Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 20:13
Static task
static1
Behavioral task
behavioral1
Sample
3eb9ce149f74034597f10102dc52b2bc_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3eb9ce149f74034597f10102dc52b2bc_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3eb9ce149f74034597f10102dc52b2bc_JaffaCakes118.html
-
Size
6KB
-
MD5
3eb9ce149f74034597f10102dc52b2bc
-
SHA1
22504615cf3e0ce2ca5029849953acef3b75fba7
-
SHA256
d8d284577c878ee0f26fadc003da9468c4806e1f38043345966f531483ef198b
-
SHA512
d027cec1fff22d32d90db5b343b091edf87c0118bfea5fa3a9131c6f2eea1e178230e500a5d4499dca6acf75a0f78a8494e3c013cc9b9c550f821651949db223
-
SSDEEP
96:uzVs+ux73SfLLY1k9o84d12ef7CSTUJvLcEZ7ru7f:csz73SfAYS/mb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30023d0698d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31454DC1-408B-11EF-B90E-5E92D6109A20} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000070fea8bf5c947bd84697431d2e0d4b6e365652b823ac25b6f45131c8168b23e5000000000e80000000020000200000003c9ae9bf730a3aed208fe10e1dc4f4f4438ae31e3d4ebe31de94c9eb6a2b237220000000cfc15a388a91eb7029ac75f64105350e4f31f040857d37c9d5c243a2964d3cfa40000000e2b479e2c2c96aa10c222620b12d89c6518c51afe6357515a621ab2da06ea95154e38971fa73b57832089ac8276cdf8ae8158e8facb079b2155c72545b5f3998 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000008537e4a9f0dd81671d71c5de33f6e59afe2935c87832fecf64162f2506784803000000000e80000000020000200000006f55041206e9a91b4988abc4778c652c23fb57b5aa4a89ac39261d07d85697d990000000b04b4c1ac1a3dc3d8a9367de6d6711c58aec05f413a7abbb2dbd7d58916c040d6804bcf0fee7562060bd2a77a75c06c0a8f0ddb16b0932b6f7d87b625d449f0fab5ee46511a0ea6b204128df3dac3d722ee42c837b6d7f6b1073bc9e171dbc42afb1803a0680b079efe2cd4d4e939c225ee9b841b2be65f985f32bd74fed1d16ffc57faf08ac2815fa7771c7e9aa1a7740000000dd4b4df60874efd7d9923f8705d11c3bb2c86471762a768ca75e000d5fdb0f19331434c9482140556bd90bde8f43cf8b3c22f363fdf77018af7b1cd86625397e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426977071" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2508 iexplore.exe 2508 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2856 2508 iexplore.exe 30 PID 2508 wrote to memory of 2856 2508 iexplore.exe 30 PID 2508 wrote to memory of 2856 2508 iexplore.exe 30 PID 2508 wrote to memory of 2856 2508 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3eb9ce149f74034597f10102dc52b2bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561097683e54468cc513cc43dec17d7bf
SHA1fccecaf4614238deb8972c47334c0a92702faa12
SHA256b00b5f80f43f0ba80ee0249a35d33f68d8839bdd3fc15be11966a40b336d270c
SHA5123664b510ba63c4c5d1f77d340a7c42981df1dff915e6f498d7da0a428051d8a75dee815707b7ac53395a4cf57e9c6bc7f0e0d4e006b1dc8252db12221b4bb425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577529c3b1423f6f7c3e34caa98b74611
SHA115ce4f2b286e48c5099d2cd016f5513eec51cc6b
SHA2561cba2dc3f8a0f35d83dc0372a1a7f86658edbe85074cbd4124432e3514bab210
