Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
63294992fb88c4a2ee41e815ca24421e_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
63294992fb88c4a2ee41e815ca24421e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
63294992fb88c4a2ee41e815ca24421e_JaffaCakes118.html
-
Size
133KB
-
MD5
63294992fb88c4a2ee41e815ca24421e
-
SHA1
909ea80e823c0ef081056c5c454717487e3550b1
-
SHA256
4af97ce5e52bf74822d1e3f3724c38bc44b237cf6eb0dd4f4b469b1afd9d88d2
-
SHA512
c50836500acf97fe40a772e00c08cee2425ed1491e21fb00900455659fa625a23b6fa7a90c8cc6ae6e3a387a298761ad3a8b53b763b20a55c309d4589daee5e3
-
SSDEEP
1536:S2Mr1IfQZU8joAyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SBr1uQZ1yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000efe88b60a766f5c01dbfad1a8f2ea469834062319f656ddd02a01af927b1479d000000000e800000000200002000000049c9eab8c74dde2cb5177066234c6e62502e24a2f97cb9bcb9b345a0c0f705c320000000bd0f10433fd9ce3d86adc51586d88a3cb3a4de0e72078e921892c210ceee46174000000070cb741895fef448bd4b8e50e4dd65b6f4d3aa52247c5758b1a034d243c2e0a1c7f156fc073e09e36046feccc4415d162dd294c8c5b549c002357ae5a2c50b95 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1083d1cb2fdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000daec89344bb7d19aec1e18087e0a742057c363b0bcb2b08061bf967cda908208000000000e8000000002000020000000e6ca6e2ba29cc1f2ef79aa91f2259daa8636ee16ca55490335490608985a7bdb9000000079599e9850535dd210c21d8bd8a1d7048f9e018ca36e9664c66122d7591e33ca6fd0515926447930544ce082d4af2cbae3627d3aa7707d0cd53c30797d31961ec939edb7e39b91bdac51de595ec849477a5ea0f34894c95552e057cd946e0376bb67e1318564e7711c70da1f5722533b6661564a11e3183327216621a51cdc911a6c470f2530d59fb56c2906c988f2534000000078bd0c8be94a4767cdb9f61e47d3a7d8f9cce04d31b7b296b2a9fcf7b5cb3b78d2dd59f9256ff2e751fa02770fe1b65ca0a3b26e1205cd33c1d17b75b9c08810 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427811918" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F723FED1-4822-11EF-BEBA-E29800E22076} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2324 2244 iexplore.exe 30 PID 2244 wrote to memory of 2324 2244 iexplore.exe 30 PID 2244 wrote to memory of 2324 2244 iexplore.exe 30 PID 2244 wrote to memory of 2324 2244 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63294992fb88c4a2ee41e815ca24421e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcba7e7fa57cc59e2feaa3da1fa27204
SHA1bcc328bd684744e5aee992d30996b244ffae5deb
SHA2566d52e290239244eda651759010b5d18f22917f36d1853cbb9e4edbf6c8841151
SHA512ad19591e1eb9b9dffd23caf5e212864df57b589f26cd6210e71fdfcbd7556cb693485fb7036747c7d8f1f01f6ca5a297358e8c93ebf579b5a6bd6655cb701928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6b3720a4d1aad73e57c0ee6444658aa
SHA15d4784c678bda8093d4cf80e6bb5eafcc7024aa5
SHA2567cbb5e2f8c997264354a4ccf0994b874b6e7adb3135ebd044205b3a32ebf16eb
SHA512b3eaf442614a2b0313233f500e692a06ee068f23739e643e123a333b0de5dfbda523ac97907265c9d13808e00ec0ff8fe7eb79eba5f4a31754c8907ee54d5991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba719a835455d563729bd891a4529f86
SHA1265140cc266cb34cd2e6b862e3aebac405ba1e65
SHA256d497f1eec7f6f80605b0e12fb9d26ff9a24dd47c923b02b2563383507a047d4d
SHA512c0ea27291f47fbcf15b53d3526b510180112b91b7910283d8171075e1d3e55b3fafc662bc99b5ae8173fe472f4cb6277080836c3f70c0497d053ae21ea880331
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2b378ecec74853f02e32c2770349168
SHA131ccb17b1a06108f14e1673c7143a9149f4d7ec9
SHA256813415fa3a5562df1a68820d66be02ec3dbd5f4edce56bc28fc1620bebf37512
SHA512bb69d55c7285132257e11c44c25f3907f4049c6f074b80d65ea223760554b65330dc1bd951854b30c0d4fb6e422e89f48e3745f2bc39bba0d000955394bb87a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1943e279bedc6d9d8eee7374c455c96
SHA127acd6333d042e10e0a0ca948e2377c8903e684e
SHA2560a7dfc00fae477448f3478e7e6eb6b4f94ef3970388ef3fb7cb21087fad6c4dd
SHA5124be4d7373abc608380078ee44bbbadf1e560e4ae238fb9b54253428df09656e0bfabec882d024689baf68a7ec98498fd1b311818f0989a6b1c2bed9ecf057f43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584f4dbb40c0ccf38fb592d92001cf774
