Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
44c9e2db31450d621ed0b829a80b02d4_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44c9e2db31450d621ed0b829a80b02d4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
44c9e2db31450d621ed0b829a80b02d4_JaffaCakes118.html
-
Size
26KB
-
MD5
44c9e2db31450d621ed0b829a80b02d4
-
SHA1
824b5bfc55ab83761877630383b74073d963caec
-
SHA256
04b6e148cba5e7bd2e7798e7ef8046dc8623c389df5b85a863f381e96434ef59
-
SHA512
772614ea20ef4d2de268a21063f706ad0f34b4c9fafe2c4ec34d443af297aad6e36b26f73871264cd5a8567a0e4a28c750fd8eb182b02899f5a23c86977f2102
-
SSDEEP
768:D1KpKVAqnd+qi9q7B2LLspsmfpM2S0nrp:D1QKVhnd+LABWLspsmfp3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427102401" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF353231-41AE-11EF-8B50-EA829B7A1C2A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000a71bf623417c3d1e1db8647142e0e330e174eb80f4bdf5cd7b85525de94e19d9000000000e8000000002000020000000e139f1798e10a52f303ee139a89c14189b3e43abf3d6f27d09ca96e2777b353c9000000020239cfa34fffafefe4db2980d8a630afe6a44ab6e94d1da90dc2b97a194044a050f6181cc8f701d258519fae2aa424fbad6dc77f837cff631651f700ba4f0d6d36b42e47082b189fdab1a4487f8ab483fd72e10e319208d12c5a3513a044a16053cb358f15abacf5d49c32d96887a3d8bbe49331d090802e727c607681faf7b2731cc63c8726e4d11319fc9013df00640000000ac453cc555042155ed6704420885ac7a7260c9ea396b072033f013fe4e54b150d4a82e494ee9e5893a4ee57d0a309a62828189c81943eba27924af84b99f2a15 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902425d6bbd5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000ca76a43ede5dfab0b10791f2550ccd189851ad4c6db49add93ec196111984c3f000000000e8000000002000020000000fb589e03c9068f7c056c8763b487b139ba63ec6d7c41740ed81a5d5e6c56f042200000004667051abfe0b58649cce89249fca393fd98304aa34201e31be62c74d410113f400000002e50ae6d86e1ee55111892c6aedf0ac64d09d3e2d5e106b3f83299a9570b3f0db03e6b2671474e59012667a66c418d4cbfb616b23d212d271f2f35afc6948757 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 1684 IEXPLORE.EXE 1684 IEXPLORE.EXE 1684 IEXPLORE.EXE 1684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1684 2548 iexplore.exe 30 PID 2548 wrote to memory of 1684 2548 iexplore.exe 30 PID 2548 wrote to memory of 1684 2548 iexplore.exe 30 PID 2548 wrote to memory of 1684 2548 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44c9e2db31450d621ed0b829a80b02d4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD5cc5ca124148b0b99fbbd7c0a3205c45e
SHA1db79a96e00faefe374cb2705b53f91d4f0fd7b17
SHA256099d9ff6231037ed175fedfc6dc4f362f56c6519a170f649abd3a6fb575f216c
SHA512bf2636b4ec854681f20a550ddca2c01d9a02a1a8c2ede02ad1b29df7217f62167323b1d4d4693493dc006e77e1beb9a727d0793be7b56a9f8d545e78885c1bc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5957de4be96a66058d1342828b06227c5
SHA158485726269986b8e061d0ee856e2031a6eefe8d
SHA2569d04e080e39c38907e5f80bdd399edc1de5e9c3188ccab1508c54872b89b29bd
