Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 19:55
Static task
static1
Behavioral task
behavioral1
Sample
5d718b007fcd4857e39e54939869708c_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d718b007fcd4857e39e54939869708c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5d718b007fcd4857e39e54939869708c_JaffaCakes118.html
-
Size
27KB
-
MD5
5d718b007fcd4857e39e54939869708c
-
SHA1
757f4e9430c9146aa14b1a44a0aaee977d55465f
-
SHA256
592b552188a4f968d1cc997afd208add8bcf43d7e5759e167257b70674c72a32
-
SHA512
70e864b52a3309a8488824e11bf5e8537f0c1832e7baaf62a413af877b07d5236c2f416cda6c951eff3ec2d99a73b04ba4f473f3088bf6b16e08126a159090e7
-
SSDEEP
384:x53H8mf53H8mf53H8mKZfQTcDvBjj7PtnwywnXwTTZ:x538W538W538lgQj7PBwywnXwT9
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427580785" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000e0ec10c111c4036271b7e1aac57899ef837a239d8ca8e648e7c5a395392e8704000000000e8000000002000020000000a899fe63f697d5f46ef34fac4275b309074afffa721cb5be3e963d8eac50cab520000000bb4e65bb909f361cb9ec6b89ab0d08166bdbc4470b0704d73e6fff8880e21048400000004cdc2989d8f0507769961e100d2546ba41283205272d38f7f85a564782cf32f3dca27c00e92b53fd90077dc7905dacbbd742483cc08033a6ff80efb0bf09847f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c423aa15dada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2DCF751-4608-11EF-B90E-5E92D6109A20} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000f5ebebc0aaf323ef959b47be821bd56f860f71d33e50abcce35bf527dc2c9d04000000000e80000000020000200000001e592384256bc646dcb2dddf8c830c517a334117376df65db6a9639fce2b4b08900000005f91bd32c4e0595e47cbf1da1401c2b451a891a5b9181c8a7e710c1ecb342326208615a0a94c046d7b3a187021b2717d6ec8983cb0c6e96f55c87fa73f867b2d917d7d61c6581340a497db2d72b5493c4b82598e3a8f772c77296b47bd3ede49bd4c856997670d60ed4b64f9faa9c00e00785980dcec61af0c292b817be4fb75efd6c24bfc4d30f9a9f6d805f9e702934000000003446ce530418a5a163663f3bc313a778cc1e9ae16c82eb70fc2220760b25826fcd7777282cc9078d80d2217f3286fe657824db7a856b2ef56de9a2f3f1bba3a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2508 iexplore.exe 2508 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2856 2508 iexplore.exe 30 PID 2508 wrote to memory of 2856 2508 iexplore.exe 30 PID 2508 wrote to memory of 2856 2508 iexplore.exe 30 PID 2508 wrote to memory of 2856 2508 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d718b007fcd4857e39e54939869708c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a451916bd7857a0dc6feb9ab3a0487d
SHA18ccb2bd3951909e6604a2d5040ce1ca027a0bea8
SHA2563db4cc73e7b5f25f70d5a0d4679bbf85ed8e881f0e425e0a603d82f45b521a94
SHA51215afd2257db717e982e3ae6654d3deedfa9e4cba084ba58baf0244f1e3f24fe16d93b7be7d65931155052798fd26b0365167911c9232cbdaef932f111ac4a937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a05980158b3b3b10248955430e434a01
SHA1010a2b10365fc3b56219e29c9f2b8e3d2a882e79
SHA2568b2162fb6b2b4fe5194a637a6ba87b9af6aeea7655224acaba956b6e90b699f6
SHA5125ba7c35fd529f14ebd70a8670d393259c33256e29807f8010d909b7315a5284f28fbe0c4128c0b1c604b243bdfc3cd9de0422dae9cf20b13d3e3f946657ab34a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5128dc69fea2b1cecc413d6245abd2705
SHA114e03175a234c242157ac358ee358814918c254f
SHA2568d94e92c67e51bbbed91ab14c6c6a170f9845eef393053a593bee26cb343d709
SHA512053e8ebc98b8cc568bc65348d3beaabc61a062fd2309f211284f4c72beeb98e4bea8255cf9b966ee796c0efcaa5d6fd59819bdd10af566d51fe9395103cb8339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee468c627c4d78b4e0cb504af16f4a8b
SHA17440927e7da6de3a2bb2e15eb463b904cbc69068
SHA256ff47c3f6b44beb49897bd40aaef14b0121af63577f6d942c34bd62ee49694026
SHA512c98463144d34e580093f19c7183541974e943479f180b37081b41b7c82707eefb293d57d62dcf937537c220191d6f2109a3b86f38a83dd37216b348457961a0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b4849c0c9746896f7a1f822274012fd
SHA1d6b0541790ebb808e5e902a0f0bbd7215abb2012
SHA2561ab98e58557f1c6afefbb88bbfdcebec145ba754ad2593d126b082244c937807
SHA5127b4454d659a980832fa7b343aeafe7d3df1099dbd6fc36c9a8df440f30777ce27f7684dce1e27e077c7c8170fb4c3c753edf117a7c1d6a71d90c66725d758dc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ff3747ca55a294e8f0aae89bbc8c2f5
SHA1104bb5c28faa821f58c6776c716aae2b16a02b5f
SHA256ac730081f0db9f2c0784aeb20e440f0f44b4eb15d6f42bd7eceac9d84bf5e793
