Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 20:34
Static task
static1
Behavioral task
behavioral1
Sample
64b49586df8366e09dce2cbda47c22c2_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
64b49586df8366e09dce2cbda47c22c2_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
64b49586df8366e09dce2cbda47c22c2_JaffaCakes118.html
-
Size
6KB
-
MD5
64b49586df8366e09dce2cbda47c22c2
-
SHA1
4e2e0942f2ba392756a9f9e3f406410bd5974fc6
-
SHA256
1ce15e8e7ac09e3a9b4e5c8c1512176ac2d7ed4c2d97ad759c6b534a879e6521
-
SHA512
f3fa744ef5aac590ef0b8f225c51697acc84e31f5b4dd8cf8fdddd0b852d963ca698bb92dfc023f53627219fb28a306436b9d3a5b58e7681668313ff7b9416b9
-
SSDEEP
96:uzVs+ux7WOLLY1k9o84d12ef7CSTUSB/6/NcEZ7ru7f:csz7WOAYS/l4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE847731-486E-11EF-BD75-DA960850E1DF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000000b12e2bd829d2ceac68ef820fdbaf945be341378e744926769acc66a5e2deb2e000000000e800000000200002000000074b299e94bd022747e4996bb7840b1a84edcdc5d47c9588912fb742ee987363890000000fffa2f8a15253ed57c4fd66dd6d99bcfd13ec356223295a0ac05c1217fed35a2ba160d41cdc81e6b285b4c92751a35c6b278850f467efaa9bbf5a71478bd2f7a4b0b4367e67ffd206e609950679d98e1117cdf76a421119e329de2720d86d2547d6e1cb1c9863e165cec7a094926a65418bd15244c1a9723b6eb7ffe5e3b38a5951180b3f9cbe5dd66f6170c8bcb04db4000000023bb21f3bafeb9aa892c09778f8ce07573c9cba43a9f919c870651ffaa0c124efb5c43de8f81c3b71e434436734d5a2ef705a8cff617f9b8d3b2f4273f61c2f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427844436" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000098a7d612b59ee1987e3723ddb154fcf2fa1e36729dcc946081a0ea7b439c7d99000000000e80000000020000200000008364027532b9be50ece85138a823db4f4b5fc93559fde43f685235c3dc4466dc2000000092b398fd994a130d2fc5567e15b32f5e44cb777e2f08ed05c3de00e13148548b40000000a83fcd2927ae250fad653be9f51c7516b20b9d4d0ea14d9951583d8ef150f826c93e525e14a5f27bad2145483adce42d3de0ffdd570f7be771a2770b6478fedd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b7b39d7bdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2452 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2452 iexplore.exe 2452 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2152 2452 iexplore.exe 31 PID 2452 wrote to memory of 2152 2452 iexplore.exe 31 PID 2452 wrote to memory of 2152 2452 iexplore.exe 31 PID 2452 wrote to memory of 2152 2452 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64b49586df8366e09dce2cbda47c22c2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb94ccc75822659b08425a9334733d0b
SHA1844f59e0b8a198bb43dde1a205cb31c1eef9fb02
SHA256276999e9677e5464fd90df153545278138fd303e03a43f19ed47a531edb66de7
SHA512955b35bf65cd14ad7bef4c4aec2dfede7393eace2a87db74f8ce7221a3fa421dc54320c06c202fa567035a645de9d0158c78d2918f9f80737b331d7889363417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c47812d890ccd73c931a7e23348cfdb
SHA16e537bbbafdb7798ee96171dfa5c7da462a95fde
SHA256dda35f2aab3941083832020ceef3352603984f6d24caab8e82ab17bba494034b
SHA51276c9c3bac3b1118fd6d71af2165e0586dbd72030ca763ab4648217673004c1c8a35201ffe5e76ac375d9b7ff9f05b08edcea34c2809aff73e867e11074b3f9cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5214a829d6344336c832bf6bcf7c1a5ed
SHA1c0755994cea5ef48f2e8b73af917c71b236f6afc
SHA256d876ff62eaea6e811c06735719993b37919badab58cfda343d53bfcb58b89f89
SHA512ded4701283de06b1b466ea4b48b060f4b384c669120b79d960f24098a9394bb0187da8952b82f5d4b4cc96ddbf9c10b8043e4e0f21cfefdd178bd1d50acb2694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566d2c7ae81647e516b90f87e6425fc1a
SHA1f55671b0b07a63997d803b9e9fb4a39f9b1b4930
SHA25627afe08cdbe1bbc8c74c058ef498bb1f8e478ad2219f9081bc972e93931ffe55
SHA512dd0ce90171fb7c20322149239a706a1e748ee0fc9085f46918434e7063127a3e66ebb11c86e7548114b1f6d1e1fc8f7298ad149a280e832f82589837bd59566c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5503b649e460cfb84c94219b4143f0ae0
