Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
45dd3a47dbc8ef6886e46d02f320de96_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
45dd3a47dbc8ef6886e46d02f320de96_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
45dd3a47dbc8ef6886e46d02f320de96_JaffaCakes118.html
-
Size
3KB
-
MD5
45dd3a47dbc8ef6886e46d02f320de96
-
SHA1
ee7ed6305a2fc9364b0f94f63d7706a3824f63c8
-
SHA256
d70ac3ed00f45d80a6d685bd0c6d486f59c4d8085c0ea6ed1ce46f934f9666fb
-
SHA512
f5345652a6b08506d9ff4764ddcee258f965b5c9bec31006b53532d10982fe22def97d19700b212ea48f24ee59c6645d40eafca8f46150557eb96f2c444656de
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0520ab3ebd5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000b155376a453b13bce2e842321330579c132c641de866ae6f6c8bc25b7cd34c5e000000000e800000000200002000000049ba7a57c6417e1d8d577d1b27c162532f85e1ac9b621131545b2155775049d390000000998ccb954960064ee5fa9296e03f2ba41085e7af169bd9285272291e9c5003c54c51b904b36448498d7b28d2fc63a6d4a9f5396ee42642949a82552195f3c2ed9f6ff17e96fb9497866023fedda55383a12913b807636135615cca36c60945b1ec1d3af4bb9b27585214648fe353ba6fec9a271f5164ffbd94979252678446799b21f52067136217b5bda12144161eb7400000000b3ff467c497a16fb06aac764a545498ccf38adef26d764fad576b2cc1c1b5ef4da25ec1b403ae5692c0e5e63b3baaf95e5ff01d1699e7d486d840a087aa9518 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C56E15F1-41DE-11EF-85EE-5AE8573B0ABD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427122919" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f0b0ba5e2477451b11a018c243ff9ad9ac5adf6dcafdd3df756edf79031d03c0000000000e8000000002000020000000adf6e624c56a238af78508428b1d4fc888da304f1aa413dc945818a3d00460b32000000075fe9042ae5f2c209cc8c6b1c694afc9b2078ed19454a3ab171215d233db6d2440000000d1b8e587f91440925191a80b4c38dffcfc4e22b872debd28c66f6857ab5dfcc157496c8f44ef50394edec4a670ac0d57721eb7c6d470f836bfceca72c3dfc455 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2680 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2680 iexplore.exe 2680 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2816 2680 iexplore.exe 30 PID 2680 wrote to memory of 2816 2680 iexplore.exe 30 PID 2680 wrote to memory of 2816 2680 iexplore.exe 30 PID 2680 wrote to memory of 2816 2680 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45dd3a47dbc8ef6886e46d02f320de96_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50502d4b572647deda91cbed36ca3caff
SHA1031d93b52121c60e38b466a15a195973277716b7
SHA25616666394823027c09f216509cafd6f49ea1c572e6f2c6b213a9a8f319f14d484
SHA512e0ce951cc5d9e807a474c0373fec7cb31b57850798901ad1c2ef0c72ed9bacd269f52bf23dc2eeea9ade3d95c3c9cc7da0aac05e7f1d11cd8ceb2c77b235d105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eda2c62dd3db424786d5af57aedd1c6
SHA114dcb6e3a7fd24b0b9fddf711a96abe1907e6888
SHA25651b6f6770cf8b6736e68c873b9953b50fb44a96b11f0af835863f552b19a5f4e
SHA5121ef1b1302d94e428b3de9d6f989fee1fd7283433fdb27c43d2c07b49f44f580b5353e4a96a1dacfea2902e3c9c51a20c7f23d36f6580b6512d0c3dd4ef061484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fa9abfdb5df63b55c2d4f774439909a
SHA1498195daf34adfd7cdeeb4b176425c6cd878dece
SHA256e7ee5fe2d15f82aeafce4eec617444da7f97bc26e28aa953579385b6fb266c13
SHA5120d4f675182e31dd58ac44284aaae53a68c263325fa531155b2b0630f371dd6477012d5dc0eec97c1e9a0383164db6c8718472d5b04fbfb0a460622f9130c8db7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8f0d52e8fa681fc48b09f93a5c0d2e7
SHA1c2f3cca00988ce7c9f89a4d7efd78794e50268ea
SHA256ce2003431f4b2c6f9037004d3b55482ec53e84ab0d3f8753fec35f739dee1710
SHA512a973b864d5e5ece600433b408d0a3f817c9832405e547c584d133f3eae982a70c5b1033bf7b1bcace6fa1f6f45a224fe35ca30592f4430e15eefde94a6281454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2762e36676da53ff8e38be4babbecb9
SHA18551f7162ce93eef1c1584ef24e2fee732b3c26a
SHA25650cd30f7925c3086af6f0c7bc24782de145f96551f4c7008bddde51c0f30d910
SHA5128edf98e1925e4e5ff35c5f9fe18bb105a5ae1fa8d196e69fefbcfc07e24601e634c2e3f643647fec47c8b3de82a9b8735e33033c76db50e8fecaa283ac2c36cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c24c2364d2f0a5fae715cf04e9c3600
SHA1b9466e44f136217886dbbc15e9cab1b0eb8034a6
SHA2567731caef093ec5676e9fce81fe331e9510291c58dfc99a4bc71a6f6afc2a659c
SHA51231423a1010e68047fe78f962152dee0eef164ce0e20edd87fe7f326ca434d63c3438a11ccd58050067184af6c77befbb566d83a310cfec3ad4e93b56c5903b53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4e108263ceae2e1446a8f08847f712a
