Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html
-
Size
18KB
-
MD5
6723dcda964e36538f52bcc4f27b0d7c
-
SHA1
a562b0db86d8658526aa74dd700dde22e40840d7
-
SHA256
7186d0f67d93091fe0cff461ef5965599476e2bf0225417ab2d3399349647074
-
SHA512
e4cf4f3ea226bea8e57219b102a568090f3143168261835941e3a713b78bc6afe8c81d0d7ca5ed8376d7fc9375f6eea61622dddbec2bb5b85e9e24ef06a5d0b9
-
SSDEEP
192:FRcR3G15c254wNNHoVIsSFXYHNXIQOiVuo8leh84+XH697SIRqRBxEiTerL1:Fa4r54ENHQIsSClTgXH697SIRviy1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1003c252ecdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49BE64C1-48DF-11EF-80BD-DAEE53C76889} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000baad2c14044cdc5d5963a3f580160b8b37b03d02ebf2e1982b46f6ab3085908b000000000e8000000002000020000000ec547adad61dbcefb3454689fb0c60e967b1f10f71febae8edbf8a07d63d880490000000815803fd79a5ab0d4617844088538cf437a5ea8588f9449ef67eb38f5b35393ba8eaf559a02018c996daa9cfdfed5b9d15e309d1944e6e7072ddbbbd2c7be0754d3a19ba10f155849bf788682055cb881c44c167499c0052053bc0316e58f776cf6f17d0eb25cd812de7460df3b5e6fcc6c3b36ec65ece721121779376b1d31c254eb2246a35818c053656373e94c11b400000006f3bfca6afc9f8b08398ac1af2343f898615c4c86942ffc0f644e28ef7ada64375018255c47ee9e135f815e1baeea9c52cefb05a461eb9fa8df666a95112c918 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000ac815d71676a382777874837e6008f71fcbc9e9944076b46abdc3c55e9eedf2c000000000e8000000002000020000000d4f8135ae7b37637324e99966865082776ed3bbfabcee4ea9daae5dd2a971d7e2000000031a123a31c8b3e255e36c9192c82242898c6d22ec7917ed7cebfc43f025833cd400000001cb6988a2c30ffe00521fa2685e8e2e9acccf84763ed35806ebf883be03febd9f81519d7c45c92ad7331779803205649845a9f388c852d03ef7f001c853468d5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427892800" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2536 2092 iexplore.exe 30 PID 2092 wrote to memory of 2536 2092 iexplore.exe 30 PID 2092 wrote to memory of 2536 2092 iexplore.exe 30 PID 2092 wrote to memory of 2536 2092 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571129445092b8991199bd7fe747ce5f1
SHA1e89283fa989cdd44e0b9f27d36ffb08303e7c262
SHA25615db69eb08989dba6a1aecbbe63bca06d727a2dc394adbdd011d2ffb7fa68851
SHA512a8f81ff41fe39b3c091f24e754ce2bb83e54d687be164dd6717003bbe64f6c484c169f55113579e24bda7106e7f20f8742328ec2f14dd8e5da80f31257cf103d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a305f9dbeaceb9572590d5e2aab890
SHA1b0a5de7d75a8ed5798b265a13da67470342ee627
SHA256787f63d0bfa2e8d926565016ad9f31ebde38bdc09a010471c8dfbfe9fb9d2695
SHA512f3942887b8a4ca00c28b67d867b882e4d31aab2090fa2e2bc05343c76e81e8d01d3a91fd98a5b0e4c8ee5b952c3122c97c23d87674935e643722f56b721644e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbc07c5d879793f25d817f974e17bc89
SHA1a5fbdc49d38c7cba3ac85c8f670421d2cc365857
SHA256d17719b954e3d17cde0daa3a11d9a27592b4ba6930f968386e62a929ccf19ab2
SHA5123220eff754a80591b9c0299590bce8b534f032f22ea984b6803da3d42b97a9ac68159b4bcaf59d5b9a4d2cda69e8ea8e66afd081a869c851659627c9c8ece62c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517e2750c8b38172022be8bf1420023ae
SHA10bbb132810a6ddcebe719e2d6b58d70ace67d38e
SHA256e8dbbd16505b6578a82613e09fd9abda1ac5a152b08fed814c72aeca830bc2af
SHA5127e527b546991aa983f3e34d27b2e1044979480cf71eec4553a0ce440133aace38af12a7d7ea027a9054c6b3ae6b91cb6274e6788de7a53b0aef13d6c86c39662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553eec03d38cb1291fcf571123b502253
SHA156b7496d31123949595d6ebd89bb9fb23e34eeab
SHA256a8fce9fdcf14364dba2614852e84e077e3ee61c65a5d4cc1882f2901e0536013
SHA5129f7d5e2f38c4b3220e0166ad12e8d7d90901191dfda2bc8d3205e7dbbba74ab6dc34119c0b72c8a66920274f446e538c6305b3058afce44d3f8cd8a660241332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bb816c4b7ee54987bfb7d492af06bac
SHA17aa7b7df7a4e1bd5347772e86cb6f7bf19fff968
SHA256d03dd4cc502cf36a0fc606dbfeb934063e7eb3b33c9910c6ff7748194588a4a5
SHA5120bec6939403e8a19f1c2937ea93dc64582623b3cd4ccca0fa64b3286bf7d47f8a9cd4e4e678fcac4854a2fb0b54aeffc87b738dda3cff33b9bb5acd666c6900b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5464b29bc7bd6fcce0b62ac3566ed4a79