SHA512484c216972893ab1a407d0b7989ae4367b9de504fa60e3ea9097fdf6279b2cda8047557cf0a92d0bfe03e25fc8d44c46c7ef68f232686ce485abfa588a16deaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516fd4204078c1e0d0f1b51e066157e46
SHA16e06d1577dfedaaad505b3061a1758d3e785181c
SHA256ee2bb95e12a176948edcecd9fed53d23c3ce3a528ad0f8052af5df6c32627af9
SHA512e9658d496f213df3dbd7da4ed5fb5c53912313c77351ecb2f91329e6b63ffda103776868fdfdd298b39538d90455351ffcbe4e66fafcdd994c3a7fc9250cc8d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592489d76e5bcb01d19211bba31a10dca
SHA15bb6551ff3eb275591557a9b9dcf505c8d533b13
SHA2565be5a51ed88cd1ffa19e5885980cae560bacafbe47aa209fadbef9842553cb24
SHA512d2a1f3650f9e41c6bc1df7fb3aa461a45c1e5eb7f4164330c3d192bd95d0a48676f9ae53af9489f9b1c1337d1dea57ee90a86f2b61ae3daf27370f4835f91bd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0a75c0a45923a7b21627076950ae5d8
SHA1b9681cf2ec50c8513e79e60d26956208855d4aa9
SHA25602e5da6962db78bc962d22bd68037ffda77dee7531bad6f311671160a8a952c2
SHA512c9fa0d07dddae8843ead0fb9bd9ab64215b82a51d82b261684e540409a95722ff6e834c2772c6f4191d85e13c5757691f186fd0e15909ec96d2bd1a0eab89dd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5087135f293afc93488ff1e582dc57085
SHA13f7ffafd8b34e9e4df9d1ab130fa37649d84aca6
SHA25673d7ed7cbefc43da2c2ce94dd6e6f76f276441a7d3030dd7406b47a09fd20978
SHA51261ec9dfa2e32e987be5dabe0760d2bc0452c47df6d0f6c997145f6b5189ce537d5d5da88cc32f5c768a17302a1c98d1c62e19626e1f96453e379252acfb93b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ab25671866cefdee3bcab8d64b610bd
SHA1982e192a6c229794b0326180f474d38570074ad4
SHA25636b32f235860b75f7f0b27d439373b4bb0f7ba6f61d99a7541c93eb95a504aa5
SHA512e5b3b7fe2a713fe66bc6dbd69674c502b4e6efca71bd3a41c83f0b7b945207cfe606feafd4ffa0ebc01b47d890cf94da9791fc2a873c165f3067152d369f9121
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5648cd45716051393aa22056ceb5dc5
SHA190f98ec742c44446c36c0483c779a5819b3be38c
SHA25622d913aa07518675dc6aab1d180192faaeb2f324f379361b0ef3e850215720ea
SHA512cfbcde2eddb27fc82c3162713cfff2885fcd027adf93b63c44968b61932a768fb8b2589d065edc2f59212aa6251479300349d5838e4e016bc46f54896ba3e2f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5eb8ac0488c52102078d49528493839
SHA1c73da0346f4c996002f82b55fdf73d55c211c079
SHA256197fe30fe04df81b386299315e5504c2ea54ef1e3f6bdbd3e59a61a165507659
SHA51235fd7914b1affbe5caddea6e5085003259ab43836b99ffbb2c1c4ded19dab4e7c424db41bbd5fed64fa0a87127c154b5c0f42e06ede4ade453e42d004dc31c19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a06f1c7deb3598bf4ef828c3e27a60af
SHA18901b5d3b8779511cedff445b4cc2a951e2cdfa0
SHA2560c3b7430d6287fb15f0c4bd88f5727d0e5b9d12a2a9fa2eba9a1a7ded259baf7
SHA512c76a87846455786a4c111cc4cf33bfd97f301e49477d955331bdd231fea91798f37fdda6828ec73197868ef5e6a2f83b7a82108c4b536321cf9d1d4b343f2ca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a91422c618f543cea2211bd4606c0f30
SHA13dee7286f01de0be126e08369bb041b3d265e1b1
