Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
-
Size
149KB
-
MD5
63e407e33e914480e3bedcacb2a92f1d
-
SHA1
0f51a62bcb78caaac780f81cf7f8d8ebea6be367
-
SHA256
73f6779093b153b3681cd2d2fa01ba6287dc12e7109666ed7da385bb69531294
-
SHA512
7d9bc6bb0ddc68d27c5a5c3f4337696fea0f738188a9ec048ffb6a22c2611347e5eae2d1ed0e78bd628b98bd6dbe968424bbcf28d80e874f81597169e6d7afd7
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcDjuHAAOLL3JpWcZQ7Lr1p:sV98LCd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2092D111-4846-11EF-8650-76B5B9884319} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000471a3082920f56884e38e7b0cae79f70d50296740f63872268cfcb9de05bbd74000000000e8000000002000020000000ff8deceea6c1bef438b1841179c3b101801f1626c0f4f5b961a02407a7142c76200000002c38c1810cf0bc3b38c176e3c2135ad1fe08d9ccaaf27d3bd3b83bb33324f2d34000000002bc5f60c4bd8d64b9caa7ef98ef24d489588c710a067cc928960fd1a5c3cedc69783d44c5e93b93e97e71cba22a51fd11f14fbeee8d8957849be8cd82c1e990 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427827018" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bfb20f53dcda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000bae68374cbd8cb06e73939b03286cc3739b6e5ad275eabd8b2c1b720b3b6f931000000000e800000000200002000000052a697f6a073faf6b600d49a32e326a9e037511a787f81be762899deb8ca675490000000c194f918c239b1569993bcdd94f3b2772fb98eded264f16cb0ea05e18a911e1f149cf3a42b5a60176bec6ed832811842497f4884f11be299bc075d42d6c22b55a836062c56e288fe72a98b5c4612371a72281469371ad0ba8077d895326c29e6d250c9cb041e4f0aaee8e02699921f2baddff54855ac6553b98fc56584cc2c47b6203b91d2895b7ddb505f0cce7c79fc4000000052cbcf2141c15f1fc5a6a9d8db6db32a7eabffdc0f9ea0c7401e308f974a001fa3c8c419e894aef190198048dbc47f792497e17d70adddd64fe48e1ed9dfbb31 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5793ec329cd51071a48228d25984c7cc2
SHA17864c7c2d85d88c96c069e157b6747a46f884664
SHA25664039aa98a704104c35abc032bcbcce3f8edfed783ff6cc5011cf64a7f923071
SHA512941badd7f04a116f84f8880de926f0767340ca6107e6306be1830949fefafd8357ad758a714cd39cc0d80672a461e7103b9eec8d5d88682ebaa8c035d382b5ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ec6379a77c210bdefb84fc18606405e
SHA15643a06d8fdc60b69b33c3e5c7ebe3b25f0ddd01
SHA256d78a09fcea95d204962f36e8726c0e01ed8c99e51d50eb921bc400f8fa584ecd
SHA512b2cc6f0ed7279dea5e80f90891135dda2d4b68f8c9a3a4e13708ae1936694dfb2782c2124d2a173f422ade8856ef2e23b47e583444155d9c8bcbffd9c98d9e7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e1a7f34a17adf578ee2ac3a4e76ad60
SHA1d212e51cb2c2e3257e70c35ab03eb31ddf4bceaa
SHA256ad95b1b19615b64357891da69c3ae40563f8a985f40828ca1dbb64ca5f24a298
SHA5127adc7f9bca4cd4066d3a57fc13a88c1aa0c43849542ab9d5fce3df6afc6137059a470b9f3a579224cf1fae6c47b8a5a9b9f3fa2043ccc2e12a9c95d9b3153ea2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5009a6dc23bc4c327e2756400a69f25f9
SHA1e3e443f624444920fa95108cdfadd60bae4cc11c
SHA25623e9d2b2a35267eb375d7f8c56950a6bd7829b73531b8073a9d8b00035dcdd1e
SHA512bcc3127c3a69f002e848814b7fe22c00e3a80c028504d1949bfd2448cade7da6d3202087cdf3a0181421086247bda48225cc00ea0a3c4fafb8f52bc6b05a74bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c28fd34212893aecc39a09f111b77dba
SHA184f6c481c79fd39e70c904008d72dfc3d27765fd
SHA256e05a1736834ccca33442d0dee73bebf920ba6cd8ef4fa630ca7a4011c8733c23
SHA512e1369b879e237f856057f697b6357bc0b136c7846345ea92724b00c3a9df541a73f11528135758d319f7ed05a0294a3b15f213943facd5ac2c81bbacf5544acb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588580969af3f376b2e746bc94b5724ac
SHA12a6e02d469f5d7b9cd7f9a09f0527a0f0831629c
SHA25608cdce8ffea5e3ab0ce6af471a879705e546503eda19d1b245bf35b3a600b905
SHA512f85ff890f618ebbb9b26fdaedd3267b6bc75e0561d73b20e8440d5b19a766cfcf3fae29e88d4f05012a4c7281ac9c2dca53b2e2a521d4a37d1003153ffe9d17f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5083d4c68941504a1b2c69ea3f85d19c0
SHA154547384ac34246c3959ec074832ef803438ca0e
