Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
400ae17b3c246acaba9d721a8c447cb5_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
400ae17b3c246acaba9d721a8c447cb5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
400ae17b3c246acaba9d721a8c447cb5_JaffaCakes118.html
-
Size
77KB
-
MD5
400ae17b3c246acaba9d721a8c447cb5
-
SHA1
18a919b611906d1463436e501a209cf10211004f
-
SHA256
1d9514908764f458d8990a167ad09eed48cdbe2a1488c3c4248ab53dec985fec
-
SHA512
8656eae7b2f548d694ef4835aa0717e9b88bc456f6900df76645aae33c8748c33090658826e31f3d25f9fa5467966638988db38b0a1e22d9c1be91b4250609f7
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fc9RxHALZBL+qkbcZdcIqUp:sMirL8E
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000005ea17acf8a4a8d9653276e3320fa69e2eb2466a6e352abfaa4028a0669b51a47000000000e80000000020000200000007eb312e497efd170b4d8ec0ba2e9970fdc678e6aad37d4f4979edfd1d6ee8bd4200000008d8380b04f2f934320894a521fd3d1905a344fe24c0294c2f9f0cbe2a4f2406f40000000060b49bd54768c7d7c7e509561f9909e41c57e30366418e1e374c20a7623638fcb6bbe659d905e2ea3c3295a3a3ac32b906013ac10659f1918e7014ad343ebde iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07b9e4ed6d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000009254170ccd7de8128a4d52a6d7b44a037ec77575baa4012ec80515a13b0398e9000000000e8000000002000020000000569792c7c5fedfe89221400391c45339fc6935ce7fcd269cbae26e424064383a90000000469bf066617f4fd87c6cd6098babb702e32345d3b2a4a1c30201cae0a143ab86e78647888090902a6518bb7ce9f1b80e5bdc8c8d9da7a67615c15aa9373faee8174ca15ba665181709957f58398fa739a2ff2097a8b674beb7e07925d801f0547b0e0c548f81524416e2427adcd57b1cabaa87635ac70589d70e04873326147c6aaf69d9ae93dda073f32cd108d2c7cf400000005b18ec229d17bb798f0e037df134e39300dc97db7491ca611a57180f807bdcbe66127aecf23856eb1265d968e7d76843c820840f0ebabc5a5517f9ed15904c32 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61177C61-40C9-11EF-9EB8-6A2ECC9B5790} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427003780" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2648 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2648 iexplore.exe 2648 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2804 2648 iexplore.exe 30 PID 2648 wrote to memory of 2804 2648 iexplore.exe 30 PID 2648 wrote to memory of 2804 2648 iexplore.exe 30 PID 2648 wrote to memory of 2804 2648 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\400ae17b3c246acaba9d721a8c447cb5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a87ffb1d970a6b5fcd2fd50bad504e9
SHA16a7cdfc1f02901693b91e94da35875115e74abd3
SHA2569867079d154e31a3ffa8b8af702449d37792cf89c84d2f1f64ed95b0f5196eb2
SHA512048c9ad9e15a1377a78f5c4bdf4722cbe163b0ae1d94497fcc378f373c3e0687b6e3263d53993f6b5dfe04da105a4cc5803b7b7e04281858747a41b77b154c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c21551487b786f0c3bf27273c716e691
SHA1a6678019623ac4e5234d51a7be251c443150ac9b
SHA256f37a9e69fa0c2291ac50f9ee1713aedf7298d5c6540c847daf461bc05bcd82b9
SHA5126082c6e6205db3e8c4a8d32603d2bae4d8a32e90daed454cac7198c8c46e90af73d9c8faa9448acc2286f6d5e0233eb2de0a3bffcf9eb3672ece876074ffabce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59677baa80a92b1a4bce9fce93fb972e3
SHA17d27e2cd9b818ddd458f7fd4257eaadba11f192e
SHA256e378c027aeb30df68b568aec711b8a8fe2b780ef3b954a6394fae95c14db22de
SHA5123fb370999869bfea5495aa4f9af984dd21e470e4d51188850b1e024491cd82f45168f4db760091e17f3a8d9a72e87bba93e70a7e476661328a3c2309b4c4fb2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512e3d135efa84759c6b86a34ff17be95
SHA123a09eacf74f9dec43d8f50aff79731e3db94d17
SHA25618c758ea57d9044cc3eec736628112e7b4fa6373b679c62bcf0a9c9f23975098
SHA512218db83eaa135e9908e4fbfce7f0a7b07811b712c97bc34403ab75dc6da5e1895083eeaff335ad9903b68ae0fdb197b3a4c131ade8f518e3998f63f72c4bce23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5846c760a78290f40e6ee1524f6bdbaa7
SHA1cb2705f43b9042c67f5d3713cca1dbf27c5c6eb4
