Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
4727b5ec56fdc646d4a94d662581fd7a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4727b5ec56fdc646d4a94d662581fd7a_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4727b5ec56fdc646d4a94d662581fd7a_JaffaCakes118.html
-
Size
121KB
-
MD5
4727b5ec56fdc646d4a94d662581fd7a
-
SHA1
83e96ac2fa2af9cecf61fa19cf691a275a7f1bea
-
SHA256
60a2e95d708b43bdfc043a9a3bd737e6c8ef8a3a482dcd248525d868d5ebfa28
-
SHA512
38bb1a3c9c808dfebcbb3fefc13d5a86db048e3e5108407e6deaebb2d6cd9632e77b8d523d4a02d384e3f2f249d8bc78991c9879786c7fec84aabe04da386b31
-
SSDEEP
1536:aKIBtMEFrm8slKIzeFjNI2g3tUdvpNxSfX59u:aKIc2rjslKIltU5pj9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427159939" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000050bea3b14916f826da0e2e1405dde4722c1825cbd848e2ef441cff26dba575b2000000000e8000000002000020000000349b6db3a6ad3b14e5f74864ba2161df9b743a9e697553cd19e3e17359f8320620000000688965f662fb5f9ecbe53e642b0361b353fef16e0e101ddbffe6bb99eb281de64000000027c2c43ba4700ebf466f540157869439da24cc98b05f9cabd83ba3aa54f669953472123d6e599074877c75a48cfee99e702a5906f0ee15228b333ee53068868d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004335ed41d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000003d568dbaaee75651aa67b40256a12213637f6c1f9ed8e1a7373a9c2ae2c603bb000000000e8000000002000020000000f0f423ffdadf865de15a7c2adfca410097f3abd1110f89e669cbe0d627e4aca0900000008228b3820970c4ee124e65303c348721e6a1564a33493b299e44f1ec1fb0dc3000ca8d32350c94e9f28e48e8daf8f5e2247d885902d3ce7c1223dac69d817abeb6b7bbcfa917fa01296ee58ecbf2b9f04c8a300f8f805466f617c5af6f4af97e438ace74485afc75aee2f3c74d86c930f6ee649b240c41a8f7743b20b4cb2b1927c392bb334aa13226b6c4186ea91cb14000000003440db029f6840513fdc91d9416d80d65aeed355694be2860808ce73213e61286e05bda4404311105fadd10b20d191d8e5d1c1057be1bed73e383f32066e581 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F67B48B1-4234-11EF-A207-6A2ECC9B5790} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2536 1992 iexplore.exe 30 PID 1992 wrote to memory of 2536 1992 iexplore.exe 30 PID 1992 wrote to memory of 2536 1992 iexplore.exe 30 PID 1992 wrote to memory of 2536 1992 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4727b5ec56fdc646d4a94d662581fd7a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a6fef6abcb20d39aeb6da1e1d1f48a6
SHA1db281764cbd92ab945b8be99553c8a718c8630ed
SHA2564282ca8f49dfb090ba60bf8c346022b56bb2e1acc2f69ac856214bafe01b7a94
SHA5127a4ce3c9a65bd6aab0b74d1237ca371572f179f1956432f0afb6076900b58d2aab5c9605fe587c16ff111d61e3d9df8662e290fa002e7ae4ca9c155651bd4df7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54534c5a40c9be9a724fe63855b7ca3b1
SHA1560e2efe34325393ca2ae13d2ca1ae8b657b4d69
SHA256bef75812035d9b1e840687dc0ab2dac0096615c724f004eb92a9c95ae33e4035
