Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
48dfc7dd559c55a985dcfee315dd533b_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
48dfc7dd559c55a985dcfee315dd533b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
48dfc7dd559c55a985dcfee315dd533b_JaffaCakes118.html
-
Size
73KB
-
MD5
48dfc7dd559c55a985dcfee315dd533b
-
SHA1
f567081775d56f6e1f58b6c82fba2997146806a2
-
SHA256
575112835d44cfc2db5d3aedf7516fc7d3776c62fd1237df64bf25068fad2193
-
SHA512
2790fe6e89df62cf10d8e01cf3474950b1c481b6a1a87c1cc5c5cc8c567c6d61d24ff2bb663696156b6d06fb335e3e5983911431b65e9a024bd26c823ba3a68d
-
SSDEEP
768:lAD+VKeqpBhvyX7CzTA+94s7VnXXDKWw17d+sJjjsyxsFNtN2vl1oMlVeBeWCnm4:zCxdkjIyTgjlJY0JwmlS/lFvwKmdrMf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427191735" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE6BD131-427E-11EF-8A2B-F235D470040A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e698c98bd6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000b3fe7b1581cc14284e18d5135103987ac36c0011300083aacd45f8b5a0a07842000000000e80000000020000200000002fe4ca1b7ab292e375764b5a190d85ef6807829df74e8ae0f96447095afc3a1c90000000268988d2ab2d85de8c46fc12dd41868873bf1f533618bc424328fc2c727a8d7802828a6e9b2e58e32c86eaa1ce8b8941c37ff57641e770991c4b4897f66e436a8b4b7a2457c4455a97df640ff429e2111a9b535e8bd5003426b72627b6320ea75ef7b4ec82b72501479195558657123f1a3569aa850f04134f88cc9c0b467ec448c14851cca3d2568c62a7075054192540000000e1dfb749b2980a87c1048726be3f81b8db3ddf63385489f4401bf715308d73f68118b1f2400e84fcbfad528f26ddf89aa8acf0238bc8fb234c2bf71e4f95f10c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000afddeaed50835465e735788a69c71ec508f527ec07eb27f1a835f8288afd670c000000000e8000000002000020000000007e36c4f65dbc876f3c95febfdc198cdf36d552c52e8d41cf0dd5e9bc988f4820000000222e2700e7b7b96d02f0c0eb62c12ddcb09a97baccd102d1c4d4c8ab06ab3ee3400000008235fde582d88c9d1471b2e7308e5e30b239d44a5c150bf7c14aa7660de61a6f64db89c96fdcf938a227a4f457e95682298371a9cf13541370674a85847b66ff iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2448 3032 iexplore.exe 30 PID 3032 wrote to memory of 2448 3032 iexplore.exe 30 PID 3032 wrote to memory of 2448 3032 iexplore.exe 30 PID 3032 wrote to memory of 2448 3032 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48dfc7dd559c55a985dcfee315dd533b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533d8e64500ed1d4cee5dab3859fb417e
SHA17cc52c600505676728ae33a93170b4a7a5ab682d
SHA256fdd6560520e9586578d533c35d0a76731b6870850bac7ebad513775fd2f591a1
SHA512bb0060f2d2bb2e90a7d4556d32726e83762f6d197c1062c893f2c38ffc78d7cf93df9f0d703a007014beb3a9b0706ce5250a58384a7d3a76f7ff67134f6a8357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f94fbe7b768fab337f3a2dbcc26f97d
SHA1aa1c097619df56083474b822d290803c8b8e591e
SHA25604b9e99436eaa1e143d91f708a718fa4c2980f87ab35801495350f7600c13230
SHA512e546a53277e03882443d0f7d86a3a81122c64e9e837731beafebd68f4fca8a1ab298f7c1d45752d92d40f2a1b3e1897d3adbcd6543521ce310ba451ed8c2e125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56edfb01ab15d3a1432d38b34ee226d98
SHA188fd222f3ccaceb205e6ef0d4128e7ca5a45c4cd
SHA25669ed209d8a0d7ac379dd9fbed378f3123deebef246477e837f13afb9a5ed09f5
SHA512fc4eadd0e011c6369d8990690152a2b5a30ae5847ad1397b0d8ba24eaf56848116b69e3ef69ee09ce1de024360cc42444205b1ba18d30060319faa1c62db2a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c1f0f38c8d1b06e47f8ac20df8a6a1b
SHA1467c5db72557beec228a11c1d8ae0f597f84ad5e
SHA25679b5bb243e83a21e2470b55fff9d53182cb78e7a4fe3c823a9e9fad6550811cb
SHA512d5b8cc92d6713d0e5b98580532c9f4e60419206afb530e4b44eabcaf43632393cecba31fd66168a109d4a4621eb37837efec88693d1a78be43daad1ac1ecd538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e837901a8403f7eec3f13b979329fff7
SHA195d92289076cd6826831e72da63b2ed151590591
SHA256ef3fd2301824c0e93d3951373636ec8ddb4526914ec626547489bf0db378320e
SHA512146d067b0181b716d3b215d51ec6ecf5bd67addaa3e2448b379b415fd25a2de6e284824284ac96b8d9491d64d1548fabd7b4efe8c691685d4cee1834ca8df5f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de7a82adc270dcec74d7495661fb6328
SHA119afb0665e2109ed8dbd74b94052bb92457b36e5
SHA256bd7281470ab2677008c656e018364b0bfb60878ec3b22e65109f46d4e9c7ca06
