Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
48cad3c091ab7b93ca8ac726afe242f3_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
48cad3c091ab7b93ca8ac726afe242f3_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
48cad3c091ab7b93ca8ac726afe242f3_JaffaCakes118.html
-
Size
57KB
-
MD5
48cad3c091ab7b93ca8ac726afe242f3
-
SHA1
5d68b8156777432519a7e8cf84cab225ee93002f
-
SHA256
45c86c2430cb890a74a55c8f6e2ccfd4a66f23b7381120c4cf28e92a47414a55
-
SHA512
90d950b44da159a80060841bfcf53c9d342bf474cb98ed96b9b0be1850518434ba714a9dc850d4ea73e72c7f4b1811cf5c05f437b2ba82addbbccac48ed40c0a
-
SSDEEP
1536:gQZBCCOdA0IxCRnhzfnfAfGf8fmf5fBfafuf1fXf0fSfGfJf7fdfYf4fafrfgfgE:gk2y0IxUfou0+hZCmNvMqOxDFQAiDIIE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a6eeb7ba0905f24a2d0f60d99038141ebb466bd3dd2626fffd036d8e62f75106000000000e8000000002000020000000c25493cd54a60760990c47820f24cbf83a2b916cd76d197d967ccfd05777bb77200000001dee59c3c67a584b91675c1e0cae1ab49193821ee375628ad3604b966ca62d8740000000a1da9d0eccf4bbd3f4f22ef0460d0ee11cd5f84b15fa6f274421f0f76169fd34adf542ef4d671f296155774955320343751ba43d7963bc558da260aa0740652c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C091EC1-427B-11EF-BA91-7AF2B84EB3D8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506ef71388d6da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000678eae786fff005eb88b332762540d8c2aadaf3ad00812a08566991a8603fb62000000000e800000000200002000000000004aa36fed66a6287ecbced10f7f20edd2635e9a40ac63624f28558dc313b19000000037e478c187b398c24605e7824006fcabeba038dd8a9087cacba8ecda8034a18de3f88a6cf38669640e9c16dbbca48c09d40007287284c068da6d0e01be788e0061408ace26aa3c8bb7687701b3a5f404c6e2f9d68e7775a766e9422b25cb79d9dc889060ab12163deedf737d608d15786d51f974a6e2321efd54dff2a06fc5212677c53c34058427db114f11916e1ddf40000000adda914560995e9cb9ba69dabc9e9fed76de9e232fa3a599886ba3e902e0f07ca3236aff0e51a86cf1a2866feb47f9ae315a1cab591869d1ad7891f13e621b0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427190120" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2588 1948 iexplore.exe 30 PID 1948 wrote to memory of 2588 1948 iexplore.exe 30 PID 1948 wrote to memory of 2588 1948 iexplore.exe 30 PID 1948 wrote to memory of 2588 1948 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48cad3c091ab7b93ca8ac726afe242f3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572fc0e95d775b6b0e5df80e877574016
SHA1e61648f774916f029b2a2022e358d32815ac3e70
SHA256fab3f32d41165d1b5c820f2427f9a28c65d6825aa2642eb6ace5be8a49afc9e5
SHA51234d1a2406597a4e5745a31d0cadd9aa717eb5e7d09ba6a98d07168463eb406eebdcc4c008249cee43779b39c1a6560fe6696383b24a21467d0bee3f7bfb5f6cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581b501106524403306a07057ebd2ce43
SHA15377de9163decacb87578de05d271ead10b60f4e
SHA2560830e4c534c4ecb6c2d719b1d5c9f033f842de49906e4b9dd15d3be7b3108d06
SHA5129ffd77f51e6a9f7fe966ca85aa42c47e45560a067b7cf2ad1bbdb56e985517340f8f462729bc6ba0aade0e7a1f9db8e7c075f245f351a7502fcf7ace3d46b736
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567202d94576035343440e2846b417c2f
SHA1775a1de25033fa0ee9c416a480b884c1db363c52
SHA2565c6dcc47946bc69ba6ec4b723acd0a9f57958638278a577b460453d768aabc83
SHA51275f0101cb5b01a4c994f891d7ab8358076d7e755ed1b6dee7018c5bf8de86347db01131d7858bb46054995402cfebcb8f356ac66b1add8085e528ff39c45e1ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5724a932ce9b2eefbc11b4a0a25c838
SHA151fe6147aea20aacbc14fb38828d79f067d74222
SHA256eca61bb64049065ab97f62c96dfed1cfb1f7ca5d0d5eb08bed130b23530b387d
SHA51254346c0b8124075d2d2efa7568701c0b1536203766fa50fb44a9642a5feeda8eaf6066126a08908959e00816c75c712da36f53904247edb511b5558a1c61e940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5627570020eca1ad9459c81fa1fddd752
SHA11c9e23f03666719f534bc0c64224c9353bd4d12d
SHA256023592185afa55eabb87ac5fad91428e84e04986974f3c27c871bac653adb91c
SHA5124d1cfcc20db3b9ab58d798d3c696a89a5fd03d04e5be755dc6eb616037a9d04bcf887a1e62def2722ac7f27c5e72338a538734bb523d2f7fe5efea2df43376da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f12c7ad045bfe20693f9df53cd2ffc9d
SHA1767544c72dad5e655f4d40ec52df5330f283dbbb
SHA2563ebb731495856a9ed32de2eb2d622e8f24821af3ad4b99f513784cba14b65795
