Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
640b1ebf04cd50193f4ac8bc3ed3ff8e_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
640b1ebf04cd50193f4ac8bc3ed3ff8e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
640b1ebf04cd50193f4ac8bc3ed3ff8e_JaffaCakes118.html
-
Size
144KB
-
MD5
640b1ebf04cd50193f4ac8bc3ed3ff8e
-
SHA1
2f5a1e00284ff2ea691e1682f418009095e8c2d3
-
SHA256
dbf8fb10eceaf30edf7fd81327ddeb2d2cc91ccc99d2c8a4680e97a4a2fc23b4
-
SHA512
669a7bdf52acb7ebe7cadd65081a71980eed4aec98df60c6d81114ff732d404133678f9ae661ae16a268a8fa18764b6b4981c5bce1d4bf805fb8f26304a0796b
-
SSDEEP
3072:hLrJeXxchSnfLa0lT90VJ9pNQWqxB28kwCHmqNORbBcS9B3Mdo6UgsxbWbeIJu11:DeXxlLa0lKVJ9pNQWqxB286mqNORbBcE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000b7b214d5ca024f34070fd2508e40d803a8c786bd844691d91f1dc00158e06ce7000000000e8000000002000020000000bf986af36c553b30280b314e0729fa90cd6bb1ada3c678f458d138041b5ced6490000000050b9cd9ca2dc1aa480e843a2dfaec7a0fa2da3f66b6fab19b0e846c258b7af8d0ef5bd29722a0b902b6e842b18a7671a190fc91900c90085b82e4c7f060a2b9d1d866e36c03518383996dce679ec74aeed8d972b28b8e436e845b9d1f828d3b2359034c5e49caae9bd6b89243de2572414b09470ba22d125616aa82af37b13ef97316ca9cf37ebf206d68f6eb16725040000000c4cd5cc2ae0f9b13b9def96c3a1344fb2d7cc424acc58cbbd134f3000369bdd7e8e0a79b3f81725b9f5b47515726330a77b8b32693ae51d6ca3e9409a6e4b028 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c743e759dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12A2EDE1-484D-11EF-B161-F296DB73ED53} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000041f62a516baffa2efd2ab4bbc94e74762fa282f870ff161ae8241e3714c92188000000000e80000000020000200000002cd4782f2e8ea35878a728487b27fa1a000d85a822fd8376034e1f0bb0869aa220000000ff0a7ca112cedf1543e8b285808c6419352f0c326a1d9f75aee731c863de52a1400000002ca9523b8a89520fc2c876c13d682c20f8bf33a4c448d71392104afb1a3542fcf3b8bfccd22eff6c7f6d22d8a7a34fc76bfaa3110d4b08bb1372aa20a1e1a5d2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427830001" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2564 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2564 iexplore.exe 2564 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2800 2564 iexplore.exe 30 PID 2564 wrote to memory of 2800 2564 iexplore.exe 30 PID 2564 wrote to memory of 2800 2564 iexplore.exe 30 PID 2564 wrote to memory of 2800 2564 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\640b1ebf04cd50193f4ac8bc3ed3ff8e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5af49c7d0a9d57da058901da54f6d339c
SHA157bb4bd45fa3031a8446c463a032a2a0200221e1
SHA2560f0eae6fb547a44d587f86a6f378a01ef5b8b6890caebf41eb1b9e35077100b8
SHA512443d478bfd82843732eaf74b0ae9309aad1bfbf5f819710891cd2d2db0338e46974d4fc8021c0fa19a224e135d943a8c826df34d6fe31e475c85d5d6b3c0a16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD541bda2cea3b5e531d3ada46226d69ccf
