Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
3fb0f3dc65e649b9439a4423c819a986_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3fb0f3dc65e649b9439a4423c819a986_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3fb0f3dc65e649b9439a4423c819a986_JaffaCakes118.html
-
Size
104KB
-
MD5
3fb0f3dc65e649b9439a4423c819a986
-
SHA1
d146366219c94fff290e9bedba94421c4583e672
-
SHA256
e931d0527050f10624e80dd513bdc6d6ca28547943afd8e9405bab5100818a66
-
SHA512
369021cea9fba507c605f90a0608500d852b1564e096e6df520175f239a170144180681ee86c5490c0c8be1841b41e591841491b3416df9d374d16909b130449
-
SSDEEP
3072:sA9kMySP8mh6kmtvcDFfKmpf1RtMjkGeZ:NRzXTywfKC7tMjXG
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA4563C1-40B8-11EF-90E9-F64010A3169C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3075ef9ec5d4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000486c840bf3d5d7b96ef849af1c18b3f86d1b1e6b0a241487812e71076e21066e000000000e80000000020000200000008ec4bccac4a5cddeac39c4e74ddd1c31ded95e02e575bb6e4d81a762ad06baea20000000bb24b6ddd5fdeb52f557c78687811ce06d58347a303da8ab1ea05696c01bedb4400000004bedbe99baee66c6e42e2d548868923505b49c87863b416c070df70c4be9b7979dea8944965f5066a0178b081c0af03c559220383ecfa90c7537079a43349cab iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426996655" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e4fdf664d755798893722667c747e7dd7446836dce80b0f5da8c3d13ac2bc302000000000e800000000200002000000038a8b772e1249840da6f4e9b79904fea7a2c173638725230cc7c84031992c31c90000000cf63f24acb3ff396ea0b3ad060efb6db4613554566a9e8f87d1b43858292d0e633ec4c5d9cf841aed210322eb31d1f040e3e21900874887c434a1ab748541571cd9945918544e748ce82ef2a50998e08860a3d4312d1b330ff630f9f33666b34718a6e05d93be0b44427f4aeee70e4c5c647272b6da0e500edc50c349ed35b9323b68e3800b55df653ea5e99eaf8680c40000000dde63bbb470098257b3012f5c66632cdab77427ac178ca80f385d82b2e85f0284653064d4fdcdfbbc9d0b422d545bfe2cd22ba9168fde676201895d697bf7513 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2632 iexplore.exe 2632 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2464 2632 iexplore.exe 31 PID 2632 wrote to memory of 2464 2632 iexplore.exe 31 PID 2632 wrote to memory of 2464 2632 iexplore.exe 31 PID 2632 wrote to memory of 2464 2632 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fb0f3dc65e649b9439a4423c819a986_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cce6c8409b042a5682cf3929f10bc85
SHA1bb2d79c0055b0734d468528d6542696895f9613f
SHA256d3681738b832c415d60c0ed187b558550419524359d11216c3669555fd6674b0
SHA51269398e676f9dce8f9d0983ca9463fe682710a28a2a449ce516e82f8bb2f47474ba31f8a447a4698679cf89ceb55f9145e1e063b1b13ae16f6a0d67e5c8ffcddf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6861f4ea6d4d7091bcaec3a2a816610
SHA1b39e1eaaa5f6fce428e2447d5d13a5a95c78c586
SHA256da44effaf6e7fcd44735e650bc3b2daf83643ebb24e1cac4607339e8b511ae78
