Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
3c45c2d21c8360f71b66f5dce9c6c88d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c45c2d21c8360f71b66f5dce9c6c88d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3c45c2d21c8360f71b66f5dce9c6c88d_JaffaCakes118.html
-
Size
86B
-
MD5
3c45c2d21c8360f71b66f5dce9c6c88d
-
SHA1
cba669132ba30a94f9f4007dcb812fb13a6fc2f8
-
SHA256
3ca76131690edd3ddc157471f92e683d7a7fa6c992f0123c42a9ee8a1ab1c191
-
SHA512
a8e7129511ca431fab42c69261740448a1a62f37447e4d840563a4e03cf6581864e1286961cec367dd06c55635574758b38998622d50b88e938317f9598fca51
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426926908" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90bdd23823d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007bfdb890c247dbc79e6a38eaae4efbe2fbc0fab2c1cd10babf68edbd67b305ad000000000e8000000002000020000000de2d76df1057214317890119b8209fc24c17e23f17d6ad75b9df3aa4c938a9bd90000000bed878627a119bb56186592334ad07346172b1fbf748c1d0d861d4b7be09b42f88dfcecab18dfa49fe1859c869ce2e9e4bfadcacb654f7d643ec34c4fd08903ba69f0dfdc7b5a8436e637f586b838e1a3556d70ba08f6c2fad465b1f2173cf66a6011b3e0ea02963f38f298167bf451b6148d0e9199c33d16b7cd4940259783335665dd6a05a7559d6b77f405bbe6d4f40000000e227899b1bdeecc53067d52541cc41d8a6059ad5105ade21a0af0c6a6266c059095a2a52e45378d488d74197108eaff8f3e255d6b665d6e093c046e6f0fb334d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000cbdcb3fa33bf0711dac41ce29c38d85cd3c3ac084063f75f9f0388b56c3dbd1e000000000e80000000020000200000004ca23a3bcfcc593d7b39767fd7d3b8afc2118f9e0cb4f2c835fcb4e141a2e1c420000000eb5576c5ce64722d72c1fb1aa3359bcb861a06ea8968c88fe0e3e8884a66063d40000000979c89d7eead6a7a1f0b36e9e94707a499d85185d12a112678a3cad9d2a25df413b6e7ab8ac86154172ab81f4d96651c9aa1d85e848c82c1a5c22459de267db4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63EB1681-4016-11EF-AB71-E6140BA5C80C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2716 2440 iexplore.exe 31 PID 2440 wrote to memory of 2716 2440 iexplore.exe 31 PID 2440 wrote to memory of 2716 2440 iexplore.exe 31 PID 2440 wrote to memory of 2716 2440 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c45c2d21c8360f71b66f5dce9c6c88d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f610367acc214b60c7c4ff14951bb695
SHA148a551df9ff7705b480283d7d5368caa48e5a841
SHA25698d1e48d9795ac7431c7c2bedbc230a7274c3851ba94eaf64cf652ccd572aadf
SHA512b9a9a51b0ebc1de962bcaf0bf40490e73d5fec70c96e9c85a06261e941dbd879dd583838ff9cd7b0a10c79bdcf04806686bd2f3645c3f9f7abbcc8975595f037
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a6e6e8ed04c6fb7819c0dc90a3f9487
SHA1e60e4d7c7d52c457e984f00c0068ac3e15818ec9
SHA256d63ef0dfe60e4b75db740b6b7b7cebd05ccae71d185046cfb73ae64a12cbbfdd
SHA512189c4a7cdcac7eef6fecb6cc5939a4f14d6f10832a06842a84768ff6b7352daccb73a57fca02605633ae683e84a28e47c985ef4eb2e62c5d4724b51bc4bffe85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596ddb8931f2a919527fffa21a4f0419f
SHA1b31c1f8809a53eaa9a952f29483e03d53e2ca256
SHA256efac514ed7f89e6280a3a15e1c4a92b9101520b673987d02861d7bb4882e2cbd
SHA512a9a95facc55e499f8b128ac311063920f8956718dba6c6bc40da3d839d00258cec27211206ec3d0bbd5c49790a6dce1d72dff391764eefed86caf27bfd3eff23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b6881328303e384cbf12638582cd419
SHA1eeedc67a62f9b04cacbc975fadcd8cee01490342
SHA256da1ae3d281bdcfbb96c4ecb129789748c2343f0063a47c7f9769e9651bcb1a9b
SHA512fa32e9c7406a5d91192cee3d34e338761558a0e56b1900f17f9b9072caee02f2a7f2191c8cddd8cb19fa7f1ed8ccc3f14c9c6073da5d35aee2d35a29940b989e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3b9e7d4d2f594342de969d5b35da8fc
SHA1026a02109fabd830056bc6e50692a36103d071d5
SHA256d7dd0ddb7e0856773776f8c386ed15c25e205ad8ac5402394cb09832db60516b
SHA51205a16fbc83e5cc79f129467cd56adf82dc6e223ddfc56e3235b6dac4ccf3a4505aa593afd0d23a99c855e714aa75e3dea5878eae39934461dce8398837346fa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5002dea1000eb0cde70c23a040108a1c7
SHA1ab678d0e172bd5bd380c50870e9df33411ca2b89
SHA25600051dc630de75aaa76653612102cd4ae76ed2ea3ef6d5940c2f4ecb1a22084c