SHA1e4eee484d13317abec96e28429dbe203f4f82f19
SHA2565e8839d08130d5502651915b09b5bfeef4e28e66685de640b2ed06071bd050e5
SHA51214203be76297576ad022a092b5adb7c30144803faf920034ef91d5c40e9f4d8ebd2b7238affd418d9d9a3198df7442799c4b5c98f1be5be4797502d44dabe244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5673e3e7dd5971fc2b3b784d7c279a394
SHA1b8a57ec3901bb071a04d69e23435beb4ae3bf24f
SHA2568fa5f660a8005c1bea5dd22205d7728028f5f92a08017c349ec0f35f4298a8f0
SHA512d4d81bf399bbb71469cb727c3a13bace4839df50ed6759708b93f0d00bff65406705b6af14bcd8d0b59ceaab9693afafcac0b59ad33e4e16ea844c1c2e8fecbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5224f225280e5b40cac1f467491a903e1
SHA1240bd62d11d7b1e1940e6876efb065cfdb777b6e
SHA25605aebf4d3d43ed21ec0b95d68b4e5b2880b727d30b5f79c8d28e6bb215d4bd17
SHA51233126695e49cedcb72117f82157ab48b07da625323b49f1e7b044ecf4ec881da235673398e1df74fa9f419b651d1b57c676567d19cb917c45dac26bf0a8b94f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2371d7e13c614298e4cd309a0534d1a
SHA1d5e34167cc3521d5cf9a11ef0aa14d055582e1a9
SHA25680ed4c2d268b6d12905c479844d8ae24718cbd6b1e6e882168c4aca2b9fcc33c
SHA5120ac95c49cd3c1aba04bac9ac13033dbfa4f7b7c14f744534ac23ec3199cc136d14264d8b09cc51e6f9b438526cb2e023c9b637cdb963db13175c6241401ac2e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7696ab99494aa035563ac514bc81a61
SHA1b452a1edc2a65b8f9c2eb6c7a4ccf6a22ad462c9
SHA256abfa50693517db07a8c36191850ffb296dd16e81dc84fa89ba45c872262bb957
SHA512a519f04e4333197533ea3af6783f3e3278698915eab810c2cc0172228ce14ca44536b47724cadd822a2f45265688f922373e3c1fb82aac0e5efe97cfcfb339f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560c5db55b067460844dc25145f745a75
SHA1f5a5b3d5e528c9981de847c6724a650d3a8c9b58
SHA256acf3afa8d69e12972ff5db1ae6cf7241e6520c752aa4dd3701f7f173e17454a3
SHA512677cfff8872956716c9c1746164c6e3a0434e7d318fec47fd4851ce8478288682f23a27ad478df626eb85b70faa22c6a9fea0633f14926d3f375dc35dd9bfeb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5096af8d7f00f5662b21a5662307e52a3
SHA19f14e1f3b1f591bf1a5823ffd688d6841ea157fe
SHA25674391561085c0c7acf1e9b9d93213239c6231714888c534de181e8101fbdc507
SHA512ef60853aa265f6368ac5fe44e280864633ea759fa28e9b8515b9204d5d3f537e2828b410045f51e82bc5339c2e826a55ac2a9c96f125d57c183d5ea9d1d9045b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50023f82cba27a81d04a568e0faa52e9e
SHA1b5cb1fc4648b6cfeae271381cb78559accf6147b
SHA2567d7172dc5d4c886b17ddeaf8f435cf12dc817fc1eb1a2ed591fe7e586ea1f8e2
SHA512b599d1ee1d856d02153912e158c1d0e5acc74aa1e88b33a329261fe360cc743b559e68aa9c5a78c067d67e51f69336a8dfb46371b529f2c9e6f57467cb7016de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e69e203246b798b6ee627ea0af24dd3
SHA1f7ca8a08ec78e0fb2721db5a9b8afe4395dbf587
SHA256396c7a0dd922ffa5936660146689035e0a599dff67309e83b808d3f691ee19d9
SHA5125c6c9a88998f5ec63f6daaba8ff66702ca1c7f4961c6566a82a4a6da6df0633bf9f577cfc67ee0011be1ab42d7a1d6261ec170d96ff7d047ce83fd7e635fd1a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce66d986c5d82ddec80615e07d21f718
SHA1a0973ae97943b5934b2a1dd5bde1723bb425f7ad
SHA256f65f6694b53859676ca7c81e782ac142f73fa6b50fd8cd811a9bc9a1d50c4648
SHA5127cd31c7e9c4e1a61a8bf649c860de9d126656a90ab085af3589e0f9d6fdc1cdf23ebfa37e2dc181f015b497515cf9f924f584b90d255365ce2c3d90e047b1c65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a67a0d8146e5cbe570f1da5499b3968
SHA17e49f5a188f36813a71d6d259eb6d84058da34ce
SHA256d4e453b730d8b3b76d67c390c715b738de51020b588026787d7c2cce03de8760
SHA5126e3c6c788eba0704189acff420e00d1ca5d47885d4a3fef59b3a5d41aa06b25f2eca458d11fd3b4397456edb5ec4d6014fce5e7fd38293506c331c26a8b17663
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b