Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
62122af7ddc858b0a4bad132f5c09369_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
62122af7ddc858b0a4bad132f5c09369_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
62122af7ddc858b0a4bad132f5c09369_JaffaCakes118.html
-
Size
20KB
-
MD5
62122af7ddc858b0a4bad132f5c09369
-
SHA1
bf207ad41cf45375f3a9115e5e473b8bd29611b7
-
SHA256
959b55335ee443c014f3d1f93c2b6f7a11fbc8e818b03c63af10867af061c2dc
-
SHA512
32e63611b510ab7804329a0b92520a38683e51a8f276c0ad417e97a52a6fa81aab858537be2914b76e41588408bce9fd7a5cf7c67d9f1e6741b6d0337082bc13
-
SSDEEP
384:4+QfPFd9QZBC7mOdMQQuKfpC5IgSnbmFe7AcbW662HJPd:Zcd9QZBC7mOdMQGpC5I9nC4vJPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002179c07bfbac5438445243fa7a36ce4eaa212e3f0afaeb4d3b7bbdf718d18298000000000e80000000020000200000003b4d642b0852a27c974db1190e476df316cb1d909bd0f9703b0c51fe8ef85e6890000000703e57465ec531b1d97d8674b4045457b343b226c07bebabae7a83be0d2842a16f5ebae057f76c9d200cbac498428c8cd122e6c400ac14295db2b23c643398224f3aba8ac2743aabad78668439762b5ae88dd3180160460f5691c08145445f5abe52924e2ba6503887cef0bbbb25e19743eba25caddc4ffa85995141aac47d16cccd57a37996f016fcc4ce29450698ba4000000016395077133eab8a1cbf98b590a3d0d037150819d3317447d1c2d4e038a2a6a8acb1781505e3fc4006fd023c9bbcee4c1905723c6747f816a959ce0d7ada81f6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02f2a5dcfdbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{878F3681-47C2-11EF-937B-6ED41388558A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000003e1020de5a46afc6fce0f124f3a106cac4037d4ce4b143c7b0764a66890c546a000000000e80000000020000200000007a984fc052ba4f3d9a09e094ef5f7cda3e931f620b23cb3585ad4456934f0b1b20000000f50933c2854d4120a5b6cc74eee35dc4c04dafd420ee0167eb3b66982070c46540000000481a1e0f8e8926fc98b5d4854f6e180107be47d218ecd825e4f7cd58bd0282a7b784f638ed41368bea05bba4da967962b00fcad4a2908a1632c707379a0f3242 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427770497" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2724 iexplore.exe 2724 iexplore.exe 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2740 2724 iexplore.exe 30 PID 2724 wrote to memory of 2740 2724 iexplore.exe 30 PID 2724 wrote to memory of 2740 2724 iexplore.exe 30 PID 2724 wrote to memory of 2740 2724 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62122af7ddc858b0a4bad132f5c09369_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ac61bbce2a1d420d9b43e36da6f50ae
SHA108fc45c2f2f983fbc67e9dd5ffa5e0104887ebd5
SHA25648f845b496409afd4aabde9f02d35da899f65b97ffa0e89b371a17a595aa5609
SHA512e2331fb38032364394fc5b99b842db3c2cc6b9b423a83a58c372d4413c1765db37e4296f38b65aeb153d1a79ead7466d3943f414347a2ea7449da4b4bfca1cb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f803e79ccc551e7eb81413d58bc87ec0
SHA16d5da94e8af2bdab772fd5c541d48d455ea708c0
SHA256497f04abe548a47b037329e08f817140cae0d6acba6830ee50aa56545bc4baa7
SHA5122906875613100a2f7fe9dcf9f800e979b3424a66e53a922960a33d57966cd77761e0512b807c8803da3fc28bbacb49b857d4bf4ed8463d8da7d5c0eda30655d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55242ae7f22935e27062b6850c0092ca7
SHA1f123768ccd1b800ed021a95eeca6da4b0542438c
SHA2565c634dcb29127b647c37df214f51b83e99e6788727def721115fc6425f6ce0f7
SHA512bf0a34a082e8343d103aa17701c5c529442a8919481e08bc08f3fb0398be796c9aad1ee05182fe4e599897d21595a8ab8ee845dd7a6519c42266e1a6974f9764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcdc161c9a30249c30610bc2989d2963
SHA1589c44ef83bb055855afe8be6d142170332cedb6
SHA2568a2fcf5f52400afcff10ace5caa857a3f35e3ad31b04c12a7eea2c718b0759d2
SHA512a99bddedc0c45dbc53a1300b1c5c62965e2a876cacab85a791dd2e73b6d7d9c55672fea276c20592595fb5495d4005b716af0c60c093a1b1f5f0b796ca1a872c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53520ff061286327efa715a43564c3c85
SHA121d1aa54ea55771e13bffa06968f986040d62c00
SHA256cf5ed41f4558675685b4e07f95d60e87d30cdd11f6175ba48ab24f640850f519
