Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 04:44
Static task
static1
Behavioral task
behavioral1
Sample
3c05387541478ad8d7b8d66fa363f1d4_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c05387541478ad8d7b8d66fa363f1d4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3c05387541478ad8d7b8d66fa363f1d4_JaffaCakes118.html
-
Size
9KB
-
MD5
3c05387541478ad8d7b8d66fa363f1d4
-
SHA1
b0103ed3a0d620a38ea9ef3295873ef9df859fbc
-
SHA256
d3c4d748843d37f29280c0224f57dd2d16f820ef3ec26bfb2f4fcbf58838ff7b
-
SHA512
712cc41b7fb4d7056718927a471aa38c994ca5999d108ec289549c7a32d3a1f8fa3b4b0bf95983e8a346213bb59c1f97b512daa306d7987880c06790be9c7ddd
-
SSDEEP
192:Y9rmu2XAbUKc7FgkuW2T7ZkR1AsLf7ALvp6pzpgOp2SpNxpzp+apTpzpTprpjpjZ:NXKc7OkuWiyY7gBxxpRhxphxR5xhR5hH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426921317" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000b1659fb948d3a63b289505f290df1b5113cb2233178a38f9f13ac61d82cf3853000000000e80000000020000200000003d8359af4a5f057450a417321f84962567b1e8b2875c4312c8cd691cbe42ddc790000000cfbc128c7d761b5bbce50d4ca6c81a23c8b8e82fb14f840607453e6a3e0df9b025b96d68a144b6bfe70e58125b28b12cf1d873b92613f22adc9a1cb9ed2df9d262d93e40fc816579456e86e4b1cc0446c033e45470591e6cfb5ca2e1543945a8066ffcca67fbbdff649d286ba0a43b091844d32aab6c5fdf4dffcff94b707427a8b31c412032b8a7b91ade561c34d13f400000009b353b2173979ae90a45f087846acb2ab543811953d3ad18c9df2dbdbe97a5f74f3d831230c4428f17571b5d8edefd9094b277e0a908f8995692b34221679ab0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000091c10f44ecd8826b628819befc2f91e602c202ab6c9f18211750b8b6be0bdbd0000000000e8000000002000020000000d12af229d204eef8fc326fad36ad866d96baf95de9c357260d752d7150dc45c020000000d6b0663646b7da87c38f940d7713012eb5c6fe6a59a93601cff3372db6b89f8d4000000074fd8a51b0375b16bf34ccf90bf7a13d6cfbacd0c982468029bc7043669057e889f29e8b41c27aa6e205d242c85707b0bd85ac78ce9e3bc796019fa32c8cf454 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{607EBA41-4009-11EF-B137-6E739D7B0BBB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06d8b3516d4da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2284 2488 iexplore.exe 28 PID 2488 wrote to memory of 2284 2488 iexplore.exe 28 PID 2488 wrote to memory of 2284 2488 iexplore.exe 28 PID 2488 wrote to memory of 2284 2488 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c05387541478ad8d7b8d66fa363f1d4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c21e5b3332c7a53006cae119deb41b2
SHA1e2ab4f01e0467d0527dca24941b91ec340c07e80
SHA2560b1074398f6baed6f1dfc7a02b4c2d4bb6f14e2a4632f0a0b199a06966a0a19f
SHA51290bd61f72565ae9520e57b893395a82526292aceae5009546821e93d106571622285e4a9763c351adfc98c03989a414a0d0f54db34f5d347cede1585017258a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5850f2c4e309b978410f409e431af5a
SHA1f581c4ab70466f89db24099efe4f780732ca1b5f
SHA2563d36dd826c185fc5e19e0c35f0c6a5c1293ad9bf776bf748eb5741577e2c00cb
SHA512805e090db3cb9c636e65ea75a5c1b12a754f857b12d01e9c1f200c62a1a86a5b721a12b2f50943065f19587b416846ea56fc66305431879613f14961221d941d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559f190cd112d3ab0340abf53ffaa23ab
SHA199208162443bf67df5857dc5bec095f76330e9b3
SHA256c750b952ba1ea92527a7039a37c43258968072d451e980b5af10f410a0fe9434
SHA51214735f508e57fc0aa9ac2f926e951eef92b50342d091cf5f23f1c740b9dcedf7288d4a55c7886aa38bdc8623c7725388f93fc68eab995d2b8c8eb2920d19df29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c49627e18e7520e7c70bcee239d92cbb
SHA1a63f1173f55514d8d1180d8c0bcc7850ac73c961
SHA256eccad7742ce5ad1131f93966e2bd1fdfd3eb110ce1ca82add706f09c8ee1b9b0
SHA512559b0d1b98254a410d95cefcff406215718b0cbcf730ea0f99ada33ffa2d0ee1c92add3e7116bf7e9676cc72f24318ad43117d7fd223f47aa8e7caa4fb6fc65d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566a4574ccff9ff13f7c6ae5be74f2732
SHA140a26b91aa85cb64a66e0bcdd06f7e2673f3768c
SHA2566a48b66243c32edd58d1f10d9a3234cb07ba4d92198c4e75d3a33b785207c483
SHA5124fac6d05b4ce9faf723f4c1e0c609917cb1b785f2e688c7f575bcbae790cf4014b7682de49ff1cbf54aa6b63582846b2a1a4c75186344862c5a36ec3e876bb20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cc32f986d03bedc096881307c0cecfc
SHA110e5d3526686983b529aa876527887d38a6ca28e
SHA256c5c9a3ef54ea8a469cdc9aa6aa60d86dcf61406764eb60ff9825aee78733f612