SHA1c5ee35521ef537df1bdae9c7c3276b7addcee473
SHA2568ac43144796bef05af1ac1de9162f826618a94d187761b0a70a086af00c342f4
SHA512104736dcf33446ba44409353f53aeeebd027528cf658ed956a78b9828a1645431d36e55315a74a19b01113491004697f6d7a04c1b15ffbf39cb5f70f855ffaa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b2133a279fe9d508923613743239599
SHA1e79e7e4d30c27ce39637616045a61873efa06a0b
SHA256c429c73931755880244aaafc22b016284d3e0870021d4d9eb1a2c4f4d6773598
SHA5120b496e14aee320b90695db289e337faaff5167d5ab5368debe2ecd7526d3b4b01691dfd0711fdfbe618b80c82fc5e030dd15f1a17d217f0c6db84ce6ae612cd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544706b82b6bf0a82dacca70adc78725e
SHA17a3cd0977ac7873bf6f2caea3a6cede7dd67e031
SHA25638c901481f71efbf5d1e973f6e049cfe46681b72c31a2cc7745c69bc4d05018b
SHA51272d66ca5bcc23f1ee34edb6a8d555f2ff28c4af55571feee9236dd269e9b390849ef88b01b9d4022efb0525aec222a0db678c82431c7f6046396e1a44a070ab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507eabd6f398f29140589b9f12d7e4138
SHA175df56db263dc8a1c1e34a4040b9d6b024d49288
SHA256bb62f609a317ce8d84d98c7ab67feebc16547f1a4a5d80ae41905ef7059ebc5f
SHA5122e2bd8d7eaeb67bd414639d4c72ba2faf94f0a29df1c2aad56273901e488036413cef803d23e986155aaebbd7fe3f54b24f49aeeebba5cc80cbf62615ab20d12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c90633843f0dedd34a69fb40d6eb8b7
SHA1971e6de2b440058fb59b1a9b168ab32e67eccf35
SHA25615e3a9132dc62f3e618f175bc4f4417c1952f466985f1e78d998d999fa6ffc3d
SHA512192fde4deefd2d64569eacd09a0390ca83c4e73bfc3f81dd8146114afdc24f11c4a20eff921253e9ab5cac7fcdb654f50e8b53a70d2b60c7c09b78dce1a09a93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557d16ddfc557bc391e84331bb0d11ab7
SHA1b1962671c42fa1299396df66f2587f87ed26177f
SHA256333867667259a180a24f17bfd75baf8b65fd03524cf0257d16a85ded03c29d7c
SHA5121004ea56bbe2b45c28ca2d9bc72e2748395217ed97546c2427c4f96b2640e0bea94a7750bbdeaf327ce9b6e4462faf90e2b9f41e2d312e7366d55c568e6962e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542c3b4c2940c15c9f8d5c29c4428c137
SHA17a87ae0ac78b9273cf9ea08f59ea015644faeb2e
SHA2568a4e020b7d349a7087256629f1dbe178bf5e18b262096c0cb9bfb50019ca7151
SHA512df3dce2303fef1e3432efdb1417974c652c0c7ad782fdf3c73eab26ee778f5d80bc06f226d3266d85dc7bcd8ba11f55fdeb44ebdef9ac698f60a682f3daee42e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a720f11a951a2df54003da73d9edcdd
SHA1fe7edad0cebd7a3b2b7febbee7e75885665f51bd
SHA256d254839ac53a0876ee4ffec2b0c8ae7e687dd6c3c3c588b5a8fcc468a84850de
SHA512ed327d95258e204fbc436675ab4a59590b85388e5a7e6a56b9905ecca18bb607ebee66e712b6a830fefb55a08429ebc2dc887366d0c894d587d272de2ca70069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b54aa689cc983d1a832d8d340b1d6ba9
SHA145815ebc698d8033ba4c82ddff20e7362d4c89ab
SHA256e8fcb881c37f5155854681c828365176370c4c3f2174afef135da5a8492fbdd8
SHA512ee3bbfd7b20048668ba2b11dc705b780b5a08feab0ed92add6666d9c6d29e5fc172a374923d98c44c96ee12943393a60e6ad1b89c9f92035c17ea364614468ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590337013029fb84e71579a31015d4345
SHA1bbc024f1414b403be7bdeda5683edd114fd96b39
SHA256dc9b7f000b8e1d15bd924ac94f8ae359786e203aac1c2c4805ee1abb00234b73
SHA5128a0d6c074c837775e9ebe4ef7b76b8eb95338d8cffb703b55830f41267e40221c6edaf23d863f153a8bc4fe09957048bb33962c6c7250d22f68f8c61f185a033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dc25026cc1eb24fd915ce6009e0ea11
SHA17ce2e8b939aec909cff382a878253ecf71a478be
SHA25604a242266e5ca606fd338f2e22baa94973863697f4be566cc8cf21d162a23097
SHA512aedab4cf238b058393ade02627428fa630108b93a883f29752971ccb5754df9e1d097963d51c46a8c58d6dce525537f4249076c406011ae1749ecca4183fd5d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0f7eb97b23924f719ed53a3d59eded6
SHA120e148adf39e401ffcd9a99f4110060f91a3aab5
SHA256460d00738e5c47564c9561c8cd9088baa6a631c1a8d46da090c123f5efe00fd6
SHA51250d20674054a85d41fec1e86cb3a8ced086943ba8034a656905baea3c790334e00126469321f29348779c909fb66f01b61b6b1e2ea77ce55643b6a3df94bbbcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de08e45d6bde307eb218ad16a5099657
SHA187c4b43de8ffa13923a25e2d561fd8473d861ad3
SHA256f637b81fbc04be621e432d4f5706a7a6bdd63757681d47dab90d29feac38aaa3
SHA512b627602d567239a508e30e8590b1bd93e0bcb9d03db473188cc61aec49971410831d12c80eaba36885adf6d81844e97c4cb51cd25018b12437dff76df1b1d9d4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b