Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
445385f0c244f2e0857e7573525e9b76_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
445385f0c244f2e0857e7573525e9b76_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
445385f0c244f2e0857e7573525e9b76_JaffaCakes118.html
-
Size
13KB
-
MD5
445385f0c244f2e0857e7573525e9b76
-
SHA1
49e91be7b288d2794dc94f1d8c5d3e87a90ff03a
-
SHA256
f83ac2364eac880dbdf7c5ee4f132cd275d4039070b864ee91f18f03f5e1cf83
-
SHA512
6eaac151a4cce3c9e8d4a938b3390b48d58839b7ddd6d76b49ba222c192691b4b526f319f1c81bf146b4ac0b0ccc0c8035d6083897633a146545531caa6a9f6b
-
SSDEEP
192:csz74VAYS/Iy+AI53mMayHRPqhCjg7VLdjHRPgI2ShVoW+HRPPPHb76f:c7VAY8IyO521yYhJ9dj28hVoJJHS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000be34ce3f5d67e138a5653fc832c64d2c866909010d4a6a6606fbe8e897571395000000000e8000000002000020000000395dcb1f7f94b79c3d4aca3eaa1195612508e5624fb380c7557a2d3392aaf1fa90000000b551cab479d5d0b04f2c89728eff1d0b638d998108fdc075b220df09901b4e93032d3fc39c9347782060cc041d8e608a357ead6538b9d0ffa118921f56deeef866996cf4b22f76c06b09962e10dc09058381a07aea5ffee6f6644ab780419fcbb0a27f2dde2db56eb4a1120b8b4263a4a71d4fd43bb5dd8576aebe0069e853a2a966128e99e8ead7d5366e9c69f3c3a34000000009e436197ab955995b450d411493bad4ed2a13c2c3d1b9cdfddf8fad1690dd8a2beaad78ba6d8e35183ef9168b13564477d91977a0bcf84bf5c2110911b23a0e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E1C4011-419A-11EF-916E-DECC44E0FF92} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807d1223a7d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427093513" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000ac22c072658c98ebccff02a0dbf0d84e433502c24e20c210d7f59dba9d9981a4000000000e800000000200002000000060acee9877893e6fb5a9ca18579ec6ce76d4283f343c29059b31eec8424cdde72000000068a433471d102b046e2045bd2941027c366aa08147f14c873fdfbeb79df8c10740000000ff098f6518bb5705ad225c78bc646d41596c75317003c9a72a9aaa00c376f95ff551ef70ed4a5f11ac89c13d505906ef5529fd9ecf7934f86b8a77aa05e57498 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2852 2212 iexplore.exe 31 PID 2212 wrote to memory of 2852 2212 iexplore.exe 31 PID 2212 wrote to memory of 2852 2212 iexplore.exe 31 PID 2212 wrote to memory of 2852 2212 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\445385f0c244f2e0857e7573525e9b76_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5464312aa1c157f9d2d4b2698e7c637f8
SHA1b0261985248076269737e552756566144108e721
SHA2564e7b9129644695a6978a9360249f16fb4e383816aa61310fa594448695a783d1
SHA5120bcb871ad3c9b984fb9e9590a8023000c7f7367218f8fb254fceb8782d682390425046eeabb50f4de38c305f70023b8692531ebd747b47169641ad6e09704af4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55941028f51fbe52f37b5cc095cdbf82a
SHA18675723c0aca7d74cda5080a91c43becf07509f8
SHA256b2670df748193f0feca62291faf0b8639aa2626509fc3f80544f78f778ab3c61
SHA512c17c8227f089d84da1c287eedeb9845bf41b534ef695d64c5d8097cdeb442737db9677275986bfe8f88a7039834c4e9950e504d31b89d579995c3d68bffa6572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5291bf03fabd256d9e02f0f2d5ffea6da
SHA1c3f8a6f4753b3c56caefb2fd86436a1cce674dfe
SHA256bbeeee8d436ac9e075287390f8228b802292718f2b196b572a8876102cf3943b
SHA512897cd2ba5b8fc2892183def6431524fd9fb7e1bcf3c1285965dcb552c8ddbcf98509bb5c4c4f94b47a53964a870485dce6b7ebbf4f94e1d23a81e1c153d665f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5398e499e788fc258dc335c2ada885cb6
SHA12cabe77c536a7129247c4bbaf3694ad49ce9e59c
SHA25679bd476ce3cf2cbacb0f273039a88bc688d6749e65ae972edfb9098649538833
SHA512bd0f9f92824f6bcf69e1a1167af3582eacdac87d1c57513c3d7bb1cced82d010d18d995316dde583e6545017cee23376c508591a15d21060b0281f93f50d1c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5876834296baeea425910706a4927b5e4
SHA1797915df23ce0ad1b10c0a6c724f207c8b1993c3
SHA2560ca945ab93e09f65eaec688c22fc84ae6d1d691016aeeb29245a1aa3c8ed0174
SHA51260ea8bf2091a0e4bf202706860ece8f7669af86f0b3a94a216a9bb51f9f02ca888c814072a69cc4d12308eb286c11fa4f179a74920252dabd6bfbfe1c39e943d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5dbf82c65f45706e0e4a7e36901fe9c
SHA1c85b08225ed03f867104cd98639f959c347bfc14
SHA25632c7bcdf445fd1b9dec1b7f4eadee0a2015617078c53749518a116953a56c1ee
