Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
3c3478bc0b5d841acde81811b047dcea_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3c3478bc0b5d841acde81811b047dcea_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3c3478bc0b5d841acde81811b047dcea_JaffaCakes118.html
-
Size
90KB
-
MD5
3c3478bc0b5d841acde81811b047dcea
-
SHA1
6c6a2f03cfd8c40229042c5e99e1d833757f19b6
-
SHA256
9847bd85d85bc6721c3fc6b0ac84e68542b89834a4d8078d2ac56b94cead9ce1
-
SHA512
5af6a09707d959a5a5f090bdc971a84fb75118e8d03bce7132b75ed67e49fc36ad023ec63d0b1208ab1de7950a9abd9e154060b930227a04c90f2ecfd00ca718
-
SSDEEP
1536:gQZBCCOdI0IxCI3AJnSywBuXqu8Ruqnp2+rDm+NZshJiC3XlmiprgA54ocr9eUKS:gk2O0IxRhPd
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000b6bf8acb01b3bf8c3b0fd521a7cceeee85c049cfa7a532fd41525c89c4652891000000000e8000000002000020000000cb781905cb2b0ccba8a2d7a744e6487963b2d693c5dbfd195ab45348c57032f9200000003aab4a331cd6b6591b32af5c9d0a9f1bb23132e7927322d4a7447dbf8a931d2940000000c804b39d75626fb2789e83595bbfeb1bc96d77179878625083b5386f7d30fdb99b9458b818485021942b9ec069eaa567cc4aa8c81d888a9057a867e06c872988 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426925326" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000eb598bc0fbdc06f4787b26fa6e55f5ac1f845fd38d20e9e355aa318d398ed97d000000000e80000000020000200000004a875a29ae148fd6441d1d1a3448d113a031082bda17dcead92099a3278b1021900000002caa66ab205e4e89e37c63073a327b6c628bdb338c4a42cd2551f8681e245112cf9d7c453d8dc83802c95673d4b4bdcba2be576fd793f8dc2dd6b403c16ca82b075a508fd417f053c393f52ea439dd0a67f7d7af078d45033de7f182371d55c8ff6abe325fdb44a18da58cc753ad30a1ff60d130b3a155fe0e91173f9ba4d9e69a09772979b379c6743de1533ffe7c67400000009a1d8b485f879f62a18463ee7892d540f87d72cf838b2da2fd28efa377442d9094bdbd8f1d4999fb980be23979263ec6c1e73ab42e52efd2debd35e65495a1b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a084f78b1fd4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6459081-4012-11EF-B1CF-FA51B03C324C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1076 iexplore.exe 1076 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2448 1076 iexplore.exe 30 PID 1076 wrote to memory of 2448 1076 iexplore.exe 30 PID 1076 wrote to memory of 2448 1076 iexplore.exe 30 PID 1076 wrote to memory of 2448 1076 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c3478bc0b5d841acde81811b047dcea_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5257babd723cfa99da030334363ff866c
SHA10f51295f876018b0d563fe07c1c655a7c062988b
SHA2569500dab7b271a1b6ee19c93d3769d7f082fae7a4cff67edae2b599ad95e288cf
SHA512595dd9251221b42640999b18032f6187ed1e83a0bd54da7e832fa8657680b0ee78c06a71d9e4d1cfc7bdae6c547e67276072883eee58067c2e4786a2c5c4234e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da5f22184f9590e135af7e84e09eca2a
SHA178bedc59e7fea1cf03d057132729948872377ad6
SHA2569d75a7a025f662cc41509598f317578a8b1ae6752a20f0febdd1a980c44018d2
