Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
640cc1099742f830413024451a89705e_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
640cc1099742f830413024451a89705e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
640cc1099742f830413024451a89705e_JaffaCakes118.html
-
Size
522B
-
MD5
640cc1099742f830413024451a89705e
-
SHA1
5d3f67035c2c70fe92c22e3647ef68afe7602699
-
SHA256
c3dd0f1aede88c076bdc752ae967a6087b84f70fa5cd777e0684a19fba611a8a
-
SHA512
1402bd8eaf9b4f182943689283b0697260232a1cec6169c636846d20422e7fe8c1968f116864e4bf49c512aea314ef03a69c0910360a1578498114e1d3b9627e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007ae0d107a52df655ba736a639a793b60626dcbd2973b01fd0ebdf824ce313ae5000000000e80000000020000200000005904fb8d819aa1190c8d0f6195648f6a7f7ada5832ab92559dff5dc6ac6c89c8200000001bbc84fddf7770ddc1392025380db0c570c0a05e9449093fe17818817d83a6c54000000017dda02d06f0d3692dbf5335323047299fa73dbf4e6642e1092227ade848df44ae34c2eb1711a6a54a5df9b13d577b20ba9c6094bc8d7ff8fbdf4b28fce6c139 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427830082" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c2a02181c902f69746dd25048b5c191060df9dd7dee4c5cb16586a84b8244283000000000e800000000200002000000010d73d6b8a63245bee5828a0f440327c1f2c2e1d465fc21c678dc1dce7be96109000000044f0d9a6b1461f6ca877c106c737202fc99cd6c945fa93b9196ff62493c9f8d9d636588e372835629625a1e403cb59cbdf7b1d6476bcfffab58d2c8a3d2c7432298fa52492aa015d65ac059bc400ca250cbffefc75c945957df8f4b277d3d7c337afa5f55c51c99b19a202040252c55f7bfce934d9a28299c6a86af65a7052f0b40686bdbdafc5b23b548661cdbfa958400000003e18481aa6c1fdb2c0b0ae26012edf35bcd8e31b84b21fd7ef60c93f0216fdd5d5edad1f2b420a3aca01cda64ad0b301ef753b04ac45bfaaf323c15e080f0a81 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42DAD4F1-484D-11EF-8920-7AF2B84EB3D8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e616325adcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2384 2172 iexplore.exe 30 PID 2172 wrote to memory of 2384 2172 iexplore.exe 30 PID 2172 wrote to memory of 2384 2172 iexplore.exe 30 PID 2172 wrote to memory of 2384 2172 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\640cc1099742f830413024451a89705e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff397e7e0dadddb39536f3fd327bc877
SHA1a9977660fc0ea8c0b28cf53631b8251e2899fdb2
SHA2563adfd7c71bc1f9382fe4993087a03f4764e94dca981bdc47f391ff7619bff8ef
SHA5121698b944fcb178585b15cf0011560b1ed9b5f5685ff5fc41529a9a73339b6e5d598c07d835fa47b7a5cb62e0081ab03045c950660b668d0f3355197528fa241c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c6affc191a59d0612598165e4e543fe
SHA17161d6d63bdfc730666420decf9625cddeacbe05
SHA256469fc8255d48e308ce790fb49ce181592d3ecac64f39f3ada9d430e7de5d6349
SHA512351b94ed9f408e8dbbd8e36ea44cf50660d662b68c0fd55d089f9a953a62a7c336d40a62e2f3d5193c1eb5d60ba0c14c9b4bbbdc83723e78c7738d4357d92305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55621fabe489f352b8a7c9dee6f978f35
SHA114bd21a9c9344443a6d70e972a6b5f215a177c25
SHA256f800a6b41dba5a69998c15d193d2296072d70f389354dae2f92ecd3f90630925
SHA5120cfac82d807b0df2b880e8e1fbfd9e037cee61e33b8cf138abcc90f425eec82a33c29c3a7b0d194ac18fd07e537438094dd191715e523f2b52c9ab43ad051228
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9823a8eab9134b866b8ac6fae24c059
SHA11bc0c40dc018cde902add1ffa6448daee7af3893
SHA2565eae29385f7874f9083f55fdba2af805ae754bfa7efc6a3c532f8acfdbb7f8e4
SHA5129edd04f9e9224f03d00209ce2df7ce4dda37379350ddd0ee966486a57baa192f66422dd09c6689fd5c09b8bd0af2f1f3f09f927205911446d7be56586d03882d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a90d5b8858de41236861d383c137e638
SHA1cf78c213a2905cbd2ab476fdbafa9e27e8693747
SHA256d81e217b08341d0c96afba644dc0dc5fc64625fc8a41c1f70b79c2ebad50cbf0
SHA5124970130b1add57231da93b8a9429fe3b6b747928a13253ec25bc6e83ddff827c325365f8ed107456e559e2a14ada1e891be46a848a14dd37a1d450492ac5a723
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da8785f1bf832fdca0b1efde7a37ce69
SHA115f27e3d3439b962ab4a445a1fb0b275e374188f
SHA256f04396733deca3aa1b6336e02c2042353e5b44aca178f585afa8ef195e6f63a8
SHA51293d40d47e68fe65d85fdf30e869853cc4561deed68615e38d187d7fb54cc177e3cd2b9a77895aed0a945c011a1af6a29484b7c67c0638f2c7a35b9dbf2be7c3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bdc013daa93571af68b97ab3d999f58
