Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
621d2b48fa88cf887302199ce837aaf7_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
621d2b48fa88cf887302199ce837aaf7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
621d2b48fa88cf887302199ce837aaf7_JaffaCakes118.html
-
Size
10KB
-
MD5
621d2b48fa88cf887302199ce837aaf7
-
SHA1
d490612ac91d1b7b172f43a0fdfe1f32dac1163f
-
SHA256
c00d7dd93f9d80d625e1864c47cce62f19bff84e8c0fa5042c1f375199d87884
-
SHA512
cad6b9132bfacaa5975dad0dec6766e76b8b31f79ea9dd6c9b7c11c1907f17b4f3e1e43da2b5040d100a3599c8f0c8bd7ed4a01473210f5836a34a6889a564c4
-
SSDEEP
96:uzVs+ux7W6g0LLY1k9o84d12ef7CSTUGGT/kzUp889+ssZMKuKHlVHcEZ7ru7f:csz7W6g0AYS/PW8VZMNOPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c92c17d1dbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a8b08289fe8dd4ac3f44c880b9ae6985f5c428f8d4c306d0e3bfe17588ed499e000000000e8000000002000020000000ff7f85a48f4c08ee65507ba6c6e15da62540e05de5d735e00bd05164259899bb9000000045d87dfdebc4478fa946e01c1b71fb53a3a60e06ea24d3a575a0bafc17ed20ddea363703d82c5a4b1a88e7531fc0a8d7f06792130a065acf93728aca479dd1ca6a36e266345cfef8a7fd2e249ce6366b357ce3f30a5212f3a178e5e020a05e6d6259e4cfe1c331d94495b0906ec7b73427a1e7dd737724c42d74af1c4a4400b8731dec4d669cca285c1376383759aec040000000731bb5f4f351ec7b7cc1d2a7b167ea879eceef25923f9721e79cedf66af42186fe032afb0c4d72312c8615b1ab8dc637e6a80e54dc1882e658320d9f30c14624 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427771240" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{417ED541-47C4-11EF-83A8-4E15D54E5731} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000002b41d0eda0848dfdc5547ceadf5a251e0e94f0d538bcd53c086af1665ec5054e000000000e80000000020000200000001433a9c557bb1aaa188ddd28a7b12636918c16e72158b9d6ea86212afce5bde720000000c3cc3d59b47268c89d34d9b375e29ed50ad10794fbe35f18a0e456283a1484b3400000007931708f49afd65d5744952c1c1c26abf67a6effff93aeaabc68e122c4944d1878af5f2ee827b2f3e52ffa4e3b2ddbea273ddcf6a02c38cd37d1d5096170da4c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 2808 IEXPLORE.EXE 2808 IEXPLORE.EXE 2808 IEXPLORE.EXE 2808 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2808 2012 iexplore.exe 30 PID 2012 wrote to memory of 2808 2012 iexplore.exe 30 PID 2012 wrote to memory of 2808 2012 iexplore.exe 30 PID 2012 wrote to memory of 2808 2012 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\621d2b48fa88cf887302199ce837aaf7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d9fd16100254c32fc551c8c305ee4d6
SHA11078656128d83b396478e269eebbd3eccb4b29e8
SHA25682da4c71357886e2f174518740e51a27cad833810358fb4009dfa8fa9c4615ca
SHA5120d0618ae21f6d7b0ee13e736b692ec94a251ee12a702df80069e8e6bbb46786c80c1ea09dd7fe4a5ff2454cc3b924a23320dbdc1bfdce3cb75af83226f40b963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5199925a662046e9ff8f515f02af8b98c
SHA1263c5c5225e6d437c4f190fc6de668405a734985
SHA2568dec696b7bdc5defeaf429e218d374c71ec99f9e69530af60e412dd667d1f3e2
SHA512f5ea2a1d0b1c018a2ddf6f3c4bbe7d02e2085c0b2d61e301dae9d2d64e4000da3d7df8798edd827ea50612f505d9a4770ebbc89e55e14862d767079dda3c449d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e40ab7f6004fea2788129db5c5ffa646
SHA1021c83eb2f954a39659abb36f3c82474adb9f627
SHA2569725dda4e49a88d3afbb979cc0034a7e4167c963a35f1b537589d3c4326637cd
SHA51204840c999aa07603407feabb82e3aca718021c352a60af5b780b643d75376e0bd473e2e63a78aedb0f683bc431c98302bb3333387bc64bc36679cfb5c356a02f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dc3ed5f67cbc1c208064139de32f9fa
SHA1a4ddcea2070c924801b13b78f49273239f682a45
SHA2560a1c66ddac22ddd6d2eeb2d695118af6f4eed9e2001a649986ba6c2a7ac50377
SHA512afd59d3253fd1ab022d79abe9eec8ee7c1afd742b6494a04035efd76545e3ced6357e0eddd50951cec1a5c9fcbc9bd0ecda1cb2757fcc4ef4dfc0800c7ae295f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c15878b614eb8aa74ed2ee85f058ac6
SHA12a50c39bab60d66cd818389e48663eedbffd76d4
SHA2564ce5c612149dde851ce8c574a272f82574b20ae1ec898280df9fd01c48034158
SHA51203458ef68109c80e41210d20528fb04898fc9c0e425af14830c4a76a47f1a4e660ae1be6837f8df784361820d32b639dc95681ae3d1cb67009dbe51253b1cbdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51df87325d756266a29d7bd1108860700
SHA1eaa8f4148a174efe49826057caf35a8029d55950
SHA2563eae68aaee2b1bc91a4e84afcbe50190ffeb52bac8349dd53c5f3809e935cba2