SHA256a65e4f0167d6b7d433829e00c3c5089157f07c80e9cbb097280693cf830f37b8
SHA512f72082df9ebfd82ab0f9287e78e587440440403a97fb87f566f380560928d3ed3f6d7bae9946e7690a246f679e737de843d6846357f6a0e4cba477edca946da4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e945b9e99c7825275b9f355892aeec5
SHA1ac4ddc298aa26002f6f16f2af4d9fb3556ebc44d
SHA256c90321a01aec10515ce2cc547bd29e7ffa7ff158f72ad082ab1296e5202158dc
SHA51263dbe507fbdc7f397e1a888bc6e58fb1661fd4524b631ef8548d3f7cce3aceee5201e029f509f52e50f4c8f65a3eb6a6d13bbaca7b683534861dd627ffa3df97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6e0ac87d28956e7c72aa6c515ac4f35
SHA1372ebd443e992c3c872ec6d7663e16f434dd5d86
SHA256df46e294ffeb94123e72d19aed3cb0aca41ddb3deef111fc1c919b86ff6327d4
SHA5124e3a282f11ed735e1b05d950e72f1b9f8533eee48fcf241a2c10625f9529846de70243a1c9ebc9022f1401d07c22931d5e3362319632bfa135aad6a9b3ad9c64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e941861766b7072bdeddab653074cd08
SHA1322a2b25bd98c8b7e87d0073723c61a9b32ba3de
SHA2560e9e6e2cfd17402f3040603b8049ff16af6c695df7d2583168f9279dd070cdb8
SHA512c0697ade3fda9c14dc41fe3664cf9808874fc37f66c9adcc987c94ae18c859371654382f989582db1c2e872f53c982fc4236b4ec78f7e88e5da2dc16cd51a116
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4ed9055b4b31149032731dabff05403
SHA1e67aa6d7307fca9bfc8903a82a53346485648c35
SHA256d55ffdb8f099509aac675ad4fd65ee37fd5b8f826bee6a5c2d871d2d348e7ec4
SHA51278391ddbceec2f8f47f26857a6cc8a911f7a74e9522fb28a9c242b82a5b642132ec784943e7981ad5d8493e163269c751f7671e412305fde78d028978d4132b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517f64bd254f69113eff038292f25cf0d
SHA18f531c3d80f2f0fe09af742ce04c5eaaa3e64763
SHA256e1d68f02174b8e0316e7f28641126110afe557c2f15be4194f2b7a16976fc4a6
SHA51250c1a34c40e55c666eed095f3d775325b5ef1bb4362890bebb47422e42df47c573859a36f31091d073e4e9e65c809129f32cc62491c853df1d87d0e47cce7519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8437744e93dbd29d802e3e4095c30a6
SHA1a9adc4c8029ed9a43916089328bc8b34d4f2261b
SHA2566b2b385a661e604d60e98d5b91dccebe499c3c08dc9144e2306ca4672bf6687b
SHA51233c8dc94561e8cdcfdbc775a36a78037bb43e488ca7c928a945cd560fd00eb131712fb207323691923779ba4d2e147b770566d80e6457f485d9dbf20e56612a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d24696960e7d1d30bda9ed9a22399fef
SHA117a6cac90d7fcbf5b9f8c212f028cd946f6daea8
SHA256793acfac8bdbf026f0c377b58b51691492219f9e749c44f378050612bd5121b7
SHA51223b0c8b0c46247a030440426fde66bdcfd3a221b3508184eab6b5274095796a376014360aaf9a9e69dcb41349f6d35fdb9623bc68e68a10dbd53486b10052eae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d0451730efa15206b1054b4e23102a5
SHA1681f35f91dd9eac5606c189be9774c042670c8a5
SHA256a785e4e9507c0b7c0c736997dcfa71fbcb5afbd75d4fe856cc5de1aa9135f1c2
SHA5124d076e801fdda1701241a43eaf3cbcc87dd6695a0c2f7608fb0c0714ce8fe6147fbfce6029b712374c14657f4f1b2f88d3778ff54ca32ec99353c09e73e019a2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b