Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 02:32
Static task
static1
Behavioral task
behavioral1
Sample
5eb1b3524f5404e2c10cfd6cc7f07aa0_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5eb1b3524f5404e2c10cfd6cc7f07aa0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5eb1b3524f5404e2c10cfd6cc7f07aa0_JaffaCakes118.html
-
Size
122KB
-
MD5
5eb1b3524f5404e2c10cfd6cc7f07aa0
-
SHA1
4e8b32e1a365a345fc8eb597876caaaab109b5b0
-
SHA256
58fa9db782b0e6f309ff5fbc25db8a75ae931fd54951d28099d2db9720da82c7
-
SHA512
78744d4237ed11e798582d57c17a07c9e9d397de08d7b3d0512ecb063ca1e6831ef82a5e5339731d19445ec832d83bde17e20fc125d52d39e8dcbed1c116d711
-
SSDEEP
1536:I8E0+S1nj8S3J3hQUJCEJrh5MR5+yP4MSTTw:Z+0jN3c4CEJrLRi
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000032b176dcf25ec96ead4c6296e69dc4930d6be761f31872cf9da4bb3b53584ce5000000000e8000000002000020000000b5562ade5cd22d6eae9a7f4cf141cdc332096282d23effc324ab6b240b0678a520000000c5a96b06b34373c1dbc94c2a546c19dce78cc4e678e3b2aba1c702c5d48d4e0b40000000bfdb2b07a553a67ccb2952cfde04369a0c5c57807d987b47111ab43c3a0c89588f81a7bc5f447036d1773084596e5a84a956b3fda634af26356bc0483fd2bd86 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40F2E471-4640-11EF-99AF-7ED57E6FAC85} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f534274ddada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427604593" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000eb5ee867e5e036b0636aba79b5b4cd81ec0deefe7229057a14c9361a04d2030e000000000e80000000020000200000000350eb83aacc6e79909284481770aac4ba5bc1e75f920cf1cf7058c278f3566d900000004bb609c6b147189cea5f2ba7a94526a1527000831a45de7874f84a86888c58b59ec66d55765ddeaa521750d3babe29772c0088376c22de5d00342903856e4aeea037479a09b7b63949f75c67f65e299e8b504cc3ff1a6226f0c0fd35c2ea82907ea2fcc95c7938831455d2ea92c63660b12229b6e0ccbbda77075ab7a4e9e32321bbcebf05bfe778f3dc73b7a174af9a400000008db07f36b7de4f45e17c1e74cfb51ec3edd79f37ea205f1c147f993d5a26a755067aa17ba0ab05b4686ad3333433514b7401f0684f1289aae724e53a536e7d0c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2124 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2124 iexplore.exe 2124 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2336 2124 iexplore.exe 30 PID 2124 wrote to memory of 2336 2124 iexplore.exe 30 PID 2124 wrote to memory of 2336 2124 iexplore.exe 30 PID 2124 wrote to memory of 2336 2124 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5eb1b3524f5404e2c10cfd6cc7f07aa0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf1dcc41d0cadc025416c8af41e8cb28
SHA1a901839dee6134dd5858b879d0684fe98ee79a2a
SHA256e0229e28e2d743c8d4690a679fe0a7acbe4c7824f9aeaee73da1a1df3bd6cd89
SHA5121c102f921381cfa8eede312105401d268ab609f8ae8df898e47a5138920a8161b9434ccf8b39d35c23e41e78f1fdde85498ad854942410ae74973cbc9b437044
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a95a6f43ebad700225e991147d92bef
SHA18be3ddfe676e71a78edd7dcee2410245b5725024
SHA25617d76d9dca90b2ffe842d31f07795b1eea15dd7d18cf58cca735c98b0e6f614f