SHA51239bdf99b235a8e978005e376ead2e165922ae4333b7d8ed9286e07d59dcc7ee5fd0db3d3df150a422901f3e03608189f222fa5fcac3461b9c012609516c0b033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3e9517ffe3e9b71e741f378b3146d14
SHA1aec118dd06d73d54c2f6f4c17b6f5050f0df9f13
SHA2563b4fa0348ebe8edaabefc189474d2f6891f5c79359156f6c5c5f0bcf450e967c
SHA512a4ae4ea61bb6f617c0ad269da49318418928db4f08342389e7cc8f17dba11f3712959a81c8017cf527c44b138a207da7803cc4ad85d5e7764f229e93fc6faa68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a543ee5cd3dd3af9f321a862cb67dfb7
SHA117c942102f88212ad26712186da975c85c80291b
SHA2566dd94f0d5328043ce37022168a1a3b59f4e9616874ebac66ae5e9a3adf707bc5
SHA512ce3467aebf7986a3bff79b292737aa835c8cc2ea86b406d76f771465f39033fd47894efa3da58974572aeecc87c4026119acf3bf75e2054a85f645fe5a0d864e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3a1fb84b5e57f0a84c3a205727d5996
SHA1207fffe49528b3715000cd73e5698491d2c075d2
SHA25617b1f937d06fd101ccd6555f3614db545456a3ee78b6ae0036d3b1e39acc69db
SHA5125a56a4cf206a3005f4e0f155529b0c2293cdfebb0019e9e4ee374c5b61a731d8f893c3c445fe7d3f4a06164efbe5bd36143676d1ae734c48684176a9a3a462a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ed4afc56ae12d6ac23018e7fbabce23
SHA1a3fb24060f4ae8c020c62762caac253e7e21629f
SHA256999cee8c37c08a3399ab39be19c1c07faa60bd6e8c6cc59add80cbf9353f6ce4
SHA51217770a8fbcde12c02e8a724f5940a29269ba440f0ead50d21f2487714812c923062a9c6916d837b44ddf8b949c460ec4074f585f466af7307527e3796bfa2516
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54409e5962c4d2a775e3e6946df7233ee
SHA104a06320133f81373243152855104d9586ec289a
SHA25639dabddbf57a5a3bca7441b1c3f96ccc147624f127a144b33c4ddf7735e49f77
SHA512ccfa1c4745b6217a7046d24a7527d2d35ae4871b8671ee2a64ac696b9b06d1ba3c4b930122da46812ba617f5c24c4fa770a9b262346bce1e6f0c72a72977c09a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3fc057eaa8448c557a5a9a4973fbac4
SHA1d344e0db8e6939dc91392f951797d345f675bcd4
SHA25609dc4aa3c8ddfc92e2b3890ecd1a0d3654b68432a8211ef587b8f445592ab554
SHA5125faf5d3ec5f8ef96e1735e99f8c6d8d38b999c58ed43a727a40c2d8252db4d61ada34c42ab026690de2c1aa02603f6a5b1b6a2b3abff76c03222634937b3fbbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523ef4252f94312a98ec6d3fd4c85e977
SHA16bba7fee6d2a7ae46d9f86b9660c0ff4c4edfe3c
SHA2569104e933b03fd2e8acbc388eae89615eb2030b2e263079309fc8da19d021ef41
SHA51206ac37b374ac32e64203718a31fabd92cc611eb8dc28bddf2f63d24659d29ff81e145f2943fc1db32f01c02506311e0871a3a3d46432d0a423d5a197794bdab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50528a82233cde0c93520f644fede2b0b
SHA197d5174aa9f74d009b00febed66876d1202a453a
SHA2561b72463f650c023db7b3ef97f9025bfd0bf7cb30dea4f4e860177e004ac012b9
SHA512e55ef034aee69be692dc1b702ca4ac53f7f66727c8f3e3abb55d58ae4d263f1c9b22f7a799c73877962a388f2340eeed2bb52f2b77510fe16de553fccb8656f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b3cea38b7a527f1336d53b957df7ab2
SHA1bebdda1d5e17579152e32b8bc3a842007b3cc00c