SHA512d98026c799e041d3e95b2295c137a53dcae12c5762ab1fe6d3ca6ccdfb3fb41a145c2c02d6655663b1f6c5ee16d3a5c385ea2a13765a46a3d90f5987b21c47a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5953863309ccc6e6ff1f264304c247a42
SHA1384e9f3425e2efba0de829c2fd0cc5e920205752
SHA256498b3512be8e940548bdd3c8f0369819478a8a70ca3706e27938103adadfb3e4
SHA512bb3f2a817a8c00a96de63795cb2b6aca190ee03dfafd31cb9e5e5d6d9e53d2d5f96723b423af1c1714d00319b4b0fb96b6d3fd2a14db6305ae45afdd57e890f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5f48056ccc323d339dfd7f681234d98
SHA1d910efa62e1a2e8bec856463a6790440e0d7a9bc
SHA2561ac6b9eec8cac0470089fd1d1701342b8070ad8fcd5fa0ba3d691177d6e004a4
SHA512013eba54c0a76d25b7300c98a49efd0fef26d3af0eb3f50064d61a32d1eea0e81b8e1f1a770f0e1e6839046906f75ae06027c04dc5a11692f1f253e932cb6514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9584715178d7c4a28f94ae85c520658
SHA169291b341da15649718a05061a1604931e7549dd
SHA256ec3b0e5e420b6c14c86706b27931c96e206f13436c36f8c693174f86abe8ac24
SHA51211771687d7dcee6bce3e41e841bfe81e1a9a49ab789e8439585250bd47d2e97ed04df1c5d1f787cd5975367e2ff60f9eaca87e8eef527b54cc37225eae4efe23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ef2495636eb36aa8f0e05807fff1d17
SHA14b4c0e648ff5c7578b44428ab8553714a63794ce
SHA2563b8e5868f4e478a216cca7132686341acddd85731094aded2f6b18b350321ed1
SHA512ede95532dfbafade8f75e73474f7425bf007334ee807a551dc6c8aedae20fa7f91504b9a80cf2158b5540aba0b8bb6d3c1efed507dc2539c88d949a48c50bf46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5308ffa5a11249dee591d4c4c443328d7
SHA13603868e5b1b12c1462f69f1ee4c8cac99d8cb55
SHA25632362cb14e5d1d721ac2783a56c040c879ff6db956a90d16e7504201df600302
SHA51223b5c32e44d8fab32c1e85f45f2409f0aac2f82fa8ba635e5fc93685acc14c871335abc64d5230a347a77a3a45fd59e4359ab8c210158fe04f25886f84b34636
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f7622ff8099bb3acccae473322f33a6
SHA1fd517af1e7c44d4ec8bb48d7521898161a731b2a
SHA2568aa8326775e09dbf7acc9d3ec61fb870d9fc61460a9ef86f0414da850eb7765f
SHA512f90f5011b62a33d98a182e8662dba11d5899132f956f6da5c5e5064f7a9eb701eac82a7cab0bdb33dba4cdda0df71edf5fe239ee1b8a5b74a088ef5737874f97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505a2f01504227c4d681d0ccc313fd1a4
SHA1b80fac7e82745d5187e4fd9882d21429687c3e72
SHA256639dbfbdc6cb5d8b2a5c0b538849bf2edf40e8f60c0d2ec3c3be16bfe693a7e6
SHA5126a7826a66ac0711b6201d059dda76e82b2b386be50d2da2e04fd3828f6971661029c008585198633c355457fa7609b88a8ba2543407dd0b5eb9231342b18fcdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535bb04ae317fd2f0c3c250ead17d93d2
SHA1da8ac1e65a8fc1464e63eabbec536832d185497e
SHA256b72cc47dfbe4309911c0dd8796b6d378e32b02e0c77af41dd399d042465c73ad
SHA512562fb6c7c283e3831442f86f37975deab5df93923b90001f5bccadc057071700d6ea23bb016084abf3e826c190309fef52b8f3cc7f3bdb6c09f243a7e40d76a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533d386fe2c277e6079b02a5af4a2eb1b
SHA197d6701a08cd69844fff13c5fb375ecd6fa5b217
SHA2569fa29c30a2c0dffbad457057a2d1a914f87d97723f54eb646b6a8196fdadfb19