SHA51202c1ab8e60e832c798018ae1e4c2c6a7e56cabd274b8a871fed1c268f4ded6ca6139a0731f5ae8eb7cb6e5d00ad12ca06fdf07c05d1bee2c104cc84a1429f436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4b567cde07803f70c76839ad4f95828
SHA13aeee8e8b76e8df3ecc92e18c3d18291b6632f47
SHA2563b5f5a8422201421ccd818b4f46726e32440b44f3178a8b033281adde413a389
SHA5122305551938eef3de184a8e2cfc0e764515e3d12b7f1aeab0dced10a050fdd5869588d5549aedf0f18f34b18b959899298b6106ea288a33903281dbe7a45ac0e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52997f2c636de1d49734494c0c57ca9c0
SHA18c0385969a12e9332fdb038dbec6d09d61785fec
SHA256c811e01c18511e5476e8855a2687e3115ba56e87010ba64f6c562d81d8b93eeb
SHA51235157c0d043348ef743d9068a61652733995aa698b91a26c1d312b451f5f64aff9f5ffa3904ac5ff7af0761598275139de256b171c94b9ccd0e2765d0d4c7f92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582cac6441c6db6eaefebd5136beb66fc
SHA1f17f310656e6e931bdb1fd34078765e7f01cbfa9
SHA2566eb2213e3482f78dfa4da58f3a753838673f5cd97966defd25fc8d043407b0bc
SHA512c126d2598565c7716b21f67ebdb7504f9fd4c85da55a27c8ba277ec7f6fb6aebc0e2b39506a917bca26de20953d97b3bdc0bbc91e0a3f04b119ea0849afbbfc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcdc78c9b76dfd6a047775d522d3511f
SHA1017efa6e4a53bc9cb88931e52bda09d483fbc5f1
SHA25606ca9928b72dac3e9d930dd9ff9c6df87ddf6dcb216a88a84ae8b2a286ec2dce
SHA51286c9f62def45dc6da77d23eca315817b63aed47f4eac32ca40956ec4d2e4804ea75e5da73f1fd15cf49001a99cfc4d43dcf9808b4f8339988da98ff5168d3bc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a814cf655e19256ff49b01fe66c472da
SHA1a406461db814edd8e2847a6d88269fd3eaddd6b1
SHA2561eb8646e91bc1c882d3401ed24c85b95a3702aebcc4163490c7e87b721bf9682
SHA512e10583769fd806a2165aba800bcfe81166e5b363e9e56c9992f751ab522d86b85777eb798b6ba0c4d920f72653fe476fb9ba0608faae58830b36f05915b9125a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0f1aea87fa2a189af63844f39b9c7f5
SHA1bd0fb72358050cb474e5cd0bc29a954077e634d7
SHA25627b56ee6b1aaced0df583aa4cebb5e972c3ea45288df788ae062aa682b37ba7f
SHA51249ea87cb5a5caa045cafe102377139bab49f202bcaac89b4a9bc634394b89e6c2b091659d0834214c6da3919d07363a107dc1dcbd2f762ddf2cf246d61e96aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502a56acacc0f333f597b2af1ce59af5b
SHA19c382fd4b8e2a4b02ac7d48b82ea7e4789e45f8b
SHA2567466b29d762c53baf0f7b51b8d471e4a19f049f2a66703ca7c9457c6e0cd94af
SHA512d81fed7a6e9c7051abf4f4f80d2e82d8ba78fb9195dd0a2ba49c88659c5bb478165b03332867703e2b00afa30a0d90cb9df8eb53313fed00b2ae4083ebff0034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a5b3554e6b31b4b1af45e7f033a75b8
SHA1c329f33a9110c3f155339b1ffa3c12ec8e04f98e
SHA256d27b984267794b2cd4dcee38f1617436a433384bfd716868a6d0a6e11973ccad
SHA51243d866d2fd848011586d50f00d81462863e5c68122d2204a8677f59f952757df743615acb3ee22c697ece1ba1349d4928bbc0acccc9abeef5c717874f7dd0648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571522a08ee601672e4c40a62b77091c5
SHA10efa4cad473eb6e8a756d814e99a32458ec3a2e1
