Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
43cf09938713926bc8b68c7c550fb062_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
43cf09938713926bc8b68c7c550fb062_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
43cf09938713926bc8b68c7c550fb062_JaffaCakes118.html
-
Size
6KB
-
MD5
43cf09938713926bc8b68c7c550fb062
-
SHA1
969295d8278bb768291aa44ddd14b6f633486f37
-
SHA256
2234b791fb7419050b1eaaf13a718bc29651a903ed94e772bd520a6b363b6a09
-
SHA512
40f4cd404765aff276aa46128e0443dfb67be8c6412ddd60666b83cbd94c1ad532c8410791bba0439939397a35cf841f1c5cbb8e18dd12cbc50bfc75cc566526
-
SSDEEP
192:5W4lIoaNNHofhmDJm0mmm7mmm6mbiJ7+mmmP:s4lI5NHScmmm7mmm67h+mmmP
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000e8e613ba0296582a4d7f4ba16a8bab448bf239c098bb2c6306b8519fc7454388000000000e80000000020000200000007ddf2d8a05d436339ca8aff4cdee6b2b431cb29d3278a71432f669d495e8766590000000483ee7598611c7ec0485d99e3d63aa59ee2dafadbe8314095205343b07375d8b026957e71e303193a8892845336e1b6caf0d786002751a3618a128d3a0904e7c37ada0bd5c0b304efe8578604ced0cef196b9723b5c436da08c9b7ddf8c97fee909ecc39ba0a01ae6184da6ae5a4fd72b138e8ce6ecc85f7f9dde28370f045ecf79c5d348055e979d07b5474f6a0684c40000000695bdd561a85de5425e20b542f01d7023fa5d460f379743e124be6db4749d4d51cc85d651e4144f178dcbb10bd8b71705ec484b9f3bb657042b375086b06a23e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427078794" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c506ee9e25c75bb415761a3d9c3b9bbd78132d60327d78d17f51d732ef383f3e000000000e80000000020000200000004e49e2325e5e3aba192df456ff4ce34bcff0b527728e56fff84813db4bb145352000000017fa71f0d960002aa587ecf91a81204f1966f6917dd0367dfb0564a6df7842994000000035a1d6986582e91edfeb08a1bb87565faef679d386009a64caa43cce6f41c2797646a9a4bb95ae74de6b6f2a5bba58152501d78f004b18678cc7b34b52be6e54 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30217cdd84d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08EA9901-4178-11EF-A1F7-DA486F9A72E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2756 iexplore.exe 2756 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2684 2756 iexplore.exe 31 PID 2756 wrote to memory of 2684 2756 iexplore.exe 31 PID 2756 wrote to memory of 2684 2756 iexplore.exe 31 PID 2756 wrote to memory of 2684 2756 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43cf09938713926bc8b68c7c550fb062_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d690c9bc83257c86dbb429389a3601bd
SHA18dffa6f37cc7e0800e1b47d6bbbea672b6a1c47f
SHA256d4b48bb8b22f3542f73c1a9625583b2167d610219b15cc7a700e274d7d0cc694
SHA512c876583bff188680d59ff3c4a84182acede0053ad6edc5e8053ac0591602d5c29085c05f4ee58ac27ba89524288be5cb9d6bd491c3b79fad209c7c54d9aa8680
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd88bb43e6fd1fae1f34bebba4745fcd
SHA151a83119bc0972d3c0f4b9524481083c75874e47
SHA256b4cacdcaecabd75c94bb3df1410b7f7333ad2da451a7234250aa146723d43f41