SHA512d5f8f5d9230ec1630fc9cfb89f1382d10f5f33ad478087c46b186e813e997b2f4a0bf6e8aa58053b5b88dad44a401cbb5f356af8207d3d69c7b6c66712047e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcdb364cb50d0b669825e8fe637dca2f
SHA114a8452157c4fdc10898e83818c955a9af006e67
SHA2568d9ad5eea95ac10ad63fd5635c2eb2b526bd9483deaf16519078e79135d7440c
SHA512c07023d0dc9915814ac580993db8865a03f9fd996822aa701e8f539b22f53b6fe84bb7f6f0f5fc82c6e2b329f222017899dece496038c386867c13afeab58ba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e810a6a7c11d107017507b02be7c242f
SHA18d0931af73078859d3a1949f74ec927a0992d0e3
SHA256326101071dacee04142289a6178e52530af3a3e5ea52921c5e3ccd981093f576
SHA5125110dc699e88c6e69bf0bb513c00984bf77dfc3557838dbfbcc8fc67ce7216d8f6a721065675d2093fd3cd4b22cca98e065df6db7685bd01856987a9a4c03ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5019d3043998213063ceaed172d310885
SHA155d547bbff208bb83b8cc13c7f93ed3ae76a6bfa
SHA25646f78018f89a3f04b0c719602b69464add9806514a7363f0c768b0a731034b9b
SHA51206fa002f84e5a2da8b3292262bb9e22e8da7425a028b7560e2494c9beaa68aaee602ddd1dd61b6a448452c2b124b556e98b54b6646b8a567e4529fd69524afdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2df00de5b1f53a65f21391260ce080f
SHA1816fa0ef510e53990ae7f27827e8f54b2dcecf9f
SHA256ac9829858fec5ccce81f3c0c6944c29b29439b75ea3be463951382632cdcdf66
SHA512a8eb11e2731d804f1990fc3d220a450266186ce355da803595a95a24ee0c019c728a64fde32c1d96eabd65e4ef29d05c064bce828c3ab7f01473016c590856bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55de48946293d8cb8b9ea5427bc07571e
SHA17bb10c9fd54338a9e55c62449bc137433c25e09c
SHA2563dcbd511d2989316a20558156fdb746986175c3772ea0bd905805c4e5826d2bc
SHA512ea45642c9572fa6c38b3a40a55ac69066919f678649a13f470186cca044d3bf8b80d40c55a40148affb6f3d9f19567463628f00bfb187a6af93e09d06283ed45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5750a3f28aae8f1900f66d9c2ccec3052
SHA14af7ab85de04a21556bca190395fde7d5807c33f
SHA256116b4b2e1455a4d92c9e61409262cdb71aa1f038b11cffa6ab96b9ce7f0a52a8
SHA51224e1c2e6bc13eb21812059f2fa88ebd8e001ecd4a9c5da343d672724c5052382675847e78da312f3149918d1a783b620da09a9e99c531548ebfc1da2b2676305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0de77df28fb09672233531fb2dbdb26
SHA1b7f6b6a62203c8845c6280b0e3229f5908468cdb
SHA2567d25efc7a678e07994db6cb48ab6e3987ef14b217e645df216a03c1dd00584c1
SHA5128f87ec5378ae6764ac9e9438453fd8190d293d2bd3ae235b5e6b07258493957292ccdb5f0b3d24f798d42fbacd2a5055da414cf2087508aaa29a2687349f82e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eea9b3f075dc55acec614f7755d78b9a
SHA18f0323d05d5539dfbcb11a8c083090390276c95d
SHA25635a8f4b8c88855ce2c635c1605e9b24e29b7241452cfb2fe190a765199d28df9
SHA51206a30f6408722387d99c152907ce20f356ecef1de51dcbef7a56446008cedca6c485dcdee474c12a66c4625cf606d54aa4ab5a3c69d963102ff8ffcddc37d1ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb1f306fe4525065a0121248ac60a942
SHA15e2b412473f2d59c87b0238cc974b2b1adb1bd23