SHA512a7a7449b19b74a7211844a34d6a4245d39b6c15cbfbf0ecc479dcf1c702a2806ae04786f50bcc9060ce3add44765e83ba26803d5d54f60698724a6f69ea58784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5026b2776ca65916f68abbaba52ea0eee
SHA1c77dd2303c8c7a7c18d222f45cba0e631779b96d
SHA256a212daa43ec7214295b9d713dffe897b27254ec0fedbb2e4adac11ce86fff36c
SHA5123f323f9b8ad5ad6d3b2da9c49bace78de135195db2b5db99a3745690e06b014f6bd4b6b6835e6595a3088ef5e7365cbd8df0787353e81b0664be002d5380cb9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5127156273531c09e9b8d17b6d38fac73
SHA1c8f2b8f78a4b30111078de69ec6dea9d707f4e0c
SHA256905363d28a568fe954942ad9acf8c28ba481aedfa142b5fb3d78884ff6050701
SHA512a485ae0ce5e02d76e06ed156ceaed82c9549ebbe389f189c971cdcdcddaea53e3539b76b2711ba41a0caee93d688b7a84a84e3181805cc8502fbffe8db6e2ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba1bee534360d7fa9aa13a2b6435f68c
SHA160d2472fb6b1addd119b8abb8f4d0af89ae81fe3
SHA256fdd997bd4e94c451a7b4b6623f516528ee8562db121f49234b025884f61ea14b
SHA51225fc6a2428fc359ef2583df9aca403ec13d3702a9a1f53b464b1af23a4089136c327efc6ae9b693df4f42c79775d2054a9216046d8e0ce8c35f076b0de8e8f90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a2ef214cc863a4600abe7607c38c704
SHA17ea1d1a2fcf014f849d48db8e57e0ca9fd311ee2
SHA256a1080d52fa645d674b3260a5838b00e3c1d13f2d2b247a285c9269dc4ae1f330
SHA5120593996afb04fbcaf09b9dd896fcc756211ac505709a34525ce46d93d4f2082faafb48dbc62ef1109a00d217eaf0a1e00d26d179a6a63323ac4526d228dc92a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a84c30cc0960c149d5f985770230e68
SHA1f0de0f6f41585ad6c90f8d28ae7df56181ffd25e
SHA256dae3251271d4d63ed2b1b8e50bdf979e9c21a9aa9b726c2df525c257d1d6e8c0
SHA512c774d8ad973ecca8c57abd433e5eae99a744628865e3661c875708495bf48a8923c4188be60050c2c72519b7ee6d6afe0db4b01e688ab62cc1539855dcf2b67b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5957f3c08ff45d0264fa8131be1da0f25
SHA127f605a628c7f27f637c45d85f25cfb2a2e7a90a
SHA256c070035bde569c1ab7d56dc682158e579d0a5a5d1543f46b9ca44dbfe7252873
SHA512b7b0226fba16348651d86252cbcbc0004224ec240bfd443b03370d7ff2fe9a0da6916fdad6a6ff918a00c268ac0904a14c9e1e7b4422d1de2d9b6810bc4ab9c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6cdcf9e9ef0c2591ef4b3bb4a15dd76
SHA13b45e71f7322f536109e09a26c5c2d82cd09c30f
SHA25693888ed68a4572b2e1e56b943316cb909887e0c69f414c1f43a758cf788f3f62
SHA5121018e47ecd50763614f63db8f831c56e9d9d78792c5b937604ead973ffdc74f5841d046d54dce4aa3274015947f43a82b6cc6d5044843cc8a3d7f75d4492926b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f66efdbba2976fc6b7f26b6c91afd9b
SHA1926d07f61c69443a13d94ac4d4d2cba61e21312d
SHA256819ef9e975f84a22d059f088c856c517c700a7597afe789fc8825212ca35e246
SHA512590e63b9020c371f6c731718049281abb9037d632011f63ac50e647e9820cc21200dfd889c969ec4b473f61982aa3d134275c87f5d84c25ab4bd0eb13ff4feac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a2a68e8dd3b4dbac006fc1f16e56335
SHA1cf02010b725d6062ad0b30f1358dd3ebc2621a3a
SHA2566cf3dbce4bfffdeae1e44731286dd2767f28ee1d251df7f7b7cab620f22d36c7
SHA51245bf791752397539d454e7c0e40d75bb3e9b5f47eed011f8ec31fa704271fec23862ad1b1ff95a072e618c36e3c1b6f3d59296d7253bdc18de2b1e6e32e2d93c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bb74f366f6538587cf6c3708430db94
SHA1581af94578c79e60f319569abaa775ab4b11e54a
SHA256c5ff4ae9e5f15a3518d779188f77e42c785b864c2a85a00cb1ac3a959b298929
SHA5124523a8f2f79dc403ddcec70daaccee1eaa94fe7754798049623fdc61a8bfcaaa44913aa4426df19e98ad74a3d88f08bf0592514ffad9baf1dd6070e6bb34ef09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532eb2b4119d8f725241b8766184fd7bc
SHA133928ec387f58cfb53534828ae157b469ad1cff3
SHA256d02f9e0260b2751982c88a64082992fc8f0b56491747395d0fe440b412544642
SHA512d6fc271561294962a4604cd6368dd287c82079f6e401908f6789470d6a1b9fd431bfb1742f8d466cb8349dd89d9481bb30b7d22d2673a363e966db899ea46684
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b