SHA512575048ef2136b88d4341f729d265f207690190f0b06c1e5402885ece9c383432d8307efce499017c9b7171463e0f445ae5c81be844acaa92b6d737708b0c52a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fab795d5ab4e626ef41c1708cf147ad
SHA1d160025f295c55a0bb1601259877114b1e032c7f
SHA256c00d705e0fdf4ec34dc8591420976386b98fa6f27931f8d4b3789e543b813297
SHA512ce53ab9a99cb94550b540a15f104bcb09c02c1594f6772ceac911fb56ff50c0bbcc430847a9a16f3c1e10de421e59e5dada6b36816ecf30ac37e6d49b30b7877
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af7b39a3395ef8d8988f140eabfaa9b6
SHA12ffb7ba519e21f5b23da8779473295252c1e05ea
SHA2566915db96d5df63a1aeb14a3b590478f727297cba2604aca8d0c42221c622712a
SHA5120c6646ec81bde06968dfb364bb14a27bee0ef160f43afa38c507b32ad51f7272625869346ff725123bb1b774ec211ad6d361fd81587803749f81ca96cda03167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50855915f9ae12607640b72bcac8d4b96
SHA1b2263cf7239a029c1077993dce78c059ad10de98
SHA256dd1dff11bca75465a29c976ac51602074bb407809d505ae3faa5f4ea44929765
SHA51276e810de46a00dc18eebc86464edcd80bfd216e796ec0d1f691b386ae37cd8ade2bb1afb53b68fba2dcd823554e8dce5bc3e5b51b84cf1877e83a10e571b2d64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522e715f61cd5db80064b750f4b8b9239
SHA1506de08035b885b14780efab49f00910f3d2e544
SHA256ff7aefae78a9bd8ebc89aa94fe5d253e2000c7d2dda58b79ad7d66ff90a71df2
SHA512000e83fbdb6e49cc63ef6eccdc7a3ddf9cd8dc70218498842b319d1aeef02cb909cc71600ea801d17bf730663e22d26e72a4b757a0209f8ede411b5178cf3f03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eec21007b37b74a4992c1dac1d1af809
SHA1603779918ea6cc98a56c255306047e0fb03fbbf2
SHA256dc84934befd76c8798058ee4e98c238d2b382b7a43c0ba68cdb4eda96fb2d75b
SHA512c6ba792eec249f49b7732408193bb87b6dd533db3980f71778cd23080e4da2e9efcecaf83de2905945bd242c444a1b07bf5e38f418b4ef86fdfb68623979eed2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549cd08dccbbeeb84dc8f28c05af4a5b8
SHA1c0971e08da290b583633bd2e9ba5a068918f45d6
SHA256e943a6496e9acaa2d699fe03141e6987cfd88f304057fab08ed27917ce099f30
SHA512458affb488972cdd662edaa14bbe00308702d792785aaca743857e05d0c6f869a39c46eb47c6cd014c15895d6f4f40040fd23f7609e09be5b6c1e8113e5477e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ead450d37252e3a8d2ce3215df66882f
SHA143ede26db7d75b112d020ac169697536c5fb640c
SHA2567ba4b3a8a48f1f538f372499c0598774505e241d41105101081cbcf0096f9b56
SHA512f8e8d01ea3b8247b84937921ad095555391dd82da755b23cba6e2285352f3bcef13611ae97993d0a22de2d4ec06070c830787094f2ff5be8cba4df61e5809ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a73600b62b7b48064c5b39725f54f2a
SHA174d73a259aa084c261946fb4dcf0d33e9b682c92
SHA256bf45d69929b4cc7f8db074123e98258711ef8283817f78d285034a1c013544ad
SHA51223cf9cedce02a58d20a26aad9bae2176640a7853480dfcee496190097c01338b36288caaa319fd2253a92cd1b649e8d2ed3b1882d3b7f3e3049601430d23ce7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4aeafb44828fa5d5beea7409f32ffcb
SHA1370f3088b122da7b71b068a0746150967233b77f
SHA256f124746b8f8d78d52d76f415507fa9e585360d1dbbb368101ac7ee990190116c
SHA5120b138ade30fbb9d19df3a27a13d6615a34626a8535bcf6a4d1783fda80fb0b6d92fae0bf46fad76af4b1ab8ff79687901a78a6bd8c3f27093e9dab7050be0471
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a67295554d9c8e8e40fc3c70e5047b8c
SHA10c3b647def984b94f506ee1311e917f7656bf97a
SHA2561940326e00ed901b0906e146ad6c42b510d0700ae655741102a8ce681d48bd39
SHA512c4b1bb70e99f3d2bd8ba5fbd6826f5074787df2f240953a102a80e5ed46d742f0ccbdb58a0b9d49ea128edcce6ab9c3b16f48c251164b5daeaea7eea142ab954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f1456d69917c88d5c25200882042936
SHA1e9c499875d6057507fa47be0e71e930c9562a5d4
SHA2567c4ee062c84b3dcd5c89ed716d26cfb49db72275ca06640925773a0e32631bb7
SHA512e16ff6205537e30e3c4101d90520784a7127991d2ff1936e2d9ec8f2ad834ce233adca06d20ef74030dfb510927c24535f117c16913e17e5395bf47c3738eaf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbd5dd361c977882fb672dc7d8193ec8
SHA1f8ff31e6fce4ba7a6d7f7db81900956c1f5afca9
SHA2560120149301d4ed131b0c78aaf4cea43a72370a7ebb7c1bc73e8cc52b0ed2aba5
SHA51274a83ad553f59731b8d5a850e47f46db053a617e283438bc969a403eaea823e489607e84528c2f3440d48082baa464df69ee298bcbdd427b9dc6a84729a642c1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b