SHA19a13d033d8acdf919c9849838f6e5f2865dfb0fc
SHA256401cbe2d25919388ca22c6fa8501b843cd2eb4174d7be72a0d0f81c063b82852
SHA512f48ec8f19c01fffd30257134730e99743f1428a4f27e883210d0a1ca9c4e2e0a1aca7cd626b761d8c4a332a891fa6515a3d7f6fd3fbbce28ca0078ece5a47558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e1ad9d1bd88aae5f8e3581e811d0f66
SHA1891b9e5bbe61b0948fa2ba473f957f299ea564ed
SHA256a8d1bb5475bfa39f23d93ec2a62077b8680da95ad4a7e94a20dea5a98cea05dc
SHA512ab0527bec30b3546a19b5b22accebd07be2769f48aa5133afac3b57ab39ef6952f761b7404968d8f75965a3d32b8bda7e17d6967f81961b2579733102e548e77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5259de7e10ab4d415a831df727f1c9f3f
SHA1ed138fc2e541536ed06bd599b37a77671d84117d
SHA25651f07afc9a606fadb7290087785a9e7129487213950101464d3546185e5cb241
SHA512be56f7ebec4894293030b9ab88f2a80d6bf675ce29c3351dd766cbb940b8f2ed6e3974390348593c4096f59a470c248cfe8d75ac99fa6759ae9c29ad1eba6078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5249dcb6b6f551ce1dc2d7eaa3f8de0b4
SHA14c37aba6b048909774932c6f2832ef645eccdf94
SHA256028726b28667cb34a8912f460f93c68bd3a6563a08a48026e3663d3984cbe7f7
SHA5121e600e59cf01d269d8bc8174eb96079f17e851ebd221a0151d291e7508310d84ca437f4aa445f269d1e00fcd1058eb9646b3e2de9a48ff838369e671bc4185c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b84bb2627eb60e4433cd78760d3ca9db
SHA11590f48f67ad160308dd1deb9db233f8888c8b26
SHA25657e259e317807c01c61e26388882f9ab06f4601cc16af1380cbc92173f6c5df0
SHA512b4c49fc8d007fceab0dd615cd75e589a7d8ae673441b954d0626dd791bb8915451d4374e5383091c700a692f1444ccd2a5cb0dfbfd4fb0093d342ee49928e8f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501a5e906e2b32805876473ec7e6674e6
SHA10aede834a85aa180fa5913b54b793ac267df0202
SHA256b620747555e26998318cda169b9281651e9f5d1d9ac5e1fdce46d1911c426467
SHA512a3e5a4063a045fc580d7a04e54629d812ad7c88ce8c7fc19aac385598180aa3fbd77393561b002d9dd97ccbfe6e389b39cb1b86786d0369294ad7f32aea4b222
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5415710cc2a42559cff76048577b030c4
SHA194cb3659be412aca82366af99795766a977232f3
SHA256f109ac845d3a24e3a789233a1f44d8e26742624b8854f710fc76e96a54206232
SHA5127f3a86323790d1cb059e720ca92317c6a752c80dc8cff8f5692be719358733b1731d3a267c385edf8fe2e6505454533ed3ebb867ce4b9b5fcf42a6259455564c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57760f4afc26e172ed22a1005ac960c45
SHA15a8944ed1147aae275fcfe93f126a78ddf35bb76
SHA256275fbe93da36d0cd11161382b99fb02c4c0eccb21f3b968b167f489200b3e919
SHA512d3d2cd9c9ec2862bce7db9356e37c533d29a087188779ac8ad0836c4364638cc3a79c4df3a21e919c0ba1e2683615c332c25db9597a7ece319cde46e299f83f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57eb94c326bda503ce9e25a6f77e505c9
SHA13fbac20646375deda175fde06122571fd3a2a57b
SHA256e6183dbc78024db4b9babe1f6c63f8c708ed17a725f9b6c80b140675ff4215f7
SHA5124541d9c1248d06501667b328e7d17867451fdbecb5f3684e2061acf8d73371ded269cd82feb458a4da226c3d4f226eda3398d2b8eb2aa518b5d1e4cf5458bde1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565cf4b10314cde30ca957d217f89e23b
SHA1c9ea16c5c0b7d95ff190a033bf11c619e7fa317d
SHA256ba11dd17c09cb9ab8314f36f61836a6a0d7dc1ed5f6ac475a30a7938768b1952
SHA512867982ad74b6c74e52afb283e2132539ea764b2b3e57548c54c0e5b1f2e08ee742c195ced21d13bcadf37e6b6bf59ffacb39a6fa10bc0162ae9c14a2a5616ccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f2f8b7ef86af21bada8cb8d8d36f661
SHA1ff4e43371c495efb7697ad1bd2ecb2d2da7902cb
SHA2563c2f34ce8a3ac946c1dd0163bc7326703094987b6befdcf471eb62c78e35f145
SHA512248fd840357dcc9c00ddd86e811aeeee61c1785e535bda7191b051512bd9a56c928c0621c3c9487e8ae1d4bb120ff4a19374c726e28bd46c000b285f2ba7ad01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c573a7318b1054ecdd9b9bcea865d2bb
SHA15e05ba823b40e0dacd9166b2e7de65a962e12f74
SHA25627ab0bd13ea0b2c40099659c9940ed9ba04691eedf19769f78831e71d830ea7c
SHA5127da068581924a0637971c4b67d2232b6962b9ac6ea8e47247641c27a66c6b6319d4e1d303bba76ca2d75c72fcf4bfcbb653c3d4b9b3afec5cbe93419ae5cc312
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b