SHA512a5bc61312ec0c5575b3603c4605de3168c51ba08fe706b7e34175b068c497e0fbfead8e38c08f37bee10fd3214493eb85d267ff75cd59958a00d70a35e129015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bd087d0e85300f668287d02eb0e8492
SHA19b5f9c4c957d022e96117bebd714f5d78ed1f096
SHA256a9e442f2cdf14b827587d2bc67d91f0f6426544d250c2fc976a555a139c86e55
SHA5124f08598ada803617664ff8d03ad40c16e515efb9e0dfb18165fdbcb44538a3bce246a2a446e03905e25d80c7454bdf10d11574754d7f709ba74e9114f3662d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5121c7936c4cd0a6463b6a82c8696b847
SHA1243625cece0a1b60744a226730c2196a6505d9f3
SHA2566917df6d205045fe907f76faa6d21d6e21d2b6875c9f389a4b49950006b02abb
SHA512dad54f1ef9021c7ada1a55edf87f3cb05dc82532ef1c73fa2d4492d7d529cad537dc7aaef2a6e241edd63f2b4a6457bc0da5d1af55171eb56095b6922247d6d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556571cd3b5d678fc9420f2d9f03edd94
SHA1de373a2917599d5dee84da39211e4c0cb42d2c0a
SHA2567e0ce45faf867efda1574c344c2f2fd98e46aee4221111678a371c2cb21e28d0
SHA5122347958313a39c9f8809063124c0114947d83272aa9f98386d554fbb222417575b7bc2f974932e4e09a8e0febddbe64b61b0b5dc184593a18e8b764333ebef98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58869c3747fd43c3ac730d90f67178724
SHA19d5f8076a61d35bd4d074455d2399c31054b906f
SHA25616d2109c513496437557c50f16920759c85d5a6b9247431d43b901eb44d7878e
SHA5125dcf3edf69fbf7be9a67d73d424713f11eec3d2a3be9694c5f40504636ac8605cc1876d956292ca329763c9a49b6bc25761b67e911c0ea27afff786b1ec870cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdd845b2d307865aa3e75e87ef8805c1
SHA125835578e7fc60f184bc50fdf93d39cb291a8d60
SHA256e59f72aaf87a69d3ee08e4645b5d0442b14eb398eb422426188b4046ebbc5987
SHA5127d3a427b938d54179f6e63e45c0365d006ef287235dc1a42e4039a17cd9a5618dac691500de1dc8a12e0f67cb06cce9394ad1f6fdb69f159c33f7053de0cdbc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5937e5baafb5d9afb5ca44b29c15037ad
SHA15041dcf0d9c7ac9ef3e14033cc80b2dacf93f811
SHA256eb949bedc7a40683a4dd15fe89735d781d4a6dc2c35f417e6f105cdf57dab91a
SHA512915bf9603117303360d655437d05feb83a33d64173bfe3d9e0929e3d21cc5b4ad845c4e908f3946d927933c15a4a3a1ea256603ba661924b6260e6018d53daaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579591a1a02d4b007ad45010479f02ba1
SHA16a28200b1830bf5789710d61951450736e8d600e
SHA256a34b3d459287fd6c44e5afdd99f819c9a73e92119d065e2a5202f508bf9f90b7
SHA5123fa786427e43d6e5a598456c979df285956e34ebbeafb447693aa198569cf2cd61218789554a209e59facfb9298fee30f14afd0cf369e63c777f2e9de73bdffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9e23ef122141370bd2d460cb8dabe42
SHA1495e435263d4306d7b13a0d67f1cf2db0cbbdd75
SHA256e4abe6eb27183dba491e81bc09ce95ea0aa034e8cdb7617dd997a6dcb5056457
SHA512ed28b44d59b94feff12b6d821e5d3581083d2df3eaf785ebb6672a43cafb60c86eadfb5ca18e30c5840fa785b554922a068680061813c1d062c110f3779abb0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba537e10e8bd36d49ef0b791d00f7539
SHA1dd9a52b446a576605583222ae357859d1cdf510f