SHA5120820fef06bef2c8fd620b2e15c92c37364a70a1317ceeb7607e2343ed24b3971dcd15e36016ce767845447895a5e536cda864657459278c67ebef857c93da4e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ef206c8363b3beea5787144bead7e64
SHA1cdea14d2e5f6dcb481d7063a0d3ef7e4b25bcf57
SHA256147e20ee860a5b767fa4f5afc803400bba7f370fef34c6b834c4b24f6ca139d1
SHA5128e24521f9449e24e58eab5e0b2422d7c914fa794647b344acd24ce742a7765f32efd4dbf43ea42f0d30c0a27840a54925ddd791dae1328f52a1e2a0e84a68a2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d435a4a0fd8ae446e98883fba3a76129
SHA172671265562972b82b6f435515b5446933e28484
SHA2564e251ed259d27036fbd476d483a0508d5ad76b05d86151c52b1241e3c5012b9c
SHA51292fc4bdbc95abb302d9fd6ec794e6ce723b9db47cfe34b1befd8848c374ff7c22b127106f2e831d7c559af70099dda09001c56fb436d686783f9e3aea7002837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fd0b68592020d2bc86c298c218634c1
SHA126a3a71a6f713730472de13604eaf0197b076490
SHA2568294f59a20ce6cd2a880542134a6efc6d63143f34d90afd7c333324493bc4d60
SHA5125d678eea13cf50eaabf837bb3aab90a1fc72c720474a46a5faac6179debcaff4209036d960586587f4cbdc5ff6bb207fcb2eeb31783aff3f7260cffbcebf9c95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575bb44105d6205f916821f05685c920e
SHA1146e7f1d337b89366feb61c512a797a6c0032edf
SHA256d7371a1edcce472acadbf8353e475de4706b7ae4066d1b0d0d927675973e2c8f
SHA5124e91f25841e89124ddbe6b0211bffd1c1f0e9207440f1eedb683ecd9fc91570751f1877fd9f5026ccd93567db48ba38bae9723b9bf6466ee0adeb9829888bc9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee0d74de8e4ee1792a6a3ac0954c9e2e
SHA1505b2f2fa38df4f1e69fcb2a2d2a70796880a62a
SHA256671b4abca4da0766b070a6d787d98142faf3e90106107760260c765ee3834e31
SHA512bd122f1c1969a5e483a780e66625c80d136ff8d01b9e6559fb1f4b7fe53165f803505b43bca5733cf8c063bac50854986540bfa9aa927369840f01f6eb4e7706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5695c83bcb34b11942f05928568ffe01e
SHA19d880bc6d624c5282dd4a474458e9b6c0132e701
SHA25606051259dcc158c3edb74eb0979bf317e082e62fb93a7cb6068753528c5ef97d
SHA512ede62d6199b2f0ca5f416dd72ffebd82f7089118f7cd48c0f3abf46e13d5129df586d8c30b71957085fc4c71ae7ece9b28643d5d4c6d4350a89ff4e70548a91a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52749a92ee5c5f0ceeba67c56d8a5bf07
SHA131599b8e226e3bdd85d17c14c9f505af15594dae
SHA2569f98e484d1c7ba3e124641563c667476f183245b2a50bcd3c8a43a435b526862
SHA512706b8b8149331eec8d826968996031dc56e59bcc082b67dfa31ca9f97bae3ba867cf89077084e6c2482076409c13ff204617c86c4f3904bd4ee6a46e4e6c2fe6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e20075b22f6db0e7fca731180207aa6
SHA1a506a3cf6abd5e70f07c32bca34660fd8e9e4223
SHA256c7c88e98a69cf672d9a3824b0c6bebe9a24ad2455a599f5f03b3407b04113ff1
SHA512d09aae74a3c852ec019a89f080c1a49b5255c3069428ce56d1eb2989e57c41ceb0aa39057f6ba6ef1eb5229e5fd510a271c2a2dfc18c792ad49e362f364a07bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eb469a5adbfdb74ecf1c0580050f844
SHA163af3ffb9f9fb266e898c0fabe97e06905c39407
SHA25625d962d621e2a12bd487215951ac452919b10b6c64bbd6067dcf692bd77d3501
SHA5120c5db724b260e204ae40b5973ef3910edf811130399a2c1e42c6855ddf73363dac6427adc35ca840c2f4d9a0c49a75ad9a104c920dba6daedb1170592076bcb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564165947018202712ed2c9bc3bb3609a
SHA149edb15a458e07cd5f3ef2dee92f64d5157b1be8
SHA256178e36e5675c4be80dc290e8c8b5554dccd9d20c0ce2a6f3c42ddb347a128cfd
SHA512e0f4e20cb2e07c60f4e1d0b0091e0b40a105c101d920ce880411788cb658b396ab64236b12ee66492ecc9167080f3f9b7b9c72745a87be29065c6e3d1048fc76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bba6d0fbbf9957ef279db9d1f49f381
SHA11b9306bb064e67a4c56ef2b1ca4f45bd18861ae8
SHA2566c39f7ddd2b20bd90ac943549ba929e51dacb63c2ee94b241ab49ce8f9c9388d
SHA5120d2f13ce67733dcf2604e3b98b2c1a5be915d94872ffc0f1cbb92da8826e088085bdb258a6e160ac7f3548c5d5adc4b6abc33e3722ec08e81b80c1871f1f66ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d77147e4a9ff5ca73a5fd1b11655fc5b
SHA1e2012f440ba950ccf0b3485402ab3377c4bb515f
SHA256846e217f76160bc199e898a0b3567b24b7d05f262a1c0a0d774176d240fed1c3
SHA5126b4474051a2cd11887f22171b22044406997919d4d96f50f708c091438a4ab763451ec7bd7865ddc583e125cda3399a4e8071b7a069c4139695e14cd32896301
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b