SHA51205c30cadb5f110724fb203c46411df78b6efe7ea40db3711257d2d73423c56e0dfec26e0ce698aa2ae2c8bc0444135e5506c4e2b7034590f9b517540727f17b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5352d97cd23659dcef1c8ac5aa76d8e52
SHA15f67c65961ac62cc67a73354d2397d7f883746c0
SHA2562cb12b35fa6f7b0ca5175f1e9b119059fa3183f2eb62078bf013176699f9f2a6
SHA512935a08cf20b03d35fe1730f1f90db05a216886eec28fb56027037d4ffb8156ee2d233080ff58f1c49668df6493747c41ce711ca8328512d12afbfbd56e0be717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7e84dfedf5642092aeb3bcf7c19dbb9
SHA18037211927659f30e4d8be9c19437480a0feb805
SHA256a962601573a490a6a0ea8d6d9ce3012692c1830f5932e866e4fd5f323e19a411
SHA51254b082253f01901844eaf0e32313613256ef7d648b1dc02c5b949e403206998839ebb1e946e418d534567d88eb408b00cacba38e5b2c81da1a36dd799a08ec04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55773e2547d36a539d0ffd083b3e086e0
SHA1d1b90010cc831855c079063b7ef8465769e63fcd
SHA256ea391eef02e2136b1c5d2fade161e8ee345ba815acd3022b1bbd08ccc90a83dd
SHA512af11eb608fa6261b03c9dced79e4e8dc7f6700a14a6082e6fbab7ed9dde9d3ca7cd138413bc3b646a4cde99d2690154f6e6edf0504e0df04685db30a6b6b3b4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d305944e598e6aa040b7a1131c6016c
SHA1d49b80bbf20e1f11cd0f2d40253dea06f3fe47ce
SHA2565df83c42f68b75418dd513b8e56251bffe147dd90f1896d275ce6367a1182a8c
SHA5123e2cbf3dd78ace7df86a4eab4f8866e3196ea155f5dafdeb0691d225e291b4a913c0a67bc962a9e3d1d07cc8a4231be8322a5114f628fb167868669ba2b710f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584f4628ac872ebd8709d2e1fbf2bdabe
SHA11fc639bf84ac51cbf6d67c1980b187996f6a179f
SHA25652b4a921a154db4b6a5ca3769188763f60e11b67ce36770e5f89d4932702fc38
SHA512aaf5dfc61e4bfaecf7b9e5995f12926d99767cf3c098f8cebed403e8e7ef675cb20ff0f403fbfae971ae4a9d8d219712b01ee22366b3b308b7c72a51c61cd746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe15189b1bfb1a32f24a19bcd4bcc49a
SHA1a6454b3faedf5c610e189078e576d182b0a3ed06
SHA2562a5132969303613a13420f77d45b394720868166b35f29b34cf53fd969f06bc0
SHA512f998ae7021e6565438dd47c93bfdee59086ba5d4b54dd9d4189255dc455cf62d13ea3306b9d3dc0c4eea9cb5c45cbc553546db19b7edea8930a475eb588d0cf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591ca698005dba14373d8bfbe6d9be54b
SHA189f2b311ebe67c7d827b7253c666932fcec88d93
SHA2562eff4da0534f1616be6e9f63a6c563a0afdaead4769e1b74e2801f25a6616602
SHA51203a3b744eaa71a54fb72e2303f8fcd66ce9a99b815426c649933d590edf48a87cced07690f6bdf973662d80d9934b144dc514dcf9238b74461cdea9fc2175e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5025f995b663a01a8fcdb079065995ba1
SHA106412f64a2d7a4177838a8242b863becab0285f8
SHA25620c4b1387bca9f6191764f4f75b79260ffbbff3ab8c91f45a2580c8a761acea4
SHA5123e3abf87b769cb4a44467b0c95ea9d15cd2600124761ae328c5c3d695092c72a667a222fd41956858ffb0c619d29f57cafc1189dbee41a674233612d45f1b8fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a30cc242576bd3bf8cd18578f7ad5532
SHA1ba50aaa09e326d1fd34e43fbe63d7bbbfba2531a
SHA256df66d96c0f618aec6507cbd0cb5b17f51a27355d301022b6c0a9a517ec6f9c14
SHA51266748879b84fdee7c6111516109cb34b21a4b12bab3af5485d2cb3d3c50f84798fcd829adf7ab1ca438329dd25e6b89811df6689ca7842bce35b6a0348e81c90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51106c325e5779e1d4f4329cf53523172
SHA1448223aecc53a85337cd1b34d1bdfe5013ab2961
SHA25603f51ee094826e92fab12e0809141ffdb4df41b3bac420c33323951ba0b80071
SHA512e97dc4f7f4c28fbd714c586ae935de1041f04c1189acb0884af3a04558c585a971b9fef2608c60450b139e2610b513d1aa5cfbd96565dace106ba146b9f1d45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54da8a06b4b587505018e43f4077d2a30
SHA1b04a94e5db144d08706e5e129f8908217f93087d
SHA256ce901276df01a4fc82825c3c642d11a22ad4f5c394615c8e0739172a248a5c44
SHA51289cc3c04baae29c248ea01069c3c093685dff4af0cb6f5691af049fb57499cb494578c35271c68e23d0190102f18aca73974e4ff58f807ed39424adc2af6e15c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f64076a6304e790c72f5e35626a67c35
SHA1679f8e306d6065f02b8a3974bf5aaa42a7c2eab3
SHA256fbbaa4a47bab35d03d993bf5ae98224f829185984fe2caa8bd6c94d16a292d20
SHA51296eff4456addca76af0ebb072f378b94c0f37c493b6408c826cb0f34aa30d0422b76f50f8c691c40f753fca307ee097b67351fdfa5bb7d119f8c1c94bc46bf7d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b