101c49cc2e22b1f73f712aed9640f69111e5feb13fd1d30ed5f4603e9450d641db877c9aabf198dab8f96d8ce500ce962b3c818a2d01c187fc762e82cf6883d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572f1813dc22adb8e9a5ab82f560c3805
SHA12018da81848ea063bea1e672c9c359783bbc7ecc
SHA256cebe74a02e5aa363a27c2f90bb221450bccaf50fc5061a9ded3ea96c1f53886c
SHA5126d97ee44723ee83aa89c2ababc7df9ec4a80c2eee70b6dc8a7cc3b61b3f23167769c7086608dff1ab94f9709c29283ea0414581a175bb2433cda0cb8c7aac223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591b83480bcf092665437e55f79243cc6
SHA12c1386c4bd44adc42ef265e25b6ac4b7c1a89501
SHA256ad99a859b9bc127abb141611ca753982248f94115bbd9a91fddcf938f40494a7
SHA512842794730aec6af88bd43e82e77b41a493e42f6163a1059cba48ddfbb29aa8d80ff4a3ecf8a397c3de658f3e72bf7336f55c6fe3589e262d8ef630ff74ab0c52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52aba19adcb82958f19bba3459be46bc1
SHA19cd52f908f63760c974a5b34eb02b8d8ac98c171
SHA2568b1b75ba4a6b3f606683ec0156080af822969548ce421c2763ae171636be250c
SHA512e12b093a9ceda85ac540b71cfa7f3e7946a8e9bdfa3dcbf5737b8183f83fc165e595cf23933ff8e4e7b7f3acf7a11d2ed7b63b68bf0660595ef0f8833f7777d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5489ee761dafad86d36becd721dc62ac2
SHA1cb362bf03ecd2d5067236f145e0f7d3984d25d08
SHA256c6f040417b07d254cb18bfac6239a2fae21f1103129d6bc4cc6b1fea4b861bfa
SHA5122ac1366f78eef5c55693bcd83fc553b130405e69a10c643b58e59a5a6d46105c5ba487b3f80a3193c2a4f78d8c0b1a2e53585f932df6427be65b5a8f210b0dca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5618622511f6cf6890d568c6f723e3d86
SHA16b4e78238430d4b096f30d865598f27820d03587
SHA25677dbc1997195740b23a47fb2d82a3039d8e3e9f975ea88ef834c59ea4bc5893d
SHA512003ad3862929bc375eda2c7eacd5dff973c783453a7d82b60d581cf9f7d2d397d909cf04f8980f1b27fcdcdb1a4875f79ba28f58b1ed77de735fda1dd0da960c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b61ac8472a43298400107b084fe39898
SHA1a1502fbd8440f8dfa8fc8b65b1dc72a215c1497f
SHA2561287bbafac2baa98852c96f5d3b766c1f3a5309c32851f11eb2b0625b000bb2c
SHA512a97688b5ddba3f7dbd59e2dcf6d7adcd1db9bb025908b23377a7acd589a9c21586effb185a2cac8953665ecc0d77d8a9eca6d7eca894447346b252c4c6710948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a4b16c738130eee45ccae97a892c390
SHA1541a610ad6073a672baff4d060e4a6f862e34f6f
SHA256e418f9a48d0652daffd361d92999b6e78a898f54bf4bd374f93a368d4ac95b94
SHA5120f9c712b1d5df240727aaaddeff4d181e14892d2a1f49aad8819dd376f60c932a721fae86a17066dabed4aa94cbb461f0ecea0904361b3d98c843bc432a5d999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fbd4f0186ed9638f4c459b9b55ea30f
SHA1275fbaf0097ccc83f077d883debb9873da76c464
SHA256965e01a36fa7f2d4a565c3c40c98a642bd2ca34455ca92a162dd8bb6a6d0bac8
SHA5128a8088b0e9c9893e7de2c1017defae88a2299ed0c896b7d3d60af6d3df9b757bc28161b23e511915db700a9f8dadd0c33883576a336be0f70b3f3edded0d9029
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569209be2036ff8ba303dbbda5427d272
SHA182a96825e6e0030aee75efde9cb4c9e22a8b554e
SHA2560071e084377e7337d2b3fc1b271a835e43ec22cfcbfa842ec9042ce4cc4db774
SHA512b85345950e4fc6c6fb83a27dd0717f3941538b3dd789bd07f19c7528b56e407ef129a0056848ccdde4d8b5fded3126627a1e9ffbc90a4e90006bdeac3678c16d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bfa6829cac85a0fddbce95a4f24c337
SHA1ed155ba28dc8995d16911f3764c3bed038143f9d
SHA256b68cb2a3b3a8eede13f4e5b51014f3130c13fd4eeb103069bb767d66adcebdbf
SHA512718fb84d243777ce30ba08f272b3dc5ed69e1579dae32de7699ab04773d0f0da846747fe9ee0755a1afea7a1f99a851898def9ad48ddcd6fa8d92c129a172207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5249fa7bcb72c5423f68a3fb26e0838bb
SHA1a46eae112ea2d6d4ac754e016cd880e90895e334
SHA25620da73126499a2601844419fafb154abeefe559a18c601c325886ac33f3cdeaa
SHA5123223ac8b79cddfcabf202e7efe60e3dddd47a13ed43ea41a32fc16be0e4f10d9eed7a45507aefead272a96f4ce97940c0bec17713a222027bede5c5a94c68868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c58d4fccf54c3c02eea321cbbed7126
SHA1b0e669a297541abc78a709955286f190ebd69fc3
SHA2568c9a1fb6502d0e1b413c83259dbb7a87582288a7865d596ca14e861361500e48
SHA512243a6ac6517443324e5555da695245715342eab5a932b4f4c4abf4665b51f5ff0639c75b2595b6f4dda242d78f59055620e69f97b87fadc26ec8caad97dbace6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad829a625494a7599c0c0923ad8e6859
SHA199024986ee3e9c7b39f359f62225f1acf5577d24
SHA256ea1a36b32247c348265f377f6d53ba548d43d8136ac9169811a93c291e03a3ec
SHA512b185a24e6e09d83199115833caf60ab7f1e2f135902635a8643fc535c8f1d93edaa93747d076472a84d7622e9ac862ef40f3a29a82bd1a81a2951ddef7d18191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0b0355229e036790f4f86b5002b2483
SHA16fcce56a5bbd3dd64e3cd44a16de4efbc8eddc2f
SHA2563d18951edd84b181a0e80ca6e39f6db29d9ea147557ea763517b49547fab5da1
SHA512546ee9351241c0ac9fd69d9029ebf9ada5138eab97833e9680df6d81bfdffe9ea4b89a7cb9c340a71894efb4e8812ddfd57490d6621e204e87e5cb23c38b3f19
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b