SHA256afc33fde80604a5243705c8db8cbed53ecb91652f2a6ed330752be83a05d983d
SHA51274349eec12b6b04e34dbb5f7f64f00d6bc48ce092135bdc23b118a55a63aa03e46062f9b4ea020c63ed0e8a133baa435e7a96261e19bdae4f05c8cb32c22353e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eeeb0d3205f2dfc3e3ef6efeff7d2aa
SHA17935cc5e897d91dca1251e82a6461a6bf3d68874
SHA256bfeb4e8389c77a2386576fdad89b34f737d9eb9c86dbd4f41b37276a275df9bc
SHA51289d43838391c71fee40bdf4bb453a945bb12d6a4e4a1a57c1df3b9a4b2eed3062aaf861e11e32ca8b0bccc41bd6f33f5a8cb18cd48957720ec5f45375149db9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5825a6966394df4e7400afca3c2624351
SHA1dca9a86cac2ad5327fcbb61d89a018d20a98c5bd
SHA2569e58d1389d09ae810c693727946504805a0e09c06deb7e043441ed568ba9e0c7
SHA512d4e0fef3774627f0fccf3fb49394cd262d4bcd60878ab0f2e4daa5bdc2686aa0f018ebdc4a9b5b4e43c875322e747198225061c598280e2b7873712b8cd510d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520004c6191a544069a6231a22ce8fcfa
SHA156575cc717bcedf267d5e228cf2bc58536d18ee8
SHA2565a349fbcbeaf8d7ab99ba7f7a4f23aebb69fa85fe0495968fa0e0a55b16b9915
SHA5121b8819d011ce131a7e12c15a84fa32343dc3317e283ed9e9b16f01fdd64e7149d260199da6aa11a2e7d11db466251f400d4f029a80b44349b95cc634da13d08f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9af53b66e3915aede59db124fe34f2e
SHA1695974625eb8cc7d2baa6bca44220c676ab7baa9
SHA25654d9f4d8578c62c465a7e65b38cac6240297ed1dfb8495889ba174ee7923f158
SHA512a88e4366592932957541ff6b1ca6ee22ed26b9b31d32d78eaf1c60abcf1e0daf2716ed3e7c9b137e5fd77eb5c9a402d3104021767dd7a2db9d32a881633d8c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b63397a150b8a9714b77e42778a16154
SHA18a3c2a30a06d8df6ae28b16836a1920286c3f7f0
SHA2561c185f20025c5e437824bbc5bd4a684ed6fd5df488c8be95191bec7d2ee085c6
SHA512b82a4d04808288ce5391baa4b69ca11d379e52f1b224e9ab30d0fe95d8bb8915a38e8f6c6ca2ff384b3192bac4178be3e15694c19464b00854bdafcd5cac12dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50af4b41f103de556e2e6300e31f5d6dc
SHA15dc3e511b944f3e27660d85503bef9fa26090245
SHA2561647f9763af0b4a5afcc67ceafb8149e68c4acdfc6ca96b5aaaf2b1ec1e1c73b
SHA512b5d929c820758c35b573a20a4cd565242b21975efdb8006b40be9793e0ffa29c5f9d995e2e9d3b2105272773e59f03fe577974a02e8eb4c682191114eb276a54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5182e911cb1131c3ac04ebbb072e30798
SHA1aef2cf56127f88c4c67685dcea543a383dc99099
SHA256da5fcc757843d57ad15e21555538c0f5e36b80885d4f46283ca55b9f569e8663
SHA5125f9fcb1390b7fe628d232864d91a9d09c916a914f50d9cc74155ec46d0d9c1c48b6481130fbe7ab62eebcfa2fa16653f314934f3eeaa29a081252e57526c594a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a11641aefae6ca19efb56bc86787b3bc
SHA1de025fa04edc104633076c0e0068f23292a67e73
SHA2567bce303c5bc5fa2f8d60dedfd718175088cbb3313f7b887160c85d45305d4346
SHA5124e82d24035a4c2958892235f17d8a9b64d4e5f23f4d58a45d3285695c767b4c579cfc6b7dec91110952e1fd23ad826cbf91b24412d0f79e64b8db55e4affac13
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b