SHA5124f435875e0d1ec944eff05fe9d38c31325da4fdbf80d6bd5a3581b751d6f8544bfe7346f6ff3ce18f3fa318a8e513dfd1ba1c98ca21113ac86986ebec6edd5e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fb1cdff425da9cdf02cc59d043b1b18
SHA17ef986827b38a56962e1878d8d29b1cc2566ae76
SHA25662f7eebe6952417a3175bdacae6b59bb89f45c864afd9f7d0f9f3f1d99102825
SHA512c19757e2604825fa86b3172e6de94b9ad250a4cbb7b43828da2321f10e5204b16b2d3112dbb19ede290cd4e848d63701651a2e342c2d79ac6578b9413843832a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2c49b563b7773a047e7990fd0b046d5
SHA19566979f96f894382164d5780e123740e0d1ebc4
SHA2561ad8284d5b12105abe8d369ce7586238793d0f3c4bc390eebe0fa9739e98a1c7
SHA51208c10baec0645f8206ca04c8ca5e32f0d7f9aa106758547eb6ced29de73d8b349ca7af17f4e1a211739a07648bac5355c3fb2ac07692720c5e5245caa28cfa28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b61678420814fb245d1c78ef21777a2f
SHA1d6fa348be3f2993d5b5173d182b1758286ebb52a
SHA256c4c8ec9983b49ce0ecb791c0f92aa204ce219ffcab01b9577dac52d30e9457f7
SHA512be1f1c89dc1d34e637309e930fcd6134fb0f510c3d7054b447fbcd79d0d1f726d7adb7015ea5ba1fa4f964f5e3671b25b1dfec5db73a691721e3892de4259ba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505ac13e99fb13cdea369e0e5912b2694
SHA1a5223b7334276d4bd7ed9bd4723d13dba6f6686b
SHA256c3cb91ccf8757479ced6ca60e3353c8940c9851eca9f86751b2852bbb3febd10
SHA5129c87fe5378796f3d9a685344a75d0467e61921c34704387bc39be4d1412dcd03caaae124d9da3e55dfa2666b9e76eff211e0daf57ab8cda12dab14a1192756e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515c518f5d437369121e2a2105dda8a5f
SHA1005cc3cab82f37502cf5c51eee97c17d7cc742bc
SHA25683a84086d18bea2988972f6698eb207a1fbebd2a72b7a031e16d5416d15255c9
SHA5121e52cc03747167b0436f7e1c569c883e88f69ce0c62020e853a1e0b8c1e521a74ea6094b2b31716418ab43d1a4bc2c3a85c05af4a0e46d1ad8e8c5d91f5680de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578d5ce820852d0a45cc101117cd9bc61
SHA19a4e7869354347d3e7b1def451e7d6de4da4df94
SHA2560c645d15fc476cbf787cfcd10c263d4b879f4318efa4ae7515e5736417c630a2
SHA512c20aadc5aa0c3af89b6668616da94a7b28c46effe6b4c8a76098733be82185a9a31cfe57225914ba4ebe0e9199f0e8572fa5b3415df9b3784bc7339bbee26245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591bb5307eb3e328dc17f7c6431ce53e0
SHA1469269bf52fefb8a6d0af1fb99f5cf2252175aff
SHA25641215da918fcd45a4220eac421a2fc9db91c6dd93229706a23f851b6b40bedcd
SHA51222147190f1ab30ec72a2bc2681755e9ec5577b2eaa07d4e0310526f7b9db8386fcacff1525bb3acbcb53132525138892f943647beb84d5ab2af1635d2db7dfc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0a4ce9345035ffcc7d9228b286a46a5
SHA1e2861cfe132b8a40cbd5e858778140d3f07dd7e2
SHA25671156fcb68d82237b059a7f0d34918668d79d9893b94ca339cb3dd70e55146de
SHA512f84c53dcd5d5843b4429752e195e44b28a1c62eeba311f370f72686142d5f3fbbd35c5ecc456cb53a3b816429f16cf016a091008a6f71b1ac4ed4e5faf75d847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6bb7f013915699d49c2bc9343d1c6aa
SHA13fc570b4ed3aa69b583153f9090960e5e5f3e061