SHA512225ce583a2c9a8985d0e57049252fd5e629f4a6aa5916a6b6cba15f7c63d7edf528783c74f82cd459dd02ce2bfd20854143612883cf505609e38df30187d4675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5944ec53264e7a2e25567babd68921a63
SHA186ce4f671d2777dfce31ab8e946259e47efe319c
SHA2562a75d023c9c24cdd53477607b71aa80873b2f5e7fdd57081cad43b4251a18a73
SHA5129c29c06ff9458d3204675070b4fe85dd9f5b63f59e6207aaa9ed2a97f59ce9834bef8a0678a5bc99dc2f15090d43da3c666da8fa20698aa583640f841c3258f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553f9e0f5372dc530bd29adb221354f92
SHA1296ae4f5d23262aee216a37e2cebf4c9d55d9e5f
SHA256afec57d4f795bdcc497a308c66d7e0411419203846bbd521e714fd0e21da6da1
SHA51262f51b47b6e1242455a138ff32969ec0109080018e6ce6634287ebe6e5e0173f75bf68c8f70f16008cebb416eea2585c6514cd5e5d46c623c00e095ccd5baadd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549047717bc0182973e05a80596d8bced
SHA1201252b64a207e3044efaec37d67a34c299991ba
SHA2569b8abd93868a96af200c2c0bb5d7fe54fbdff698d33bc7a3c8327095706aa68f
SHA5127bfbd775a2ca61405c520b4f0f017ee615d73aec93a22529b5d75813050200fc2e116b80d373d34107cd42256ea9db5918f99831ff99fdad6bb511145d276632
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54df6aea91e1d449c870dc1cf99ea8e29
SHA180bc2e1d5fabc6866f67c695825c7ecb4b3f7e3b
SHA256c9f1bd7066a2fae1d3a354a767eed0b4f405c85a7235a1c37cc4e5d10a5a00ad
SHA5121d9ff85750b630a5c667b1bfef63a42ae21162a5d2d0b1763f50a200b1f83696bd0f14d1c7856f61c1bbdaa5549deedeb894518d1db19c7d413b38f953779431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5132d5e866b1b72695f0c97ba3062ddf3
SHA1ab2fe4c923330c425f6c31e2ace9f31129c63a08
SHA256836cc5ffc2e076652c950a5a8f927d98fcd714f76f7bbf6af3d30f2817b05931
SHA5121415aa03516ba4b84e91898e0cb150d963b6ed8cf72416bf7a0906d0419be64e6b4b61aacb2cfc225eba9b9b934dcefe58d2e6467aa1983300c5dbb26e09fdc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffb064b01844259932812a99393f555c
SHA17b0a9ff91cf126dbb1efe8bfd187cbe7ce83edc2
SHA25662db9c54b785cdad0cb5d0b62409b971f097f6b22cac9e2827eeefc2793925d1
SHA5128750355f6436e94c47de5682740b60231e89175a27825e30572d3241e5cff2353971d2f453758e6f648bf261fd51b3dcdfb8ba96cd734d62f431405157b05111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526dccc2b2d6915e480ffb341ee80d899
SHA1c305f69fdda8b074ec4ccd45604f8d4103fd13f0
SHA2562c5f4efca5d602796de4a108a311436c1cb5a4bee7a9a1a449d55cda113ddad7
SHA512eac9d0bcf8b9aed06aab59efd8b4c6ab25847ad2b6ce266219460bdd471d5637f27f3cea25f78d1f35278a35fdcb79e6b450a49507b857a4fa3e84bb975fd6b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8b263b2fd35170ac680d453b7fa2cf4
SHA1d52e72e34229d62b980aee891564140c21fd111f
SHA2562462f92b7dff04139d56ca928d947b391ec59d588d225d7c1b9dd441a3cdf619
SHA512c73bcd93f341bdaccef98c3c892b92c3ab44858427c7820a15cb2c400a5ffb0d90ec32949adc3c6dc2e1fcf8dccf8546dd5af11670375c3d39bda75c51a81139
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b