SHA2562608d181a47b5a757109e6bcf2f7d01b357aa611f38a7e0654bd5a7097237eb6
SHA5122f3f53548948c5ec64dffdb0f4a4fd13e8be3403ac440f385d0d43cadc3e899bdab8b67de797639fa44d8acbfe24586fe127f214a5d891d4ad9996a757ca1c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ade52f3bc73cfbce41765b94692a17fd
SHA1120b5ff5fb7999f9f498cb54a64bed25d1a47126
SHA256937c7a7cfd29f6020a264c55464ab6c64fd97efcd1ec63f02560921bc6ba37e7
SHA5129da1c24d638b92cc668743782bfab2d40d5681aa8317cbd64f5025e0eab1d63e342619410b940b0a49bafbb14782d0afe1893b32183429668f12aa1c72206c01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6fdff1785093e30349ac4c1c9c30953
SHA14eb042d4e982a41e9978afa64d43d7b3133d16e1
SHA25693cf50cd29f5ca1ac473165191aa7ed1624b58e32f4eea0462a5ce5e97cbac12
SHA512cdbe37a69b34c17fd26b8351cfdddb91c2e78af513e140621309c6b8b5b7434f16e01fea26a8f1a40de9d36e6364627a05b7d25daa73767ea2ff9f3c8bb5dd71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f2f989adf8989c6a4d6455ca66c0740
SHA1063e5490c4f4e63c1158e8e80b4d07ff5e52fc0d
SHA25681279e567f7c3da76a77d7c1223f9e47295289ce8dd74e5c3ca133c29778c25d
SHA5121fae71225038ecb7ab6c3d4e7dfcecf19bc375dddd561df574539c26e1f5bdcfe2a0e0934c50982100a42e574bbe4c09de7be2e6b2ff3efc5c8111c4149b34ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fcb81cc3cbe8536df1a653c057029aa
SHA183ce01a43036137222835e7cb4d20304c98e3d04
SHA256db840ca890926bb23e97baf00aeb2c7d98cf35417fba6d725600179811073d02
SHA5122f56752418f5679999395f971620654382f70f4c5ee13dc00a33ca4ed1e991f3ae53b69fa2c3629a8aa4c886c8a527456165eec10e260c8fe8fc8fdb58b5b7da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1ee2f369cd5b4b4149e2a4dac4b3757
SHA151bb38888cd74a44fa7ded261268aae4c01ec71f
SHA25635195c92b71b7ec7a3bc368fea212744182ec97f45118eb7e8df38bfee141723
SHA512a8c1fb4b24e868224ef61bba11c2cfaf0dd3952e7839ec1f6872257cec785c2e75cc3300beac9e434ac4023a4ffbee1150055a366ab11f9e067793619d3dd1bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5429e9381d9d0cc087899e469724dd1c7
SHA152dd3037c5e8685685af3b615c1284898373c39c
SHA256b61cfa835f96bbde2ee2e54709a31c905c7522401b1f25521d52858802539011
SHA5128ea12724d4071963f746b4dbc029ffa8daf8b80f87452a2e5330fcd21ea93d5042099fc1943702b55ec8ac778206a485afe925b74af6441df9c35cdeaea14550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c178e3a5a7b27a8d79753dc3a7ffe731
SHA1bf100aebfe0ffa21608feca38bdd2ed902f50483
SHA2562f645df07b1ea8806d9baefe086d57342b7262fafd70058f7109e04d53dcf698
SHA512bd58cb9b0d88e52b5d6ee5c019e1da61a7f11ce49ce3d1fea518d3992dc3573aa0261988d3e5473944c89286da2073b6b20cfad0f4e1d0e20eb355840bde0dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff00e74a6fee2b4d576e07327c690f98
SHA141fe932f623c68366a86c4af2e717fc40e30a20c
SHA256126baa18c5c0538efdabc36e675a81f26a614645ef5be2346e76b80f36c926f2
SHA51239cfe449b8c4f80d5cacb5f057fd3179f9d1837591e28a5ad33988c7aa9525dbe32775cfa5ee7b33697d3017bafa114f921a9b386535c7f0d13419ffbc120601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ccd27c276d6d42035c35d6ae7abee2f
SHA13efb1fcf279e26b8a5f6810287d985e03e4230f2
SHA2563534b23d16f91ca916055fbecb3b344f42f768f30f750ee6912232d0119a96b2
SHA5124c748278b95a60a7656c8872df9c1e9731666aa9c58741594ed1fcbeb9b535dd7fd942cf98ca50012b7b47568b1be0422e6c4cc61b3ee3b37c9419afeacb3329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e256a0bf048f1edd49e101da51eb77c
SHA18ae3f2c276b4676588ec0f5ecc491b8c8684fe11
SHA256d7edbc475f5e24f7d50848b7fae34d233c9cc098db3834a3ce6a3028f3b70ebc
SHA512f29dc0f40540e31f0b6ba5398ff33173414c24c167ecb8caa7b90b2cc21f95236b37e6bcb7eacf1e1d46858297b82c89ccd7c515cee1bf75c1e432936b5981eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5238766fd90f5ab3efc9be763b7117a3c
SHA1ac873ee2ca784f0d046e4f21bfb9c7ad303e02ab
SHA256115063ea1df6822cc0689073813bfe593604a7ec3f83f3760b022cacc70fbe10
SHA512e3c35d3300399c4fa2710b1a6b6db08483a16769c7f446b637c376ee991301476d7cf0d289390079f8fddeb33a5a57644022e84b76981d58b8c2947c11daf0e7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b