SHA512541db97e70154c0e0c401fd5497859df5b88bf1245e2e674e949d815d590f127d6e03578e3054c83174ea4491874f93ab4f0880688a5e87168956455cb367076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53088000d446be7c2ff64695d5a4bd2ab
SHA1de2e460427921561b87128290771291db99f97f4
SHA25697dcb10438daad54853a296e30aea02c4df766a16e2e982ff36af00907107ccf
SHA512ed389feb75ff5d827e0b8df78210e574e1c0ec8a62955508e8d0fb53f036265866d08cb5c838e24a1f753d681cf78f285f3990313645f5b0abb8e926ee3613ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aed1617e235b59fdab39faf6250ed24
SHA1ff36f730b24c3020cde5db7fea2581bd5ad18fae
SHA25666783b52b1142326b509c07590be84c2fdb897fcb2a0e60abdab42cbedcfc377
SHA512ff188843f649396a451652a50c3341b99ba6d1fc5f62c22c8a9d890f432700a26af12d79ddaf4783f0ead4caf55e8bdca735c265ae93aca78a2c4d08ad11339b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5543281198b95230d94fee7ea75622c0f
SHA1e644ee4ec96847757fc3f95cdd311941fb5f3bab
SHA256745fea23d13731d06296a48a1148f4090a8cb4f5a529b6de9bad78995a29a52e
SHA5127a4c1f6a14f12dadadd16d4a5e4d240d71e77fcaa431e5a5887d3b4c61eb2e706af92d6fd111c75139a0987fd0adca201044aadb00f9cfd4000e3c44111326aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597a3dd060169f27f47ced4fe29927458
SHA17184cb7493ad2651b2c8130ffc903a9ae04f1156
SHA256b274f9b6a2c909f8960deb017c67f07bfed42f51edfe1ad416641516b4a38b39
SHA5123e9c6b343e4f4313bed09df5710e3256d08d4b9590ce9d66fc1cadf4c4b4e7313e1a5329998e1b81ab0d38123b1d50daa749718b8acbf0cab3d51b11c517176e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58664f486305572c471650ba3c1f60fb9
SHA1073f1cc3438a56b40d563326bc94a9469eb85dce
SHA256972aca3fe2de96fae427c600ed4b831de5d199543674c6a405ad7b0541c39b9c
SHA5125931cccdcb0491241887068b71a4eda641a8d55cc9e2506c47e3e122240fd868517da503eaa2c3644518b7aa3883c8693083edc5034f4f648530581764201d6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad49328d237dfb56fe9554e13f75e553
SHA1d2825f80bc0f226743f524ccfc5af5561805f041
SHA256819312ef090d4fe8bb537178b98bae8aaae2616cb68147040217440c962ca563
SHA512e2b4bd22ac14f888909c6159a7d5282b9440cd05b4e9c9811424e7b4af30f2d08190e3a111e6e6556516c3a63a470b77b97869eb1a9353002d7f0ddd8c465c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508a2ab7b565445e05f92d4e9f0853f56
SHA11413d9af79bc0d245470131c15023300ceedfbd2
SHA25651d848fccb41a1a554b41d1b36c7e873aa60cf97a81520b95715d48371e90707
SHA512e207afd026b9aa474f9ac14f35987f35c80c06ca8fe37c12c9bd55bd700a8acc767c3c8a9f4acdae9ee236df28dda5cb14888a9733c19ad6ae6497ca3d7c7d87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5920d72203229327b48d507811261ec01
SHA1c51f93c31222d66780164a9ed0c3ed825f1a7cd3
SHA256288b901f737adf2a1d840288c52c4a911e697af4ed5c42f62600d5372d5e896f
SHA512098b20552d8150bcb0a87e48fa3ba87e1c2415f7e74870621999d7dc653b10bfad4792be9a7b4c0db73c07e30d74c517bb493f36e17ae684b4b20b8cb0f0a40c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572db1ea249f14596f3a314a8f12524ca
SHA1041b72ada19e6c0d29559851677d470bf47dfba1
SHA2562927e67f1d6eee14f3f5f6e755bcccac12bcfa7a610c6ed8f65f0c8ab755d638
SHA512bdafe6a4084681173ef23522c420e6e259f38bb2da5bc88027bf8cadfb831c05a659bd057b4945c6e755bf3288ca202e4aca56ac27940e7d5d6b78d2e9e27550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a911c6eeed3e98ffb81987027045a6d
SHA1a67f5f3d017033f4e3fcd65da7a99cfeb3bbc165
SHA256d9270fc564690ade0ba6d95aeaf4a061295b29d23b701fccf3fa87072ee31da7
SHA512fd15298cc2a647adb187678bf8632e9cf19698f59568e8c3749699d6c366359a23b4fcdca30c6527bc5ca15909f154e8a60a8c027f9397b8c8bef99d9baf833c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d86e3a7cd64530c25eb31b5cfbcf653a
SHA11915da8a21d64f04679dfaa0e0374738949c18ba
SHA25637699d286673db6d1714fd3527a8e98190a9a2d78e83919e1228a129d7045dcb
SHA512c1020c7810840103d9374992503a2c7254888538315fe53b31aedc5c935629e3083204862fce1208bb9cd6a2a30f420d331d7f063379f29e227f95f8b98144ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ad478a56dce7fa86c6f9997eeea442e
SHA1457c2aef71ae012e2f000a2551e9407b419eef33
SHA256b00012c32f4d3b3c2f389c8ff68c99d93c5bf95d013251874171b1d562455c2d
SHA5128a25377ffac66404bc309b1a8ff38eeb306c4e29ed982fa37e4512be00283f5c458802d823fa010c0167a98ad58d0b7c034bde85fe4f8fa397303b69b6cc330e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b