SHA512766b81b011fa1b4d13182ae9391c3e4d899f07ed1e9bfe1a1862d12457c86790ace941a1f77385507cefef8c805c72aa9299d85261efa5af024bde46980382e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3302730a1e0a64be32a6c02dfffaa2f
SHA11eaabf334fba1ffef19086c9ae3ac0a0c5070150
SHA256fd59f0b2d0485f4894f963c2e0f0e71a7f27113126ff7a652139c118b43467f3
SHA512d146c39aa43c63e2f19959fc1e9e8f7c4e99228244a24f2281b5418334fa94cdf1923ef40078e36a62335eed8dbdc9dc593008ebf9ce0fe6289df29383a8cfc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53215de58c0eaf99a24c22a3399841ce9
SHA1153eb97f04645a0dc9c20053a4478907c2e8c6ad
SHA256798207c6a314c8bedd4a76ccc76854c82857cab3dea7783bccecafb9cd5a2c74
SHA512967fa006723fbf4bce25759ac4d5e50cc021e2f066aaa65bb90e30e84d189dd7e5189511c086126d86ce10bfc74c08cbf58f7d810695ad2b8099586ef40febdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5872e24f159f7bacb6b36db76cbacccea
SHA15437dcf6d2762abcb5d4615aaa4aaf0c816c8b3a
SHA25679f5392860ee3350155bc9495ddd90ed726cd8891c9252c39de1f9d91ebb8e64
SHA51266700e35a2d79f6748a116a44f5f846aad08c7da7b6a84e17b3921cda9e6b4f0966276fe0ed8bc7bd4c0ea6edcb9634a125fb3c2cf55431663e61f51dd4e9a6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b48a66a4d37618988000ba4a685befea
SHA1406da84a23aa51110e5930e915dd0da7f430b99e
SHA25678a945505ba10e40ff76b313ee471147df8d5963a16f1c8e3baa0b5c638237f7
SHA51223437525036cae52dabadd92dae1a70a1106f3944ce7f2f65e42009bb707edb246e719adc0d936f8bee37f1071c7eed7dc028594f32cb43642b9e1e9686c4a72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525a5255092b5f0ad462148c8e499fb67
SHA1155d4f5da826f96457b8b138e609ee1d7b7e1320
SHA2561005fdb7bfcd0f39d21f1ffa99a62e89bdd0af969402b11262c63bc3c8fe7a09
SHA5123401db2522a216f5c15cc2edf4cbbc27a5b6ac2c9c3a69b9d29474b736efdd8e4cbe313b98c1ec54e4eac3e93ddd67908b8b0fa684ff78e25f121e1d5e2eae5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad1a7bcb3aed7cc554462caf10e800cf
SHA1d194cf0fce3814bc6e06475b8639c19df1374e60
SHA256132b77e29bf47192592d4668be52341bb7566e5bde710a1bd2b4682333447fab
SHA51236d7943a505dc8f28bd3ed5967e42684726c2ad9eff2dacfdef6d31950dc038cdf55a1b40141efa3cf7471f9ccf90a13c8c5b3d7a95e3bdd6a74c78532a59bf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c96ab002abd6c8c0904419c8ef8bce
SHA1c1ac86bd526a05bda3f8cb4a2cb1e61cce07102a
SHA2568e96a34dbb567fffaeee7a5616c48dcf6d3d2ba5d54b2ccb37db70d1aa74b959
SHA512b4a32914eba541bf9231fa7b77f602d6ae4222c424d850348b4fcc8f943fc688443299c71da6d716563830b04940fcbe54113a82ee3c83193a41075f8d3cda22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e625e9ec8349a01ca5fc987d64a5f67
SHA15340b3345db93a7ac568143e5e8c3612a516c6ec
SHA2564899fe93d1dce2da66cc478959c1cfd9006069ee586d5ea1f537786135957230
SHA51288fa32cd90e5e80f4ee63a30c130973f695179013aad43fedaee06ba874e5f9e03496f8dff2809c4a7865f3036b89911d7162f94d5c1006cf7131bb050b197be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cd20d7ef9a53296fb6f0b946f1b7eb8
SHA1957e7d2be099df5e130b4b5b6a649a8b59385eda
SHA2562a5c85100c912b7f7333ed768df3b4ed6d06ef617a22790fb9a726a289209985
SHA5123d3b2f5f11491ac8c2d5a013c2b83695b9bc82ff09f91be955bb7008714a18566ff067a8c464af6f88676528234d65dd930583d9738eeaa29fbfdd3a18b77dd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583c7e7802efbfc3e137244f03daeb74f
SHA11162915ecbe974d0efa0161cc030bd26689de158
SHA25644cd11f1e4d71e220a9fa5d222300145c5bcda3f1fc1d26c108e6028ddbe1963
SHA512eed61cdaf72d60e91e631c4e465b9b178c4f303f1d8264b867749441644fdd492de7db327ff946746a6ff7290e01a9923c83eb7ceaaa0ac972813052bc0902ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560956b014e7bfd7ec73790b4968e855b
SHA1fb0046486bf6dfad2bda7c719741f39962575b44
SHA2569e02b6ba6f86e3a780fafdecc799aa01cc231694cd9b95801f6dc05e75ce122e
SHA5126ae47530b25f3e9bac91c8f427132dfb460c3452f1d24a6109b4548280491715a94da0efa140f7782ab7728554ead643bdaf527b25c45d8046898488a56695fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572e2cb03b2f3f736e53519455b2e86ba
SHA1382131a3f251ded9aebe20987f36e91af6879ca5
SHA256a3141962fd7b394fa642075b10522a1013ec468b7360a8aa07322cfaa5d2345e
SHA51252fd93ebadf10db9eda29727407d2d2e069029e00a555daf70f72f919f3644f59a87046cc3cbd15282e9823491eb39dd29c73b9ee4207e4e89a47ebcf310fff8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b