SHA512f323f9c814f3ba7fa3f3a207695836467cd38e8a2aa2d45cc785fde5fac7ecb5f9c6f727a0e3fb4fd46e3cdd73621a88d222f0a1c1cbea8081b33b835864bc32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558ffa3633297e094c3dd313062ad1150
SHA126f4c15daa072cc1e0dc95b0e34701eb13e29464
SHA2561f7e10f641950854f33fbe5d2b3f9924dd7950be1c08f000ad2b3222dc564986
SHA5124219c43c73ad77658ec0dba9237b88005abbf4aabcdafa340733cdda8269c98cfaf1dc7618020887199b2cdb5d2e7d29cee3849287362ac04fe3f83d679ef741
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af5de8cd60d71294d10b013e53422e76
SHA1fc3ad43829c6bd0fde2b431957a743243cbbc19e
SHA2567da23323496629ca8e9fad7fde65d97346e2237b1a01720c23df396a9a0cd695
SHA512d1d73c365da7e84dea53978868b870300ca912dec749bf3f3163efdd1086d2a5f880dc4dcb6acb31780b4f78a480f20ab9756387313f94d27001ecb6b9288cba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd3c100b8545bac670b7460759e9aa2a
SHA17d66f81e43b7bf3e83896182c99ba96b9d293a65
SHA25669b3e65b2134d2a1d9be6020f4b9d724a76132f16c4860e49c5c51e1c6f85a4b
SHA512e68289613c128032ede1ec072ebb0c259844b0b7de3246fdff6f4836c5b61205e50fbcfe6ae2b7f97fa97cde44de549f46483355b674ffa99ab85c666cdabf3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bbe5188e0d3d853e1760790c3aa7b8b
SHA1d91b5a956a021210028d047fde94b4ca56bfda29
SHA256a6aea85054d95c3abb1d12a6e7fe23db73494eefffc16da5b7891854db3b8e02
SHA51250e9e4eccdade0107273584eef74195d094b73b86bc4e60c5d69517797bdae21e173a476b7c7fb41486b62ce628e9ba324e6cfd0f4c274faafe147e6e7f4c089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c699d7de9fa884172559fd436df2242b
SHA173965d6f42960e3087a689e2ba68a3ebb01ca520
SHA256d409eadc112bb1f1e14265940488a56d71207b5c3356daae44e12e09926325a6
SHA512a4229a72f2a5b6c8fcc6a25daf4dcfc8b6defc2138ae552c82c83d06ea46024bfb7fca4cb6c4aed4efcda5c16b162737c7ac472d34948396fcfdb2ef76fa6ab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50174b352721b80af3aa8883a47cfda9a
SHA16f5c548e10f0066f87f565a4b434e145ad12049a
SHA2560203f45171e38bc7b7a8f213ede3ef3f4b13dfd24ac2578abecb525c785bb9f3
SHA512404ef4abd1d0c5b64052d5a2623431f71df43a5680f46f1e5d9a660806c4291a5d80ad4e382d9a1dce5110a6138d3a41ea74fee3b06e5c33cfe4873dd946f730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5507ad0769562ee46c4355f08fb9190e5
SHA1671d99dddb17896a233117ce6885a725f8a30217
SHA256b850b0123ff282f705d0708eff7d5f6a409c541a5ee9f23ca8219a1c6eaa886b
SHA512af3bcd18eca060adabb80339fe7088191792a30ad604f68e1a1694a160608cdc0a8e78fc0dc7ab1e342bd851f1a1a872521c92fa26ba4a277c2519dd192f3d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db6d680caf40f277e11d803084a8b57f
SHA14e98692755c5d0eafacb1b897be83bb48611ab4d
SHA2568e9f5a642426dbd78084d9099a00d75b088adc2b997b930e30b01b6e419bbbac
SHA512c0c6f634d089f6230b58afe70de5916ea5c0c909b6422e4bf22d5da56bdc889bcd078015d35486f768d90852f76700c108834ff8b04a46ef62412d4d11fa1334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ec1340234efb374ac28a82694a6e2d2
SHA1088684e7bd7afe22201d8b3818af97fda025f58d
SHA256048a06c314b92ce6a901e995696d0fcd39ca0daead5702a673b56eb27f74d814
SHA5124bd81ccbc8be277df54da7d732f08403c5484de78e05642eb14a69ad1c4cb96926f7f3acff0ae9ebbc3800b2612e3c07f4fd971afdeb5e56c3024ed571e3db11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8a251ac00a3922293ea600b1c074051
SHA103fdbbbb4ecf0e304543f9a1ef1a960927026685
SHA256fa35cc18147efbb9c127104e8225a60764a091e0290a356c9b7b167f236bc41b
SHA5127f556c867e6b82b0815686426725e01e03957d53e0bb8e018a56c05fd6783a2940479e6507aef61e8036b8a3074cdd603d973a7e51da97bf391bb531606dc565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a32b66be05fd7a67d9a3ac7170d60abd
SHA1877b429228543fd145401a5f434cadf47a46ee25
SHA256eb1571a1c4e0b092c5a195f86d33660c2d869f4560fe4788570285a6cf1b9360
SHA5128fd8378caf30e92a6bf7613ea114a7795bc2f1d6ffb31728ae127f0e7cae52ce8ffd7c9bbb1a24a8bb4485d35db8cb355dfcd018d5934183e4b175fd8631aadc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d6da747b1c3f3b46e79d903e9876283
SHA191421a12f90d3bc4c7f94b667f526f7fabfd40fc
SHA2567aef8c8817fb66b5fe8665c6990e42022c3c3bd535e584c153c65a986115511c
SHA512de11ed53de968c5fc5413144ea2df4f45a2d8d9b7b9649a3529d3de3c943559c32e227d4f1e874a994c72aebaabb5c3de20b9d03199a5ace68c5b17e8540e874
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b