Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
4455809a6e51017ed3e5de83b37df055_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4455809a6e51017ed3e5de83b37df055_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4455809a6e51017ed3e5de83b37df055_JaffaCakes118.html
-
Size
56KB
-
MD5
4455809a6e51017ed3e5de83b37df055
-
SHA1
8e04ba00f6b5cd75995095ef867af1364c4c3723
-
SHA256
96a302f70757cb6b3ebb8af39961126d9bfcf1a40b751446a8a42f8027c72421
-
SHA512
1b20e98968d1439985d5c8d8c96d65b5ac9b61fa451bb419b11112d5757a4c78053ad5fbc3baf80688c10fa8bd070a1beadad8e23dd7012082e5d8386317f0b3
-
SSDEEP
768:Zcd9QZBC7mOdMIrpC5I9nC4D0obKVi/HUMpPd:gQZBCCOdP0IxC01x/lpPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c1489faacf0b01a075046edda7d2a2bd6603dca68fc268168944eb211ebe921c000000000e8000000002000020000000bcfe2fd8866ee11c963fa159649c4ad40ae8ada11923fd3e681ad413c0f7b0f3200000003322c078b601bb5bf61a3d8eabcc3a579d0ae77773198c7275b4841c7dbacc174000000056a78c4476b7ee157954ffd34d33050e8838c37c1fe662c1ae44a8d13297a4c9a9285fd46aa0eac56fd3a477a9e3dc4e17b0edbd1ebac59255ef14573b3d8ed6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427093689" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B193F701-419A-11EF-80BD-DAEE53C76889} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03d5594a7d5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c669dd7aeadf8392a9df66b92f1c9173758a76ba46673c35808a5a135364e6e5000000000e8000000002000020000000f37a3aa893bba41311fde86e7f4a85716651cd4ee9b33431cc98a1cf7d197056900000004f4d0baafd02e8614f228cf5cbbff0d2022daff2064ef412ce2045c6da98c8666d66c6fba0096e9757b0d22418573057362009c03b23af18493613a6148dd5410342fd83c12985b7a4e7acbf803bbf4ee706bf1b2ac2c21486345babff45044528cbfb53453919113256c38f624401e4528d2a7a2199f3e65051a7c45d24c9ca56383daa9c4274afc26a0924f85f704b40000000ea8e53799d44dd4fefa559ce797415e56d3428d636fe14e5277f70a0ea73b1c79167e9d11919c147d3b585d4b473e15f961efc7230aa87c79203d9ebbc619423 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2548 2280 iexplore.exe 30 PID 2280 wrote to memory of 2548 2280 iexplore.exe 30 PID 2280 wrote to memory of 2548 2280 iexplore.exe 30 PID 2280 wrote to memory of 2548 2280 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4455809a6e51017ed3e5de83b37df055_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c331ad0e78aab6715bb163394bf0f715
SHA16b7272d8521f02cfa3ab6d68add7f0af84cc2405
SHA2562c346fb6110091b2ece05c117bafc949334d2494406911a19fb1515b87993d4d
SHA5125144745094f2ff7978a3516789b99196f7b4374c61406f64b6c6d9fbfd724cb45114b4da365c215e9a75e382f1c58fb24edec5f83fa6952ca6eaa0c42229a2c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7fe0938024ddef194b86a83543e071f
SHA13a6bb08d4f94ad7623021393418198d85551638d
SHA2561522681aead5683ab7803a47600a56720fcd5ecdca33433fd6875eb99471d13b
SHA51276e2e37b031b9c307678d9201409c2e5091e56bcea59cbf05c331341e255907181c03aeef0bdfd78825a49b3b10419931d98392e4a35f0618ab7c7108f310647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577fa28d9e3adcc020cb0461f6bc96ff3
SHA1589522598a210581324f5180e4c3745bf33b2307
SHA2563361c02853b17e8fa0408c23ab07da3fa23de46e1304fae1bb97c394b80ef29f
SHA5124ed1528497053fd041e1947ad057ed0d4ce6b44567f15ed74e84cf1d637c719f45b8ae10e12a0fee7a67401423552381bbea4a0b29f59ff9d17076aed28c0995
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c980f63db124d53f63b676639db4c9d
SHA1fdc15c3aee7d3f9f4492eff8f1ae0ecf5fc6d754
SHA256392677e81eb969e43b3321110a26c56f9ad61c11886dccd91eb5cb6d6af6f710
SHA512c0a7c7f3877805f3c6fdf31b0519cbae0968b82c95afad3352d222b764d71ba803f7f2eab219ccef5aaf95e7602197c042be74997462add1356325e942823b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51af8463c3d9be3b48cb40a2c9551da73
SHA146c2e56e96ec05a0c95eeb04b1b12d6560d538c0
SHA256b1d4aae63aaca74206119cf830ac873fc58590ecd9ff369a2672396a5f867178
SHA5124fd3c15b9bce1117565e0a9e829dc1f69725dec38ecd0e7856ccd021c74ed8344091ed2dd7ffb40947ec191a644ca48d1dc2182d54c32cbc16e642bf94f9c4a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5870e346480b7b65af934dfcd3c41f81e
SHA1cb24ce574819a9e626bb515685159ea7bac79a6b
SHA25685356972a74c754eeefa64c42fbb4e003006eb8f61619ac118e9d205c41e2033
