Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
62875d1e3d9860c92d246a83eaa2c16d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
62875d1e3d9860c92d246a83eaa2c16d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
62875d1e3d9860c92d246a83eaa2c16d_JaffaCakes118.html
-
Size
6KB
-
MD5
62875d1e3d9860c92d246a83eaa2c16d
-
SHA1
8ab32fd1658c87ced8833b4294cdfba4b1ee6f49
-
SHA256
44d4cf2bda7d6aeda2c1b9e0f10f181c6457457d4d2db1489fa03ba8e2297a50
-
SHA512
e6f3f6fda715bbdfa5809d2e6474b5da47210b80bec0d2e1da8718d8ef016e4c76120f8deb13c06ac758d9bf1041a4dad8512289c70e5bf9e7ff9a3105c9340c
-
SSDEEP
96:uzVs+ux7OELLY1k9o84d12ef7CSTUq6UiWicEZ7ru7f:csz7OEAYS/GUiWib76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72882C91-4805-11EF-81BB-526249468C57} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000054f79ba4cf7cb91f6f9ef978b36befeb2a83135a3851e6f5c71915acc9e3d978000000000e80000000020000200000002ec4f9000dd30fa35d9a18e16b2a4a6f4c844ccc8871a32170664b4716f25c4c2000000069abf54524d3be61c681f366cb452b012f80a82f03445a4b234778d15bc1883840000000c95ec7e4b75cf4a088c2b780d4beb4ebce8c481b579661173a6666a5d53816935f98fdad6e9297167f24438db997748784b821ba9ba94b24b633de38c26e441e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427799239" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d006f84712dcda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000022e6b6858eac88ac0cc0d4404b2554507c16ac4aa515e91e0a76ec6759645876000000000e8000000002000020000000983d6778745d4df90647556beb5156b9c3e8ade8633d7f994d22570cbbf4000390000000d5c9a40135f3e181c185005e8959d9c21464b211ee68aa5a06c31d7aed6187805fc922559487d84bc5f1830a8003e5fc2965611ffa437e6f3892e4db12bea9e915cb8b15c5fcf43644a615427bf5ed0b206162811d9c525a6fa921f12dbbe40918861fd9c6afb6f9c414d2124f794f61b7b582e6121e5ae18cfcd601c61c9b60afa31db5354bfcacc8801b8d39403403400000000dea4601a60b5532bc4d4ea0379980aaf45a1354c00923d1aaac76d7a4392a643751e1428cb59512a08438a9abe88d13f872db0a7a2c69778852ac4521638aad iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2712 iexplore.exe 2712 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2380 2712 iexplore.exe 29 PID 2712 wrote to memory of 2380 2712 iexplore.exe 29 PID 2712 wrote to memory of 2380 2712 iexplore.exe 29 PID 2712 wrote to memory of 2380 2712 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62875d1e3d9860c92d246a83eaa2c16d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ed46f063c62f0d7106d4670b1dd6468
SHA1cc2330bea19096c2f9c49dc3bf04dcb9c093cdb3
SHA256ca5ef9b288fa860e2c3d2f39f01f6a22661d16174d7e1b4bc54ee15a377249fa
SHA51285e57e30a02c687f69a1d9cf615760310b2e164c84530ac0b2527f62150f4479fa4b57a5a04ebf708727e73c83e05dd3bca6beb26ac90bd974735144930e73e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b051d2a117235dfa0ee127899c574bbf
SHA18644d53622abbbe045684f9185216cf950cdabe0
SHA2568ad4d895418549fe3d4bea74cfb8bd983e42aa0e74100d4c30bc3cf171fdb205
SHA5122282ddf46cdbd3928038276e44087ffc57258d189d77f599fe2e7836c4e1da9759336baeef353291f5bc7a05cf45dedb3dd15d91d9ab4a79d858199a902ab435
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59023192d619b2be92dc8eea3967370a4
SHA1c942a26adea15326fd7802401a39f4307430f711
SHA256fba37bce0344d1454601b6c86c12a788eaf8de53c2d009b9fee3a2019674c14a
SHA5127587f4afd00d239d5c142dc097bce5b54a22b580e5222ee9a5079893b7d7051f147840e0d0b1d0dfa44698348d2b61afc0899d2cf6d21762f9fed4cdd55dda1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d760490a93c6e21adf08e8a8c45c2d7d
SHA13070e9b50b650ecdaf8abb47bc46978dd55cb5d0
SHA25640d0733207a3bfd3ac1b5841de2ffbb2350d1edeb72d7b926295c34d9a7d6f78
SHA512de8108b95245862765cd93bf1ef1dadcfc47972b9ef2c589f16c45f705648e7a549a51dba18763e8477e46393f7ba3e54a1c8a251790fa3d3ab87c76113dac77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5331f3efcefdf90575b508c2452a8fafa
SHA1f25e86aaff5c448b140512eb9ee40cb2d8b17e4f
SHA256ab12a5f10e55463abec9da5f9c0be18c26c9c802d34a6f16fec403754c94c8c8
SHA51220fbebba50a5c120fa4508d57ae132a469bb2f0b4e3f07f065cc0672e1824e6bbb8e750deeba03cde9319d7df3c2ad6b5e4d7283c0f7c94f0a82b707ad2c1af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7dc97d1ec1dfd53c7462cd4c44afdf7
SHA1cd9c36500b9acd561171107f63e7ee62f06e4e17
SHA256acf864fd0989db74d06df067ac379c68df0a0b96dd06e265a2af889b1c180e8b