SHA51237af6890b1880d4420626e5b25a4bf3ae83e9e83c007119d0fa842ad2fc7861958d8cca77042ffe73081f7ae8df0d89054b14a48719d9b8ad7acaaecf2e33376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d96c12b87f9563acb528941724bb4269
SHA19452e1e0a1dbe2108e75a46699e85a5f4956a263
SHA256a8292b0ee67f5b29765f9006ad87c8cce17267c1775b8306f0304ca447df2902
SHA512d563d3642bf16a87fe32a420028b4d650978ab7516f8388395c2de6b10dbe7f8562d5aedb6ebcd8c8932818b76a6449f17804a3f053fb7e9658decedd403bbeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5766185ae80c37c8841cd9e6ca312388f
SHA152e4cab6c934196e09786bc42b66887f6f7a8163
SHA2565f67ad03caac622ad8d10303e2bcb0dadb317af7e2d523124b8a2f081dddc08e
SHA5122ec6a137ad9f78e2b2290ef9a5ffe8a0a3011316756f371e894384338ba2bdca8f59953babfa43a855deab5e77bca1dd650e1f4fef70dc468e6d6bc4cff58a98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5293442f91b010e2370d469d8cdad9429
SHA198f57f5dcd5c6e9c9fe10d56ca95b86937b557be
SHA256bf8ed052b3ef3136f4737ac6d1144b65515365f33107b82755fdbf0fe84bf052
SHA512c63e61820767aae47c42ce71065779cead361d7963d2a46c22ffcae69db4b238b6e227483d73e02cca36b28b2c77f1ae3417a1f297f9d33147d234280443e157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7a7b8aa3aa72affd6f23a860bd37408
SHA1fb3055d81cac65b836be1e3aac5e9269c722e26a
SHA2562b4430e4d5077c57cac78dc7f6e812777ff8855e8b1cb3553266d4daec5c964c
SHA5126ab69461309d5e54403c22fcb0fdb1089a488d4e8698bf3dadf5c3042f27325fee68d7370e8f5f7d028d66c094d487c7754682b9e51148ade1ed14d168a9ba03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5924230cab7dbedfc105ff3c5e15ea909
SHA196372abfc2f0a39d87fc114ca8d6052e1b35465d
SHA256027a5eb45ce25fece53a89cf2b9aa1155c17e2f3356e45a40a3beadb9e2cc49f
SHA512e2e6cf47312a9fdfec72f05941360da30a83b8a1ac1636c805c135eebe6da8cefad0b3e0e12a113041bcf2877afb14888e8763dcf136b4e868145f00d082c2f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503db18addae304254128af6846eef1fe
SHA174b450fce4b8b594ad02f9b2bf20239bd4118eaf
SHA2563f66aec8195f7fd7accc7b3bd92ff28cafc84f2309bec61167a43d01e5490631
SHA51265659924131fc09cad76a6abda51a0fe9d4f21925b237e08c3d61894ea093cf992386f5389b76376b1fb983684b43f917041ad791a7cd63f3a121c3a5c6b20f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50db9a31123dcc582204750a8dcdfda4b
SHA10e0bdd83d3e2c265571197b5e291ee01319c458f
SHA25626ed8340b7bf9b36dce710f0c992ed37f6701819adf883d4e9539c9034b49e29
SHA512fa24a5a416fb268ae8adc98eb043314e94450784c5279a2c305dda81e241868244a5a435192d1fdac7d98722cad5f78cb359a4b8247472919e99910fa7624f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54220fd524f47554b6c9b70c6be038695
SHA101086b9725a44c23e513466e1ef44fc0148ddc5e
SHA256a78c3e4c5d5b27ac41ffa0d25c5fae5eeabed7d13e44ab9ebcefa8eb1dbd468a
SHA512a760daab8d8af63a73dbc21a781ef603cfdafd1c47ff3343e7d5a59d70b6f2c6511e34baccb24e1b34900c98387aae784575da04816bfac7eabb34d26a384e48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579a4b775806d88ef7a3e90806c64b252
SHA1d8b038155314955cda7c5856ef2bcd022d84f567
SHA256c3423255e9b3c767c20708cb1d3e97f969091ca55c39d6f94838b347cf20bfce
SHA5121564caec0ff04c6f3fd39144af325a45c697e38bc0f25dcaf8563e203f7ef721b896ab03155276a3d10d16b6c9e874907ba3e257d9f7c34c517d632df4726dd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbbe27d9b4ef66ab119d713c260b0d0e
SHA1bf9dd1ff2f31a34231c59ece14d8c22c475f799b
SHA2561060669ba79fb53fee16fd387812120d944998567d2eca56e85ee8b3d82a847d
SHA5128f89bf475bfa587351ea4fcf170f4657f280dfa711696e155c5e24944f4094a94d9954f27afb008c7738aab9fe941cb32a77bff93ba03ffe3153a1f11dfa8757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f23d9a6cd13c66173550d302ea3ab528
SHA1770cdd751be970e4bed566cfc3eac08c8539d65a
SHA2561581f2373e47279c516be4a8ba1a817b56e032bcfce3b090d532e4d84957145f
SHA5124260e7582174c4dcd2e465e9bd9425e8b570a9469fb66cc26b88f0dfeef2da29a83011a8538f0e95d307d65e728d08a9467cb286047619d2d9188e395db3e450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfe5d34108504fcc02853c7f097e9ef0
SHA1aa3f46f5814cdf4f990b061db8db652d5df03a7a
SHA256bfd1f1e38e588b3b055e0815ed1b04331e5107f8a56a0477c9dafae5b31b5445
SHA51294730672facb00f0f468917c7b6095d334ee1f16ded2bb2b5737489feeb222a606d954b2ceea7c3581038d4d10558135a8b74ee68ceb24338aa66104f7424c6b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b