SHA2561a69ab29956c4acc25dde9e0cfb4e2cdf03253ddd86d77b77c518b07668a3816
SHA5124f8b8e3df711ad483bf01379dee65880977dd49e732f9d1664b3d0d607f63ad74dfe60ef17f9ff29317027d1a16ed433d1ffeee62ba499e6f090bebb83030836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5061574dfb09d4e479dd0f26e6907aab0
SHA1002145b545b1830353e2fd201998aa74e33cf709
SHA25638244f713c32a4a7c4ad586777a091eb927311087cbba43a1b19686a69453904
SHA512ca8df8b9d192c070abe5d71fa652392f39ae03e4b45b47e5d13f3fb5f241d5b174cc6aceaeda71197da54e6eb60fc9ec1c6e967a3b264363eab02843c6073e1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ca3f06991dfd3f612776b9e2d836fdf
SHA11923ae1e547e4ee2f9a0d91de3b3ba6541f14ef3
SHA256353654201ffc4e1ae6d8f4f856693cb8dc0c6910033383dfad82b6291f12e4ef
SHA51246ebfc01a572d6a30d7f04dbb019fdd4be71756be3bfa324aedc7cfab45c80b3ff063d2eaf606c4abd4821c8aa3485a661ad60ed144846650fb437dcdb24d637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f807f4ad9bd00905693412d52251913a
SHA131fb36c3c90284faaf039f336cb68bececa5320e
SHA256370774702da7f17511cc70b502b75f985cad7910b41cc49270aaa849ef9b7792
SHA512eabceeef92ccf1687623f2845119f3b3ab47f4d05124ae55b6b79c6ec69d4c7d30eeecd7a34d2e2c7bd426ba6982df2e649113148695626ec26c73d7d181df46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c22e628e75a9463fa5bc58f284c9e165
SHA1bc98506ca65ad990bd685937ee7dd67f337da77b
SHA2564aff4a3f5f07825939ea4aa0562ac506854197b360cde0417ec682bc63e1459c
SHA512568e56d4ed8027b38946f3a818a885cfa487c5ac9ea1a15cf910089f560da879ec6e4ab3cd75895539efae9e994529e3e857a35790b847f8efdfb468f7b328ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8022af22aca8d1baaa55d9db1087f92
SHA15fb3df7d190fa32bc2381a9484fd00b14a754888
SHA256ecf6598fc1e166faa5f0b6e0ecde7b7aa0ba7103f9dedc86a80860750abb4cc3
SHA512734233ed3c4b5871d459c258b43a2eb9c9aeee42218a5724b734564bc977d52a564592e92bdf9828ca0f6b0191c7e4eec8b298b268e5eb54edd7bdc643ae131b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d23f65428f370b4c395ab8830d2a3c73
SHA111d92f00d0de3b3d2055ab471823629ec62736f9
SHA256f91201fbb37f8104083854168892de851507516508e323f592f274b750c4f3be
SHA5124b0c34316bade269b3c406083b887dc8fe18e42d6ef83506ce6d63e580102299c03ba02792a7a3cde67342cc93bc139036f24b0936256b82ed5305ca51bb30c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8776c72e21a5aa511ec32f4b000400e
SHA1db7d472ad198118ba787edda33e0aebd9c30f747
SHA2565791268227f2dcecfebffad4e772e5a4850179d5dc662282afbfbe11629d8605
SHA51256da14e55a5bafd1967300f3c9f206ad29721bdbeccd8ef9f749b8c4bd6cd2ef3cc1b095e5555aa56d1c3cfb8c4545b2683c805c19b43a1724034c2db30ce5c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0abc1227a7f8d16a45b9d31c90038ed
SHA1c23866015bfcc2e3ceed1d25e756935445b4bd85
SHA256b588852a889d6903f8a33ee1a9cb3774c0592e746530a33e1639ef4da7032353
SHA512a5a97fdee32d3777869ff818a2b614cc6d00809a1d86200a249983de3f62d824805b9306f641da039c9d27774389905879599e4cfad020711bad1bf04786a5e0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b