SHA19c85468f9c6b1261ddc1f898ed30b5c4156ec509
SHA2562addc6b476ad4a9a35bb6b1d292f96e78b6545878a5e575cbc5e16b4e193c9f3
SHA512c152686d30070bc1ca5880502a1229ad7bb530a272b3f1ca2408ef007231c9259d91bd1c4c6e631c54441945e68ce5a3354d2354259cada301e109891de768e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3b8b5cc0af0f32933b94ee148361c84
SHA1b4ba7c690e6d2d3f65eca2e41dbe06e990c1369a
SHA256025a149d4549af4d852a17ded4bb64b835dcc66b559265d2f3b77df0419677a5
SHA512475fd9a937ec4032ebdbc54091925f87939514a14a7e2172eda17d8422c3ce45e07ed3b209d8cfa0d7b1471cb58f21f810863dfaa99fd1e2e40221f3a2eac41b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5953acfc225b724f6ed5440a606a4048e
SHA1499e9b8c73cc365e63aa27795b2d1332c8b32f3b
SHA2569af9701d221ffb21ad60ffc4b9d245b460fce574fa394a73ee7c6083c8c236f8
SHA5127694571f9f2effbe2bf85c67883331bff763521f9a92bc068f33e3bc25b17e082a7f91871268f0b43ead6a88dd74aafb0ff74e7e0da983a1335faad1884cdb62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522183d088ec23584aa384eaa506b239c
SHA195594a879c700180ff70873bada2b62a9bd41d62
SHA256e651e6c5776674f0c172365258b79a2d667360fb5756bfc993e76fff6b65bbe6
SHA51239b74fa2255c3bec70f010c32dd6d1840eab6ff99ebedaaf869960897556d90473964d301918ebd1e2c4c7733c0a9821f6f3020dbc0934ef572860dc629bb2b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559c4ab7d648689b516078fc9a0a3e734
SHA1d765a215d4a9c26a2de424c695dab7f0de1d1b7f
SHA25603f39e078373994939a448ab28fa09bda9f4dac0ffa7d7df600286bd9d675a3e
SHA512fff18cace653a1886b53cf4e2c93cd4964877b3f79adb2ce5d3d007bfb3a3273bd4163cacb0d007c2ccca297f3858a02af85d23cb4c807d9c71a214f83d08747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54261dd70f70951d8e87f8e26bd7e3556
SHA1bf6eb5bf8bb16b373675f88bc309a4c499b2e104
SHA2562c3005edaaea6a4276f08960d061287656e2e7f6e46a0d812dcb085091b6272a
SHA5123409713cbfbf3bacb149e85d9df50afe29667e94990c589d59f4c7346cc1e0a3a55bde3f964fdad521d18fb7e1fe59663fac0dbe61127827ab18e3d2363279ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5841c66cf31f065586e586db3ab79ac78
SHA1a08b8a8a081e726e88095897476b8284a70d3d1f
SHA256a90c3324bfe151a7eed8a9b43ff9782bcb8d71fbb54c913c5382291d162450d0
SHA512077e89d892537fde0925dd027121dd0984d7ae3deaaf1e95b6292aa26bc774725b1191b751da1805b1a106758b955cc33816438957d66adb84bc1148fd8599f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3fadd3445159c350811c10cdfbee9cf
SHA1a8abf857779015cf9b06bf77b228d75e0bd964b1
SHA25649b1247f94c88cb871c77affcd272af5ecbb27d12bef7907a50c28c2da6807dc
SHA512cbd884c2611d90daa933db9f4e202ac4ab30fc9dbde77528388f81472c54d22a73c1640113242a71c7b1ee6e8dda08d9427ef3796665d510f7af0900edbbbd77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5607eeac5fce7b35d5fdcaa013f9bb6f1
SHA185e080f4780581948b08ebef4d29d1e8623b9147
SHA256b8c692d6c8c3268e7c164da934db2a2b323cd699b904c118bd800ed30f51791a
SHA512e0ef52e9a4c4be8a37132b78f2b08719effef08c39ebc560d945baeafca49e44a6690f3f283a9ad2c5174ec21933b1e608dab76022d14f6f30d9a38ae2cc6387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59edfbd9d470208dfd235bba689900c0e
SHA1fe5884b284f5b63c8a276c427a0e301879089d7b
SHA2566fa1a8947d5d75ef2ed5097597eb96e7beecc0f8cf4fc4b253e98a50a5f2d460
SHA5121d9c163318c288e3238da88a9cfd242807cb4bd47b07beaaeb61bc9119e9a6f4790b7462c24d471943df6ea1b94d876f7f7d88f124eb5938f21c9236ed0aca0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bf8439cd672e8aed6f5a8ab62aba436
SHA1153119d51a1080a909620b2ea4e97b84b92f1925
SHA256b243c6a6cade3510627f91064526dd741f86da31ec5362a2a81d473868e1fd7b
SHA51270b4c609c295410690cd22ef33bd009aed2d8cd8bf0173d40bd94d093721b2ae92c58d38c25683e0cfcb1a427890ee76111acf5bdb7f349c46f5f939d590bfd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a5307cfe88a17bd8b2dba3cdef98b65
SHA19aa18302972b3545fd0137dea94af74926a0bdc4
SHA2567b13cfb312b6d554a6ef80ea40066c4f2c94d383e415b615dd7f85e3aefd648a
SHA512c82699e15285ffa8c7aa714c8fa4cd9d0858127a7fa6653bf31ddb3571b0194562befdd149570ada107aa673b1b784f53e24aa34cbce0b588084529f587dafa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c12453963143860111e85e0571806ee4
SHA12ea4b30f32f350d042777cc1050fbca3f6af23a6
SHA256cff53ac44e7a5cd80d935c1c23f6e9bfec609c454d7354ac687c4829883ba218
SHA512dc3265a13f6bb197226fa9cdae8b753ea8575232ffb0c3b4a4f5f70ceab982732b4f2494ba16a9761518dcf1894e04e1c49b0ca19d5d71759bc12392feb1909d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b