SHA2568838f6bf4871c5b6a5d8c7fc3398dab3f3f9f452d7be7944fb164ee246fd9368
SHA512d08fc485e6fc33d108f905d8ff6dcd0a50d2772be5e5211735f67b452b84b88f807fe3e927f5e35588a9e662455b95635b83411acc6a26be0f263ba784ae98f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5738450c1e7998406a7bcaee580b409b3
SHA12fb4fc9e58348f809bd5fbdf8fd8a7cbfaec3669
SHA256312279fe4832f86e5da6fc162df833e9a0dfa1ae3cf77360621ecba7522ab1d3
SHA51231449a511c161ac6445ad73fe068bec295dddc618ffd2a9f88cd893e19cb235080e2808fd451330add1e924fed8e5491a36f9a9bc64c4aa21e79e8930b96a458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df77b9564f00922bb37ded9819dae00a
SHA1d7a3e7babfe69c3eca16aab12e2f6f949ea8b455
SHA25619710e29b18bca213a9d70732ceefd04d38a243e65da2823495cb2cf9096eaf0
SHA512793302457114265ec664f347049b8b2eebb263069ba95eaf99989aa5e854b39c57ca1e3b88c050ddbedf9359fcfd77bea9d49b7b8cf8821e629930561b0c49b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfe05abd19ff3793bbfd85d8aafc498b
SHA1d26dc991ff38f8106324dd4c9670cdc920be341e
SHA2562409afdb72382b891a67bf0a233df0fa2def19df79198b846610c3a7b35183e3
SHA5127310a7c8f9d6ee65d3735d5418d882e8d632f1a60ff2e243000b82563ced4c36ddeae4db6adaf6adadad4484a326a96b9c1fe8efc4b78328d41688ae29bd7a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c344b0098677bf49f9a542f39dce2795
SHA111a7af5f5a6b5bdd4020c084ac23d8b66bd172cd
SHA25672f014c1c16f32a0b6cead448d59ac82cacc81cc686dc9addcd967c77c00a8ca
SHA5128bd0581e8f139db41403c3be65c774f27bdf728a044e61b9aba7cb0a21c133bee46385c3dd76be0cf1cfb8ad353054373027ad3c120f7ca3c82b416153e2974d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a251579c08860a231af12a2dc279f5f9
SHA1a136b81ad260cd521b6997cd4f51378df34a07e7
SHA25615c3f87e8b0015b4e3950e9c4571aabc9a9b684b388ca68139582ea086738488
SHA512b1732476c21c5acc9250c0b26b78a01fad667423f63fbe8a89c7a0d85264fac772aad1e284ed086dd42f02f5cf0c04fbce72ec9656c2b65485acfa5cc17121ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58da48a127db576aeccc2f47e4eecccaf
SHA1fa492c623392c635bec430186bb7f4951a712bd8
SHA256c8f108c02861a5a26adeeef2bb333c6d9d0945c06c9f130021679762bbb27cfe
SHA5120eb20b9cb2e196b604a1a51e784fe561e24cc6e045d392945f3b53e0f6b0511c513374795310cde3eed16577a4dc0fa76ae134d5750c2d7c1e3f795b4a40129c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dfd4b612f9be3920fc8715ecd34a284
SHA1722851a32e9948ff398eaebba29dba03fe0361d6
SHA256bca7b86954bffb0d4a18ad7b2c0b7bf8c144a10220cdf5233231f0a5f0f3fa8a
SHA51291956dd122ec8dd16b1240e78a18f5089a8a2fc075ae4e8e946fe10a78912c41f250c62adceb6293857457716140f17a03d3ad540d203539dc01d5871f9e295b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aeab28311adda73edbd6fe54c1627efb
SHA18e2fa9c0d12dd7a5ef0ab9687abdd76c30705470
SHA256086dd09b58a5b78dd4bde26db2013da5d692014a88a0fb534456fa587ffe8b84
SHA5120151ac61d4d6205a644a5892e8c633454e9581f98dd9f9f242a5b3f5f5a99f7a1d94a54027d2328a3aa458778954655c3b1b2c4ff70a48d510dc11c97c669ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b76f48505fc236453d66d2197edc13b5
SHA10560c504fdb7a37e27eb65a258b021bb9e93c5e9
SHA256baa5be73a0a6df2fc8c569b352b9e84c53d071e94c8fb5c058bb91f572ea9d7c
SHA5129ca5634498c5d9ef4ce132541ef637a62dd2c6d47b1ef77ac61ad81729c84d80260bd650a4f9f740eb4516b46534c06db11dd38c542216007acd964264a834ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e04d8c321276e6e6f4f1b7499a6a27a4
SHA1963fa0e80eb0adaf6e38f561f3e4206f4b839b7d
SHA256e59b17036b933aa60cc07182c7cbfa661011fc35b04cd73706a0e8a1a28e82c1
SHA51233d2b9312c640baa8a98745f94add3f33432aed70aac2f752326d3094d72900367aa04bbe04ff4089602c629a098a87fedc64619a08cb5a0d0ed69f49a473485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598e1247b3ca4917e8f5c9be9195e9525
SHA1e17b9e0b39f3c691be4a95ca832f7c91512e4c5b
SHA25699ab7af443abd6423d5f574845afbe6536bd4427c1c8bfcb80f7446078288b23
SHA512a56ba6920ff0bca18f42e76e82b18e2302ff2876048e8c6dba047bf02d6912868db6330439f880518d732c349e6ef91e3f9af5eedaf40642354d59ab031c940c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b