SHA2568b7a30d621f838bcff1fa2a6c6473b9749939e8a4565eead2f523fc9908327bf
SHA512c314a02f1a9012ca1c9256442d1f502e349b3f58a45f70ac7f38a94f96e4370f9e14f7b109189844da2e7794c089e9f56b61a742fc3bd2d22a188e45e0ee15f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da824c29c1bed78e9d1f0fd7709e06fd
SHA1da5e3d3f564804fe6017ef2f94277e1cafd2ddfd
SHA256dd672c4295309096fd66fb8d68db60e8ebadbef983a68b5ef60c2af7cbdbb647
SHA512e52a46332c87d88237ee4b0759b3dc274d873d00907c1bc07ade72f65f9eacf37f0c33424b2e441ddd76cf766ab531513ef57bc794c5bb513c855b06912ab8be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce493e4648cc9424cf1998c066f58ffb
SHA1cb63a434135dd6c4ce4c88094d22f6b9727b6f01
SHA256a48ee99e6169bca14840c2b255e29ba222c0f7f27e587628f01713cc47ed7216
SHA512b168b975fa50b53baccae24d795fc0183054af4fc325b1687ec940fb0526aa4e9fad7c6964f5b47de04878c5a8c0f1f1d83644b873b6f4a37eec0b15c0db6278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50904d17844c01fc17c8c34b7876afc91
SHA1d0e48f8e22924636684555a02bc7197030726502
SHA2568caa0c84202ad153942b315c34a78ba4efced71b9fb31a61e0ed593c1015488d
SHA5128d2b102e1e60759bb1ef3b099a87cdc69dbf85bb9edc00a0afde8dbe0e567ddbe20ddc48c8454139eef27d9f1f097db875a30a28590fa0f17d4696c3ae26aa32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a76e37b36976978b0f5d1bdf06323cba
SHA1a6bc16da43638a1d932e9f230c72f4c5c4bfa36b
SHA2564ca8670b90b89d03c4c9109ea58c01cf6f991d22bd4721cd8d39f2b0e7f44af7
SHA5125c502a94258b53c409d7e29648595ff6d77e2941ac439ac71c17e01483ef83141c9777647703c4446337bfe387c5420d309e6a31b55f8728d3ec585dfd4302fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9e53e29bbd9c01195764ba9137bf7bb
SHA1880a858596cb0c1a0a5cfd8d8684cdfb759093b1
SHA25604ea5fffa91ec523debf183c60eb71c06d66ff0ee4c79c4422590aa834a7c126
SHA512af96128c65840d5c9e1b0f736f97f1d27dd9998c624574971a67163b7ed245a8de39a431ffb2ec799b9f754b9b580904075d154ebff56c70a25473852f3537f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588ef7208ef37c5e7c928fa6406c535e0
SHA1c73ff848536f0acbfdda497c44554556e6e514d0
SHA25618469c2cfd89fa98dee6d9d24aa1de112ff07eb59bc9a272d52bef9a01feac95
SHA512444d6feb65c97cbcc0bf00ecf487b98c57c24daeda3a72b1a603f60a3f141606f9eed56d54039c6dd235203740498ee632bdc40dcddee7d1333f71b5bd27d250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd1d6020d34e708879bf9c68fc5be323
SHA1c23da212002922c3dc97bad4d44728de7131f5ec
SHA256118ad672dd10d1d0d84f6297c59f85350163b292c96c232549d83bac092f3fa8
SHA51251d17920bc971fb2fd0dce7fbb4385afa367926700f7b2524bbc0a4404d41a0112a89030b1d08c00c8fdbb5cf7f9ec6687bf6a9115fe677d4d5d72c37b5f49ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdc90018498ef3da0c396825058b0839
SHA1f681d37133f564bbc70d2fde04f20fca06a48dea
SHA256fe0a0357e3de02628fb06f1c01ed8f0fab90dfb847a7b841253dfb4b39d13111
SHA5121570d03f9018040112cd907e1c63926657b8116e083a77d58a0a70e815965dd13728cd39eb3364ab278fc9b573efabde225697a6f3e41f3aa113dc93c6e54e8e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b