SHA16b556044047cdafa3a2428fd0f4e4b86d0a733b6
SHA25676332d06c1f7af84a2d90bf5c41747b7d31a9602fe896678d532e5af50a62b52
SHA5129da0949a3c85727167f91bbfc1d6a9401a4029539a46050716306e460385bd04e4a792e6b357d7e0747234a0d2084cd07d6b234d8139cdac35d2ee03a5f2aa33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58af7874e348b04330c47a8ad7bc8cd14
SHA11e816881ab86e32235f419e2d5c8276e3043805a
SHA2563c6cb69935a0b68db374cfb15b13aab2e21e510d7de2065038f29c98c0f52cbf
SHA512955420c043e65f6a23d8537dabfafc4f4f7521b22bff87b77fd0a3509d2166223ef410c95f54ff953fb1e322a9e711f1b78cbd1592accba4629af5049b59866c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fbd0b67ec78f0d914922fc6efb5a948
SHA1ccf9caf16ec1d165f636cca9adae4cd32b798543
SHA2566a614fccb09c8323e344d0a6a26d943b57f2fe1cf1fac5ff839bb0d167e34a4d
SHA51286e64ca540dfe4d2e10919481b9c075626a775daf23b9437fab98dc32786d5c2d461dff1e1c029ab414efac3f4427214cb2232fc62c46cee957678fa8b451180
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a80a743f77081ee1df9188222a422651
SHA1f064546814b6ddebbd340ea0b75a9b31c233deb1
SHA256bf3d3f44b85a3aa3a0c41c7afe825a7b89115953db4fada2035170eefded66d6
SHA512a4ff1cede3ce160d67afc5572c84c272ad6b1ac0831f1e8dc1aafff6b0c50eb0d2ccc2f22ac97f15c7ffd0a7d39418272fbebf309efcf5270592423a220a4e06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532c417bb3102e6d437fc18d79cea521d
SHA1a61ff44ad258c8ea33369bfbf84fa38906eafac1
SHA256290e1635ee7ccaf63dc361dbf4ba53391a6cc402c96db3a551b27c53b0798202
SHA512d9932b15dec45c12074b4a4e02297d7b434dea1de42eaf23b22398cc17da939e16b4a9e84eeda83eda249c949daeb3fab1d8aed2ce948082612278d76bd0511d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56873e53f5e214381f47d29d5b9c84e53
SHA168464731ca82fa11f70827a526d3b529db77092c
SHA2563e89b86eeb317b159f214625f7861a7f449c644f4ab41dfc707182f3946e6b01
SHA5124966df492749453c1b7f4479d99cbf14469588d943028881c45ec7caefae2c8f9d851c2775c66edbddda83fd667a83cd337ccfc503d0d8066ba855a81b6aa0cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5597fd48b4b4cad8a3e285c6dcbd7b8fc
SHA17d0b117fbc00f8ddf2f362587cf1e5fddded389b
SHA2565be8933e0025cbeca3ee3c7287e86ab9049551ee1179a4f2b9d092d8da05a689
SHA512cdc8218308f94c8a133b5aabf08fbaddc3f51146624758e5a3175d82a9766ed4a04bf4ecbf677f0974574e8f81cc0874cb3ca6b493a532449f4ff01039b3d47e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efce5905505dbc18d028e17d4cd524cd
SHA14af8d89ef9ff9d76bc70636f369fbbe38c751e93
SHA256c4882a91a263b427da722caa3ce977e51cd2309c3e6259cfc2a065be0aec5ee8
SHA5128c719bb67f61ed33d9c851600ad0d3433beffd7050e1a317ef872f0832fb2d0ffc0ba94565d66becdd2c572642344978cac7a4b003314a910ae96ed098391b02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c45d82905e56c7b435aa515730b78be
SHA10dffbe7ec5c6e616067855b051e7fa6eba6f7784
SHA2568370983e3cfab6413cfc87ca166300eeb09aa5dcbb1355f1c5cd4f0251f17b18
SHA512d4aa4de67480f5228af802a447c4cbc221e98f6d815382001423b0ec77855b13283375acce13f990d6d011aef1ee51a71fd90d03c91eb20c95c099dccf2a0cfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbbd1d494a8de40aa52dab913b68732a
SHA1bb8dd97757100ab334f35f98700d89b5ca24e5cf
SHA2564fb2a4890019fd5c2e0f461f540fe85530b8894c9c7218146aef2d538c68bff6
SHA512cb693bb72b13f04b35ec0fa0959e2cc9b8b13b6dde8bfd5b94b339bf9c457a81c71d3d080b24d5fbea2671ddd4ff48a6b454ec119c5a2da6e506826b24e341a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e80e271ca1b36ad7cfc2b9f299b746b
SHA100e6ed85c33a1a0c6e2ebc630cb24a88e6ee78a1
SHA2565a548a11343f510756d95e6890adce9dcb64994b14b64bcdfecfe74564f1aa98
SHA512d72fcf783b02146138ea503e865b45d3c818c64a83609ade9fc324c0346b9f1494e0887b4fb56b67b99ed5b387b5f6ace227b7ab6f28d0899956798a626dbfbb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\jquery.min[1].js
Filesize83KB
MD5b04a3bccd23ddeb7982143707a63ccf9
SHA14a5dc1389aad050a44ee5e81408238a317ab3413
SHA256764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
SHA5123f844a06577168de05b187e727dd07b9a20cf0453cd00e28aefdeefcf783dc680ebd941ecd79a53ab26510af1f855984c2ddc77565ef0db11d4ba6e46f59d748
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b