Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
3c3d00b823f42746ecd530d97b5384ba_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3c3d00b823f42746ecd530d97b5384ba_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3c3d00b823f42746ecd530d97b5384ba_JaffaCakes118.html
-
Size
6KB
-
MD5
3c3d00b823f42746ecd530d97b5384ba
-
SHA1
37a79b060524f1c96d3e81684df37107f19fcf99
-
SHA256
9a2cf2b7752ec7d5bafd2944b36004c09532053ec55d1e6e8d8802d7c2ea613d
-
SHA512
adef79e944b4a46908bce598a774a01e1d491b6fbf55286405a85d98b28585c921abce7b9a8a3aa1fc099b4fc1867d1fe4e1c9db3f5deefd012af9848619ce09
-
SSDEEP
96:o1I7GkBHEo/NDTzUWttBprWfbqOmIljaeDtKo1111111wh2t8b7cYj:o1I7GkHzDPpgbqoljzgRh2qhj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c2f77221d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000000aedd77281735b1c9cd98f2a070a667c6991d007046a2488b91d0ed198c3fb92000000000e800000000200002000000060553ebecc8aba2965162f644ed419a1b42b1c8ecf62a8f796ceb7d8ad222d929000000054cc21eb301b49b1676a471979cb7ee291a65fcf144db91dd9902cbe9e1f7758c98eb658b9a3113f2895ddef8f89f5ab48b4a5def46ae2611ed4de4f5a7b8f26f72cc426ccb719068f2e59ad2e6fb703e8ba75b20872da3acf8a6222678059fb3235f9bc607ddf607eae6c090e1fe5013d84658fa973356fd1a6af91bf5746c1d62ae08bdec08f15c40a0790a63f61fc4000000033dbab0b13ae96c45f1d2f6eac6b5767fdfbb455945bacf7d4ea5cb44a51d4cea98a7cdbb681a864986e3f6b5bd3810f8ce0da0c4d9546759ae7c81a2939caa3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426926145" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E6FFE31-4014-11EF-BDB6-FE3EAF6E2A14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000002b43e4705ee3d35fe5580aeaad500fd5980779ca1efba46dfa5a5e91c05f0e43000000000e80000000020000200000002c977d2b17b5e6d740e475963aeee1b6c73943f338df39f443af225c8c21355220000000a9ac5c03fad74d1e2cf30a8917a8dae1d902bbbab8455e28cd0b1c151a638a0e40000000727beabb84d5e85b9ab7ce88b6eb6117506f6f89c842074fc3a6f6336d9f0e3d67ef91d4cab550ca26812b757a84fbf9a41c5336f75310d2f85293c027202842 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2564 3008 iexplore.exe 30 PID 3008 wrote to memory of 2564 3008 iexplore.exe 30 PID 3008 wrote to memory of 2564 3008 iexplore.exe 30 PID 3008 wrote to memory of 2564 3008 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c3d00b823f42746ecd530d97b5384ba_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fda1a3ddd37f13941964993a22609972
SHA17e051410ff0a11f35bb032da4653d1b6f6d01397
SHA2564a0f771be875c23c73cb9f1226fe8add233034d29e533007b6691cef748855a4
SHA5129ee40aede96fbc3ca23314ca7fc60b0d51a62d7d34745e4e5ce7a67eacfa5c5c3ace901c21e4180d17bae131773d36fe5d36a2890244399d368b029a2a5bf89e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5844a73d2e4bc1358814382f3e297bb4e
SHA138aebde497e0982b746937cd38a08141967d8dd2
SHA256df495051a19ca30337eb6d396c1c720d368e141d825ee81712bbec0ee4fa5ec8
SHA512718009bbff228e87672440829f7be00f74035f0f19ee395717abd0cf8e60c065bdb9c01e895e45cbd3221e4a00e8e00aabee2245a49253d417122801c9751441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2e101de679d2560df2d566f54bf135b
SHA1035ab9a1898281f803156d6539f0ea3d48eb49ef
SHA256eaa2167a7fb1188007deec186f8c9d0ef636a165c37745f328302c4261e2ddd8
SHA51234330acc984b1cfb6e4d0465c97f4e41f72e4b707f467472118824ff42bcb818673ac5ce0068fd66a743038884d834512abb465bed41eed24ae7a077e49dbf11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1ea01740e6a0cd252a5a8ab71dac5ca
SHA12d13c6a3b06e32e843490afbbbf88821c5e75129
SHA2560a668338dd99510e1064b92d0599d31d3f7dd9b0b0ddf2e0160389f11aaae1b9
SHA51274bc72d664f2a6fdc2ebeac2c151c9b5d93a1839a0c227733bc7dc109a38dca9b585ec40410767f30976d1299774a38c84ab327147f30a29495f70f8a7ecf5f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5039e01a4c9583df7ebcdf07d880a77bc
SHA1568b44291a4c0e8f98bc5da460d3406ce1b5831a
SHA256e203ee5ce65a53cef222602c03dd3a6140ccc2e8c8a25fd53ded76f58a34a58f
SHA512c7cf11d4d1c1d5dc8d368fb89463b8211fa030b047fb52d8dea3f6cce3781686fe21201cf0d848251f3a0d297fa753844745a7d3d78b1444334336a396dd95b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50fbaade44d02348b0856ef4b0ff72581
SHA1d9a476c1938493c69c202576db153a78343c599f
SHA2564fc817bf06113299e0032ec865c30db839196cfa3c464f749da66d90dcebc56b