SHA2563f7072c516f8f5a5b54e56a79809a01f6fbf13aa041c6ee2e97c7f7faab2ef8c
SHA5122b80c2397b932efffd793bb2557da1bee3fc9d29edc8acd02314a0714ec24a1c2cb55968f5f2a07e9e1dda241d8046a977a16d191b540e49413a4db9e3710e8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd1d9a587a7fed6a10e5b52051cc3183
SHA1be463fae6b6189bff0132b2d86ca6a81115900f2
SHA256c98dee0c776195cdeeee11059082474508f0d02cbca13523cb7ae8c90a404ceb
SHA5123eb0577830a26ffeb0880cf2bc02877da2c99919644e125db01f40356a2f50c0e0b7ea546391c88fd1be9e569d9768adbc0b20adbf6eb51e45b9d527c3e70c21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3a5a261e55fc3aa4b347d38efbfe6fc
SHA171d5939dd0c3cd27c949a541b5d55b7cad67fb7c
SHA256fa3ceb1b102c624aebc2617da4c0d4a44216a6b914dcdff04ffb38a45a3200f0
SHA512afbdfad90a340782093834d763fb73449dea44a2205c32cd2b7c94bc4a4772f820a18828a7e2b339126c7105edd788dbe33e91fc521b88a8e1fe53b2c898ef2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c711be3657dfcb553c63e29d14cca5e1
SHA1a64552c3bf0dfbc6f93f862bb5715df811ec6be1
SHA256306e2bed8d42147ab60f68aae4a975a4d843dd3ae494e1fdbbb84649c13066bb
SHA512f0c08701daffbc266ed57be51edc802dda2b7a832eaa153712185fd0a0b66092712879d40aa2b7ed1638d98fec303ecb7844eae21da3eddf567ed13b42c56be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503946f51e2f16383fe9936818dd2224e
SHA1ef1781771fd9159ce30b83c2e89a5081b887394a
SHA2565ffdf0bd61af5a21da505929675805b444f70fa94dbe1b3fa71a1483de402c1c
SHA5128ea7a26a8e6b52ac4796b059f16ef7cf57db7a62b0f7c7931bd3ae135b55c0a719c62fca6892150fe26e1658af2b587407ac6dab4421549a29a34358fd7d01ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e441842a739fb8bde41016f7df7daed
SHA1cfdf4973c7c7166f2c6c0f3cb3a7f7ac9f06c7e0
SHA256d9cae5735f9d8ed36ffb9fc2ba84b79bdd0f081950ab46be026b830bac963fd5
SHA512c752efe2211c8168a455b293d6e71fc2caf000e596166aa67834bbcdaa2d3608c95a3ea5fa97b488f160cf235584ed41d4d48bd460ce97343e84f969ad72e36a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f08a6881a70897136d0f581ac2ed72b7
SHA17505ef1a7a377a2f93bdb36fa22aa31df338e268
SHA25680bc98371c66f7d3a2be274f38c7afb734133d1f3551c7bb1aa850fae961890e
SHA5126ba253fa0e52600c9555cbbe0269467b1f3ddb90f5f319ad2e4aa7aafe9e17188efe01957281a1ab665edcdf553141ca9fbe14529b50ecc20b58cfcf49f5952e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dec962016776cfd585202cbb8e936a47
SHA1214745c63962447b3e0f7b896e6071ce918b0966
SHA2563aa8721e15266c168e43df2955f53d2c1eb4653cbdae0ef364b11296c50012e9
SHA51299cd8bc68833c072f1c789bf4c135d53b7eafe5d96a31b9ae863189f20bbfd7ee6eb6514454c89cf2df143628ddea4c19c85c86852fe4c4f355281079558fc60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7f8a60e4826803e2393d421fb41e900
SHA1c8d90916b60c8490b007f18496c7fe6772b57c50
SHA2568dd4e380bb4aac97a82577d25346860fcefdc6a9e6c2338d5a079195dbd70f04
SHA51282996628726a132cb565ddcabeb2f0cd0ad5864a764c01fd95bba3fdf521c416f584cdd8ad7f5e68909faaa5d645109a2fc73855a747df33b1cb5caac80dec56
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b