SHA5124576c0ec0b1b1d2ae148bf0cbf26387000221f3d878ca373c70a3d5d1b81e3003d1b792430ccc49e732bea0f4e2a8d52c5609eeb1452c5e309f92988a40271f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e4eed9aa19bd3d5eca6bdd48c292b96
SHA1ceae0d6d9f2eb2a8aa22730ecf6b18aaad0095ee
SHA2566078db6da537a8df7ac8013f36891aaf44353ee76f0a0ee47c4e9c016ec857e7
SHA5120b1bf75e70d8ec89b632a6a0ad8af186d28fe5dee6511984c40e71c037a3f1cd00109a699bedf22cd02b16cbd64de8734bf4a8c2646284533c112861be4a85a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a7824c8ffcce2f5d07073a1d2928496
SHA1332e204c3777430d035eae6c587132344517b5ec
SHA256624aaa54c2cd6a5e81a8a0822a737ac29e315dc82a0eafc4d100b1e348646f04
SHA512e561332a478df22af797dfa3bb6245a787e4b0bf703d51b7e3dc420394b3d4d50cc8cca042a4c2c474eb890ab460d239f7212255b71edafe17bb3bfcee2f64d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d69bf4ef63ed9b9b24abc4a77bfa5e87
SHA1b6fc8a156d3283f10734a274ec4fe62c385c683c
SHA256cffebd8b557b454c89fff79aa185ccce9d37448e95b4dd5ca52eac9ded088fd6
SHA51203bf38c79dcdedfd909063189330e0147e54ffcf691c8b6a538fb33b7004e388bbc4052609a20424da4a4f752c1531944db0872896943e60b009c896c46c04d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59504f9fa82966a944a0bbdb81c4ae1d0
SHA1ec425af2aefa97068a599d4ba6f6725d10cd0a48
SHA25670c04eb252de59e74b394865515ae80c2b885998bf22c43ecb3cc974c72eb0e6
SHA5127643666c420c4b8ebdb23e3222eb5bdb439cbc624478c990631cb5cbc966bf11d070e01e7bfc3a12f162540a514f40662e9866e10b5bc444fd77d052d52f2e09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8b42298cf2fa48280e470622c8d211b
SHA14f1556e617e230974609b4bb10ce0b346bfc40ea
SHA2562a7e79ed94a35bfa47169bb125604110a868eaaee29fc28d7ca568d0a47b6b35
SHA51273b84755a258e074c46c273e76afd9e5a14d7d20d13bd21a6c2a950a83366b643b1b2ed7a85ce0276e7f7622b87305e5f0cbcbe33ba3cb29bc09406d45ebad73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edd98e9d6f4ca7c46ef6509a45227c1b
SHA19f58362b4c351be86350310c831a9a83beecb5a9
SHA2567ff3ee552a638b2ba0c59697e7d6295ea24fbc9b781e31ea0d76591a1c1bda0d
SHA512583ae578f59167711317c3c3a7fa41b3ff6a3512d16002dc77efcb73985f6e9cfa3759d1db309ed79473b26c9945a8023fce9c70b75f36fa693da279271eca40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e5577301e62b869f43089d67bf6e82f
SHA1ca06fe061b285ad482138ae00f0de20b20ad40ed
SHA2562c9ab364e944ae62b719d18f2b87f74e0d35e5e0762de771d36e8ce11a70bbed
SHA512dcd2fae6a13fe5507d933e2f92090f3180939173e54e211479c69e5824e7d90eb589bb2c8caed7ab241ad5565385a16586782c2fead1a2083ab97d8beb361bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8483ed288bc7c464cdf8302ecfd8762
SHA143bc27b742dddecbf19b219e4b301baad9170129
SHA256c24a271f3e9dd3b9cdd4d3eec792cec278bea2354582094dec5cbc62eb8958f3
SHA5128e49ece77d11124d9e10c6cd561933dab6cd111a22d20f0a630c5abf7f72306dd2b3bf6255566a929c5abdc281ded466659fa79e52b98e31a372478b829d5740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582a33ffab2395df48e99061a59519553
SHA1c54e052f206de1f7011e334bedccf5bf32243335
SHA256d79ad7d145032592370cc0dd686cbf75b21a1eb19b9e9165ad864f68719412d4
SHA51268faad210558b42fdd799f7db6d7c0099bd1e701a1e2951f5bfa7fc36ed080f576a73bf10efe0ff5028de2e3e54ddcd559a48dbdd3a2f99f86b1a26fba9f564c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5738a629ad96752b8d55bd7ffebf27afe
SHA1f3e79f2cd5b7e14eb84631484e5505c65ec00aa2
SHA256751ce41f851528796976d7cdbee074b48c84fd02ce0bb4cbb7ae66cbdc01db49
SHA512f1e34b76f4c94d0355840b59e83f280d9f0dc257a0266f170a6037ffc2abc08b37128e703016780b6268a9c4214c4638b2b5a48b2070a2eed26038a474719421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f24163db57164f110ca6f368e578454d
SHA1fdd7061be1ce91860f1bd78faeef86bd668e42ed
SHA2561e3d2328118cb4fe4471bcadc4929fff071383d58e208f53473586561f3e0c15
SHA512e9ae271923fb3bfe184d01ac1b4a98e725bacb19ee346f29fb4b135e781a19acd12d88d99b69a0df87e8abfda7d0ee2ea5a2ac73e8d9d489f3842eb15791be5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fb3a23130b96351513ca0ced0aca5e9
SHA171e91a5d2dac491d6771b4ee6dff415038e77843
SHA25695d1ccb104ec00f6a77081d0c5dbcc3cadc93807f2559cdc8c064b387007b6fd
SHA512a9ca7ee9d0c76e381e20287c652af73ac4bcb0f8b5849902b77c415fb5122745c060f59803a10989d4a1af3e5a1339c0d09661d394d74d47c093cd7761c518f3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b