SHA5122a87fd0332c18342e5985f0c249a78498e8f2452e3885712456900f091b9c5ee59a48571d11add16eda57463ab668fdcbd3912b49c16763a19c6e9524bc43e02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6674e2ff892c59315919f7a5550027a
SHA1c689a3a2760ea98dcf48f4db8ba269eea05944e8
SHA256b19cd8d2586212e4d2a3ce1211512572ba72cebfe33bdd3a4c03fe354d853713
SHA5129d9d6fdd59264114edc1667c64cd5235d9f46175238d6bc8e3ce5fb398a760d9af49a982b859fc21716351e2564625649e67dae950fdce653dd2973d09408152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b9283eb9890579def00d95c9137c8bc
SHA1e4dbf18544a93876b0df9ddc9855ad7da372a0b2
SHA2569fcdae13ae253cd841ba73285a919a256a83b999dd298e3be9efbba6be414842
SHA5120d0de100b76fa4d6ec607ce3e2b8a6f306911c288ba749b7d004444bb21bd75eabbaa7b24c64682783250408c2701c92ae57c83810ac910a946b860bebde78a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541fde01f079109175eab9c9cb46a6b0e
SHA1a8af1ec9ef0040e420884135b4b2d37b3868a6be
SHA256e6df9f97380024729144c3736e5fc929cd76434ac559730a93011eb190de55fe
SHA512ae5d58144b912bfdc78c96a528d7899c4d9582795ff300a9bb160a34acfe418871a1e24a49d43154c89c1ff7776dedef66f64781ad765f7f867b4c2e8cb3ce4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afff17caa4658719b2681e83f133328b
SHA1255deb82e8951990572cac00d799bf527e610a84
SHA256a5a08be44654492c4d38fb4d606f097af85d2c7fd1856833a7bc937328ad2a97
SHA512399a9ffffff1ab116af3de28d6a5ba80afb4fe61c7d991729862fc844f21556560ee85160006a28c56cccf9b1e46baa218ffcf56ce83e88e0d2f7401ce35881e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5c915ed339a20e86cca1be19cc55ae6
SHA1c3c42de64b17bc74050ccc9655197799e6fce336
SHA256528f708eaa2b0cf83ec69083cce54c2211004f33663393137a3a4e80eaf75b42
SHA512692e03d037bba3a7aa5e4c8026aff784ba78fc80cb4e7a279af3a5629b83f2bd76cb87c706901d07b14dc0ca63b1a2fe9797319893c87fe8cb313df6fd07c007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579ad247ec3424d1c4498119c037c0d25
SHA1fa8937e7da93c18f286dd8cb64ad412fc36e2a3f
SHA2565ee3585255659b295e1f3103c5bea4ab5b124db624e2442ed6bed25077871dcf
SHA512b79ec5157946a03b2a306dfe6303177d55e7c2491367e0cf568980c33f9c527a38ce0116352c1902cdc71399471420623a0b566bbef74551f54786e2d4919f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da5013ebc62c840f6031588f5b329eea
SHA11e7721c5aad21c1af79abd2ed0de1f17a23e779e
SHA25601acb9859ea55e2a4c8784c5a716e0335e05ca51fde50a741bdd827824082c12
SHA51220e6ad34c2679755e794009176cd792487456fc28b5ec286d8903965c3f79b906f642b123ea854c084b8e8cd8936397c22d1bd2cbd839cd1d5b96ba21560925c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2575dc0aac2fabd977c77351f12d061
SHA1e3ec0b116015015aa04a84b7ca44edd997da649f
SHA256abf4b86d64e41ddd48a169a360c58d4c4cee0bac905e9721538b7163791de700
SHA512fe99822230170cfcbdefb24bc8ba1bf711c0514c52d6dac658d5c035f1eaf9e075febfa54fe746c7d219aa3d4fe24001c7b5a873a34a50f2ada3e770b58d11d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5285653f8f6f199229cdf18fb57530ebb
SHA1b8c6f548999ca0a064e78fc0f11eb13dbc062f2b
SHA256a34b47b6ca857bd7cf5d306c8ebb8ac197bd0dbb21e77366a5e9fe7b417087c4
SHA5123ccd235ffa12b42fc752e7ed58e6d9a28212bbd608ab47d04a9c0e0f7c99bd8fc007658a68c5546c89f387bec7bb1c8f45c6dd7d49ec38e8ca0c7fc2b8ee4abd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5508fbec8ad3c418c864319e55a2732d8
SHA1cbb6442a0b2b411bd84204a4686e97ea1e2aed46
SHA2561db2db8899375bb37c254aacbbf7c6ace4b554c1ed360a697ac7603bfb0ecb79
SHA51207cb620f0e96c4b762df8fbb9cd2a31bd5c3dbb4917a3a4abfa85aa4c48bcc1d086f7763e603441e579aa08226b1cd6780e0458a995a59198a860a1207e7502f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ed0620221f555ba3fb05e6922424aaf
SHA1515226b98fd796cbb3a5c5ac2ecbea30fbe89b9e
SHA2566119084a101499909552fe9637c2843450efc44c0de37824691bcdb69f07211d
SHA5127ba33a4c41682a5c502a6faf25bd24dd305f197d7418575b44b0d0bee87c1fef1b79a79e2c6de3eefe041e555095be27beb25ce19bf78d37e34b5f66647c1141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4025c9251c771a908d44812cc755959
SHA12aa986e6749c5c35daf37009ad67a6461b0ad9d4
SHA256b310feb3cac8840e843a9f1577cffe7aadd3eef31470914a62c1ad1c9cd98128
SHA51252731fbf7d6dc0957b9e4617c13ef558632d8133d12467f0329b285562863084b7348ff131fbe7fc29cd761c4261f595c11e5aba4cff017ce61d16e1ff199279
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b