Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 08:26
Static task
static1
Behavioral task
behavioral1
Sample
48fd06da58ceaf655ecb06ae838812aa_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
48fd06da58ceaf655ecb06ae838812aa_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
48fd06da58ceaf655ecb06ae838812aa_JaffaCakes118.html
-
Size
90KB
-
MD5
48fd06da58ceaf655ecb06ae838812aa
-
SHA1
e84c045cc64fe85b641fdd5e8818e7ec0136951f
-
SHA256
c0fc6e17726da7f9d3e2ef5a826f99bdce891a6464fab2b3ee411653c7c77a4b
-
SHA512
403a0813ff0ac22a7c46ccc13c9481f11f077321b49aa1dc22517a179094b93f9cc3ea199f2fd65e5982620ce3096339f2b96ae92b24ad9ebf3b42c9bd7fa55c
-
SSDEEP
1536:gQZBCCOdx0IxCM4V3Q2Ghp+DLeiz9y+YzXDBwJon7Z1Du6EY4ZJmC5GdQ43kzx+W:gk2X0IxiPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000005f80002de809dfa5fb64b1d67c3951dcca6eb16d0db0c0d31d37e067411bae39000000000e8000000002000020000000a1ef49acd4754e59c853d2c73df2cf0802eab0ca3319a0b77d0cbdd98da7ed45900000003260ceae59862d2452c307cafb0420fc886633883e6ed4e82e000f88acf8f6aabd07eea5f8e122b54ef39f8e55b78d43227edc2889aabb7b9ddd53d677553288f4fc2a45fb8b74fc4a8f4ca291d680697425d6b9c46d29a71fd478511495b4de16f67b13f3610fd5507a66428fd0b69f2f3310f6c7c5cc50a6b3feb283914af843245fe37fe5da4da868acca8af4e4e340000000d9f73e552b38091640920eb620470e894dd0750337c34819ece4fead9c2dfbc9e47dedd91a3d317d2dc1de73a25c1974dd70289bff7d836cd980fa1459d3016e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427193856" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF34E1C1-4283-11EF-8419-5E235017FF15} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0895fc890d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000000078ad9e2bc34333831ea57bffaa262da25b92e070bc0c5c75a8114d0c0847c3000000000e80000000020000200000007997a892308129db1e4b3e2e67af829c2aa7806568818e9e23b38fcc236f813220000000f531026b53681225f432588f2d3edcde913d27aba8d5233637bcab3dc30b35ba40000000ed8decd85180f62fae42c544a1189f2de96ef86394e7bac3c6d6f248d95c63a61590a46adefe90db1c078ebd631d1308c4d31d59cf0188fca28b3a39f14de574 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2092 2104 iexplore.exe 30 PID 2104 wrote to memory of 2092 2104 iexplore.exe 30 PID 2104 wrote to memory of 2092 2104 iexplore.exe 30 PID 2104 wrote to memory of 2092 2104 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48fd06da58ceaf655ecb06ae838812aa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b2e4617e7c0059ba98ba450b6ee906f
SHA1c5b10906837ea3f91bca316d6c55a29ac1e9d733
SHA256d3fcbe0a52f92ab4e4abcb1fb79a70eaeac651475336fa7ca9554963e16587cc
SHA512dbe034fc8289307f30bbc2d4ec220acf75e474d55578142988fe983c4e6926bcbdb4a7e5730d269527c162e6eae1463a4c1eb316242ceeabb2d9dea77462c148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f7f5d3c652bb2fc16c4811a9e72412b
SHA121013d4a1235dea364f5eb11abccaaaeef2c66be
SHA256ad730587c2cc03dbb3bc767aa0945c4e45f1bb6cbe9e54c1bbc998073c3529f1
SHA512107d1c06d652552c0fed4098e6cf927a3669df1d01bbb8185bbc89c3006dbfde13c6fd3b0b33ac6199cb2c421d5721a529d3a0ae07f58a1a5937477450825b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baccca763c40322eab732827c65af6bf
SHA16ade197fcf459449b89873cabdd51e4e3bc4c763
SHA25657227a5ea40c0a8ea7bd38d0febac5ae9e923cdd49b47fd93470948c8f581377
SHA5126ce5c2159d363cf3559e495d21605f1853b1c075a55affad2544fcac2add49484e5c02ab0dcf667b7d4014b58a7632ead7f34baa8e242a29b748ef5b8bee0040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b78038273c5252756b6cdb3d7e31cada
SHA1b0a617f7d22d0e0b52639b6372b81c1a86e422d6
SHA2567c826c296480eb61ec7f349252b716b42ed60c6de467a659da0eb65717ec8aa1
SHA5120dc5cf4e4298076b2e9f767d0b84080318f0e8db0cc28c9a0b4f08c4c821797eef797a6d817b2a99c238870e94f935ebd208b1232780c048580ab794ba89f2bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2704fb6b0ba0e4ce882433dea695680
SHA1dd39e33fc6f20de6cc256fbcd398352362a4ad2e
SHA2564be17a86a79c7a3d358dc36941acee2bed37f37ce52840b72d3a8cfd28fb0a5c
SHA5127243038f429993efa84daa314ed9e9060dbcb27bf60e7851178e964be8ee71bc49ccf8c0409a1b72acdb55288fe785504ffa12f24ec218178c3ab1c9647a98ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56283cdd51fd44d035b8b367acc04ca7d
SHA1836c11a38c24ce93333c8ce55fddac820a4cb789
SHA256e1e9c68f9c3835882ebf663af0c7b900480c244dec268ff9c661d73aee712aac
SHA5128ba4b31f1f2d49b76b021193dccfb2e9094e232336bf018eda10b9a68d3e4a4769a311c5ebece8d5a7ece0a835dbf0e8a75e1dea66e99efec217d05af45bf34e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f2db3e44541f85d6519732a4223e6c8
SHA1f94e4ee584ea308ab8ff1c13317e605678cfdee8
SHA2569e17fab66c8db339cc9228673bd93592c2c2c07b13559e8cf2fa31481d4f431d
SHA512eeb1c8e72a187b0663a4270c8050951d2eb183ac3322426ade5d3ae6716fad202780d01ae52e0e67245cac9a869a4747610e6e87b94c91b4da78571fefa833a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e59c368844b58d7b1dc81bee7986f0d1
SHA1c8013070f10ea31da19044833eea028cb7e23807
SHA25608f2673274d8f16fab92540c457e1d6b3b96345a43d339b45621ba837418ee63
SHA512844fd77435ebe7e94d2096d3170b11a1625f9557dc8bd36e1f4ad420dcaf25e6dc3d08806f8244d8a5882b7293ba850c1492a979f87216abaf08439d282aed65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504fa8f15ccd894daaea346b1a755042e
SHA14e1d09a56698e0db51fc25f1a1707621e7fd6812
SHA25695b2ce05e075a40b0dc8e03d661c52e1c3bba173e942241b156d319c982d67a7
SHA5121259dbe9158288d4ab109fe00be8987b53a47d5063ed78df0ca3f505be829fd3a38191510b64b94d6f05991d981830982e30c1c76744a791f2f8161fef3a76da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4084ee427e744fbb768e9aa3f1636be
SHA128f8fd0846cdf9022b89d9eba642c78f1a492e55
SHA256dc34cb079447b967831cd303196eab47d8f13cfceaafac34cff924d59e3d9134
SHA51213a5ba23270dfd1e1431aa8bb4c34513c7ddb676d2f4fe0eb81930c05e47d589fab26531cc6075a0411191c83162e7a980edb12e894c13b1528bb3962647862b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b