SHA146c8676b9ae6ba0b40151cac9bc62b14715f8ddb
SHA256c464746c52478c0ee1866d0006de29edcfa9a1971eb605fe078f7187fc231907
SHA512c981bcdc8d25b53373a4cdd3d87e32181df33d4df0f925a0f95d716136e4b460d5e84c7121dac53bdff627b31dd5449958c0465ff5eb6c888f7666aa87d6c060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c790f5a4b45ed08feae3ced857750594
SHA14ade5c8ab79ad35c8d4e468a6523141d2adbcc68
SHA25672f1c0b4399bea39d7bf2328f39998d318888d817eaed8fbbdb42111c7bd8d07
SHA512439286c9e0aed17539c2f73e7a86f3fd5b7a13c02e1579db67d39bfc4d6b3fdee7d63ad94791a785ac44614fa37bb560c7ffa8d95dc34c5583b795f04fb93e24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52aaee351b1c10dfe47f60a5b36d3e53c
SHA199a8909d5d8803833007886dd0c218dd6f69a632
SHA256a80dd379a4010239b7d5b7d919c7b077a0fb8c10aeda433bee8beddbde3d9b44
SHA51254d9577ce176a8e66311dd3ca30d6fa17d9a53e463d2d4208fd978ace591bed6bdce78b67b3db11706ebc7cf3f688ae62d00e719c4991150dadd5605cddfc1a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a68bd5f300377395adcd597ef391cac5
SHA16c7354d3cf16992668330dbf9b92a16cc720fffa
SHA256c9952558bff21c68d08737b3ebe3432104a88efd78a7e65a6ee3df4d7365a96b
SHA5127939e4a1510073c189857ae5b4c438930a37baf85d087276eaafbb0ca462ff549c5e92da74102916e619c2b84ab83b88ab94110f34340ef9e9153b835a6d4d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50e49c34487325296b12bc8bab3b657c6
SHA1748b078c8d9655fbfe374f6e778b44d3b4d5801d
SHA2566a3a881854d2da7a92826542a85e2a66bb2f250501fba7d53dd3cf47928e10f4
SHA512aa9c8752a9450216bc4338a6635dbc239a0decbee0c308131141eb8527094e87eae23d8d76265deaae46bf6dcd0ea2c5408e331ef23fb88f0e727079a89fd9bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5252058816a65483c377b8ab4e716c1f1
SHA1a8f2d78e1155e49be622a205ce95aa3d639031df
SHA256f5dadfad033807778a4fbff89c4b9b80bfaeaa39e2518166f17a4c0c126d6637
SHA512b5763c72ebf84c423284e33639bbaf2e58ac68513380c0a89a2664856a81a66f0cfb758a3358b888faf1d36b3c4c26f8700175f6a44f2fe3c5b5b7b39b81e8d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b955b6f1927b6331901bddccd906c5a7
SHA1ac03544e81411a25739e977caae77fdfa277a465
SHA25619c93186ea9ac4f415169a85bfd877d662dd41abc8af4bf75da83421bca4466f
SHA5121b44d3170ce4542c22368e9c75c93df963945ea258748a983a8602c4c3a84d487ba05630553a51fbe70fc2b303b77a5ce82b338debcd6820075f72b2f52155ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d5465a372b1bfc59becda1d52a902a22
SHA1187b8f912137a3bd54af20a6b513664293e2bc9f
SHA256251009879f7a59568f5852d21ce3435d1229b94c112e01008b0a0fa443c922ac
SHA5127cb8e5cbb3a6addef291a54e3f3a0d121e492d06146efc5e5bad0320f4ce2e7f89d938edc28e2c2750e9bb9cc91cf40838ea57a7ae92635302023dbf7552d0ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5be83bc7f30217bbc6ba619b53f2cbaa9
SHA1453f8ba60286c8c18213dce82328772b88520657
SHA2566a946044f649e114790180098586a918b58acf8daef2fa91d003adc5c0bc8edc