SHA512fcb9b6e8eac299dc9623ad039e74893aa9b9399de3ec1297997fae2d16b03d8709be6f650faa1e41bf4f90d0c1f16610c64a6aa6d2e49cb892c0dc22d2b6d8ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ecf247cc25b6c9c7abd20bff149fde2
SHA15f32e7a299991a230973d82b90b8e65314374fed
SHA2560c47ef79e0a65c491ed39a3c576efeda58d3e2b91b83c0728c22bb46be5f7921
SHA512c67f29c6c07aee6ea807a85c373db7f4d2a10baf3e4ee3cee159ea2f59cb8fc1d012e7e7e06e64ebe2e96b184c4601d4fa638fe3ad954fc6919f5eec643d01ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590f89cb255a6cc55ea26a42eb540a34f
SHA14d4134606d43d0c3c07212e8153fd79d493878ab
SHA256d5ce560b75fdde6a63de0111e9d9b36ce78995de43196ebcda5f3579902dce69
SHA51236042624f6f966f3f8d2f93af98af4ccf70ccf8ce567513af55af952a50a01bb2507533964e97a3dd7693c10b43f4ac593f52216e67b20dedae18c79bc6dfd74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c71a7f6b548d6de42e00b91129b6afc9
SHA178b43d98af32c73321851908927635491c8cfb74
SHA2561e620bd5ad422875d3e71f20e10da269242c50eecb73947ddd91c7835c649765
SHA512cec27ee0eb627e0ddc0dee5da45eaa52c0ba38b961df519c5bd56d74f5262fda46b5ab771363d33995ac090aea10ccb3acee7502d718155bb62e4a2b32780dbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c060f016442221773b196847d65c0f4
SHA1ab9b8731115e1968bcd3d5a1fb66260a103e980d
SHA25605775bb74cfddf38433f5ed3b40698c9285cd14d22421eb77357e4bf7660e3d1
SHA5122b33f5e44b0402d17b848bd506434b5cf8493174175cc9aa694d2d25636473b9026add4da46cd9636861fd6661b6b627187e447068d08c4c4b2d48bda84dbfde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5074586bf0e7971a8186fd84adc165dc9
SHA17fa2dbf5d6c99957b983db6352ba3e94347adb56
SHA25692279137451b84efe6e644cf5c8ea5712fb1a3f7b65b078e37e1f712ad8710d0
SHA5122b3eee67e316106dc24299dd55fc295f85961edb645b5911de7262b139d829879ea63fd1bd0b3425bd42d61452d65631263dd384cc61d6a2961dd18fa077bc3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a0d2606251839066f1e568cb8bf4562
SHA152f7c827710f8363e446de59c05c8de9f70516c7
SHA256d71285903fc0f8556e7b232d3c71217462cbceff77fd8be7eb2a90b1471880ce
SHA5124452c0fc9675627cbfe0c8e23787e5c416e84227da01c1cc2a21c39d9f12a8663beed90649011e780642001685305be7625e2bd5a86b7bce33acb9b6ebe2beda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d6d80343e88d5b543fcbba9b1995b01
SHA19932c36b421450cd59ed9cae9ebecd983791e656
SHA25693f1bccb2bd2d57b3d8235c941e2c93523a0add60400989afda27a8129d7d853
SHA5120dc453b27c571409eed576ac54c3ca7e1c6c05c173a12cc2d502e2bd5ab44a0b65223f9235d7642fe838ac51a3158ec3861de0c6ac72722f67b15695795220b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0c05e39601953f8869e4262777f81e9
SHA1bb8f852b12a7ddc50757004211f5246d6bfa00cd
SHA256988f94771b13b2fa4cc3a4c09c894e8bf36979c325d7b7f3e7699237882cc1cd
SHA512039dc9cf6f85dfa5c1058e1bae3bb67e611f1a5892ee755a443a27f316941d29b09ba26b6c7462aa9c1417ca77bc579cc4ad524e5813dd22b44bbfbdedc558c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3a11b2d1d137d63620508333f73cf42
SHA10ec9a91fafaf201263b373432ad2b4c6fc3dff0a
SHA2566ac2b7d008d3ce0b9d5ed40c062f1ca66f841cd15d365f3ad3a14d83fa517663
SHA512feed5ad7ac1250807524e0c38f71caf75ab72f9dac2b2b794b74628bb74277f8647a5555cd29cb5706207ab6f587f61ee3e8261b5ddcd3a2d41e8b3b5f5f4daf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b951048366eeaef2630e2951647aaab4
SHA156a57bc2134a0481ae01f7aec0757ef4ec6e0d7a
SHA256277143f28a2046635169884d6aeb6a7137526b8261a4dfe9c9d150a628059ab6
SHA5126f301186a91ba2bf6f440c5a805cf2d33dbada3c83f87630fe1b4b0a8390ec570c73335e7ca11f3692882c21c11d2aed9a837d760879bbc6b8ad44eeb7b06915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e1832acdaab12327ac9bd6064d72eb2
SHA11d8bbb1f7fcd52d180004f0e1034efbb81a28158
SHA256ee1903d01e5d8ba6432a7ae94dbf6cef96ffe7a2a199e5ba04176baa96278002
SHA5128b69f1237042699deec940bfebab2f3c06a63a40b8571b0aed7d2510c107e876cc24d1dbe7aa6dd9cccf64faef3bc8e8ca4f7d7b78cc8585d89d59dab88dbae9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a9d86211005f64ff74f712e7385f051
SHA1439715409ce4b3965b54866b8e4dce9f615d04db
SHA256bcc66f05b1824d031727466e5906fe98448f6099cf831afab4ca92a6c299d4fa
SHA51242edd4efe3c0b19c740203ec5f7115ae5887fcea2981971b86973e0007b6ef2ba1090f94a8f7d752f86ee5207ce80fd93f38b14b5d49cb2a1d0fbe71f23105ec
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b