SHA25641811602fee2422b896642dfdc80eebbafdecc51279b8cf2dcb69474534ce99b
SHA512ab8fd8920e14c0b70863b2f193e2cce53379bfd4859ce55d8968c9a410413dd16cb67820930dd3aebe86e903d0a43531534e70d6a990bc2af2b47e0f0fa67785
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fed1ae9fff8dfd93bdfaa51efb01386f
SHA156570ddabae943e7d8a26fe4ef99aeaa3572f2bb
SHA2569dc21969f933ae8baee09e8f73cee8b581ff9f35596a276ed8b76a1195bcc212
SHA512c65626a9a2facf3c89da1e1ebd22d16239c4b7dcc1564de56d06b0fc4db45d11253836b1aaaf6eb05a763e39765086319ff77657fb3dad59c64339e62a8ec338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d0e90dfe50757932227ccd88d65398
SHA1a6700da80939a92275b14616862b636f5784ff59
SHA256b3e285ace13ca0289fe467584bce329352c3859a825a862d6a8e9d4f4885c3ef
SHA512c6a4d7e814828120962134a5a1e39344a8ffe871eea891af901590a08e84790dd126824fc2b8842474df150d28a15eed2593378a5dfbbd788d9c87a6a55a2aad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b04d514bf17438155c3a711894528d69
SHA11f90badd7783157dc5751bd1593651064b543dbd
SHA2562b36f416aa1c510cf0059927b2a0717d0fa99fc874f474e757316fbf3559701e
SHA5128345350d81647bb43e30fea7ff8ece2c8408fc5a6404804118f9be5511432b1e79af8b70d86f11b4f40e207906901ba06000891422749c6d931f12784f0a3c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513934e413904874812f00ea44e8c8a7c
SHA18cf6a034a16fa71640809593633c8cb617f9bab0
SHA256a74d8d76676cd023b4e1380666eede1fd420c751e32aa819c1a416a15d917b7a
SHA5128fb309f3f77366c32a0353f23024c1bf4db8bc0ff775a73f1b31eb50f42680f5db00cffcfc5707f4a2ee10bf5dffbd3c42096ebe6214824ba61e2aed52bd8f46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5393f410f85d50bb7bf69b210ac72c2d5
SHA1673c6a9f133a03f0f930610250ab661e239cfcd8
SHA256500aaef1bdf15cb90b1bca55e805028417584f125a955bc830127c399c11b67a
SHA512cbf029aedf5808be4bcad5be599ff50c273113b261c2ad4abf79fd5eb1942daa2a4bef795cdfbedbe49b1518d12c81165e9dd5f9dac3d11bf7e19c5e4a82678e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a00bad3739c9f9e9e4a6843d2521fac
SHA13e6ddc0b33aae025d260b6291344339e09919f97
SHA256b0c22faa40cd027b02a27f977d3a0e3e4c11da38c48c7c662b82697ce7338369
SHA512b2e4e5d5286304f03f29b39062f6b6369d425963da4260a2cdfe186c63a0cf91e0120e2d946a5ad6f18df340333219529dd7c5b3e0320965c4acf4d8efab63f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1752feedee9d77924504d767478883d
SHA185b9bcc25e98b49401d921b822ced76ee24bfdfa
SHA2560b2334c6d32f8707c3be3f3f04d97f690b043cc127e35beb57c844eec7c79902
SHA5124f3f41504fcd93f0983508d424c89a47b99ea015db93a166d5c1c8bd7096835c01aecb4194289e864050026b6a493910030dd73d535a7c5eef203b5b1b0c4f09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582de82893f959e690ca8cdcaa36a2964
SHA122cfad44a8209b3a2799b067f803e84454b918fe
SHA2561c028ad199b327819eb4a0f6c145f5bda557efcb0898a39c31625dbf4679f308
SHA5123afbbbff5eaed930cb62480f716b621998f20bed67474934b319af5168d4b241307f01fc5f4b4c22263e1af8cb202fc44c41d7de1b4d4bf6092b5b3ebfd84499
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b