SHA5123649209c877ff36e9be306b8dfbaabc9c9385806f10253ada53352b1239cd524fd3fd00de6ba0911cdfed6caee15381edd2751b146ad866ae104edba6f368487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bc32014d531575bcf1a6a994e12823fb
SHA1e33e0e9543f49b1ebb472ec2ca45329bd77140c5
SHA256e3d6664c326bb2a80af87818d1f6ce15a4c0d7e6ec6c74caee28955072d5023b
SHA512725c9899ab3b206b3147ca6317741dcddd1e6b5ca627aeb374dd8017927dae80185ec49743ff2fd1e7ee234d8fda970a55ae743d1ce6dbcda4a99686d7d45c21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e8c9af90342b45bdb7ad0917ee1c4e9e
SHA1e8feed4ee5e5e004d640893c24cc3c07345fe84e
SHA2567f842ea9890229af9ce474e0e4739f34d70d5dd5237fc956364d31127f68de0d
SHA512dcdd93b861b811736dde57f08406e0b9962b7e40cdd1db3fef5e14fa9d453bd8a92cf8a0380151e23e54991c405a4e67afd70713476d461b7d1ac6dacdfdfdd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bcaba627b031480cd2df44fbefdf90e4
SHA17f8782f50e033f397e8d5fe7b33e88d70eb20149
SHA25657b7a63cf4ebaa9dc2622161e726598c0dc79e2df575d6716ebf2a03222790e4
SHA51269699bb8b978e73ac3e4f269a0cc1775d4192b0012200612a9242cf66370acfd2077d12d05be974d3af7bcc5e658f19d3b18ef2380eaa28bf0853943c2581acf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5be34b3bab8d70aa48891d2d8dcd400c3
SHA1bea8086c82c350a3a06ce05e5e3814822b8b1ee6
SHA256a118bf57996c0c2addd4d5d80aacda533ae384f26300ed312def9a3cb68c5710
SHA512ac68f7938ddebaf53b9fdc9d532d6ad049a215e2aca7d5f5c330478e947fb26aa9cdc3612ae015299ef13aff7cb3727a418369ec347de776acdaf26628ea8ac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50d082a0871b2056e726bba98b9c54550
SHA1241af205d1510e4e1f3d378183d9324e026a68d6
SHA25682d0318727bb48a8c4de0b2d5cd817f8d207c24a1d78fad956eda50d2d23507a
SHA5120834579d9efd8b1abbb809ecc7b121e6ad7b26c738e95627e7919495dd4486c301617e6ddb80621d6335500d2f3a2385b81fa7c995b65674f7acc0bc66b28c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD579c9d2feeaed3267177bfea6affc8cdf
SHA1708af472e3b9f8ecbfa075b25fc691d709de704e
SHA2566cd7488c1c5a206c632f53f3119c3015848f1e5298f208b033056ecdccb40c77
SHA5122ff24e6d6c179d799c8c7cfaf57fb2e378be36ae923c97a4c9a6a4aa75df109cd84a5b6d558a774dfb0dcd981404176bf5d5206a8cae5f6763abe38d9ddc23d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cfad9d0120baf43b33f3219a1ec11184
SHA1cc41bb88a28bc3a462fe8abb3bf3e609a93a77fc
SHA2568bf067c38824b44d56923c9e63e3cb7be931d07cea295b7150185bbd2edc4e1e
SHA512cef4d34952de822c3503e7c2c22accc6b6d80423a2ccc11bd787ded5ed63578acb1442e900785f13c2e8b482aea7d44c65737f85eda342d914b5b150b04d0e50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c2a54dbcf723df4dd6bbd61b7cdb6cc6
SHA1339081ea2ded5ab0e2b590fc6618eee9c1af46fc
SHA25667bfd6233efc0f19c3ad746763acca5c9a6fda45656752db9e9d2fce41449e1b
SHA512a4557506d2245428c473ca5c4c3a884077b91deeff17c64e3a407a62005934fadd908c6dcff5b24c6636e09efc82d2e75199d085cb7810d18d504e56ba5904d6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b