Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html
-
Size
139KB
-
MD5
6884302b78e36e247b091df9a3287a9d
-
SHA1
19142e5209792671ca91b6bf84de5082dffaec66
-
SHA256
f376b59fa1b6da56d6b12542d6c5e5fbe5c8ac952704780f5aa6a3e5d82f52ba
-
SHA512
22f6dd0f610e482b7532d2a598f2b3b002d3092643cccb16e40acbbff8987ce788cb7da0b37b809b14927e1e02ad0ab892f05e7a3646a952f5f8b4cd2d6e95b4
-
SSDEEP
1536:SCNgCNGHlmXZtyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SCmfgZtyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ed11ea8b8a2208417a5b71bdac189126c1a26779a369c8eac51738e04c630d57000000000e800000000200002000000023cf0b8997235f52280881d4e90225ec23cf0f8dcd43cca235f73542dc8ce880200000008a0253d940a493fbbd5dde529775de54279c8d5df41e6e2a460602600d762b6140000000bf1430af0eac11d37b8972cc9b15dc2ea5520dcb8e878befa82de1a429c77ab521a184942a15a57adc1b099202ae4ab2c763a525c1a0d8e08ea735db9b10d742 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000061bd8263b784f2f8c6c50763af2a276287a3f8a2042130391abe9aa396204287000000000e8000000002000020000000219b0e39f1b87ed156c4db2c7c5b555a6de477e4467b2581b0834913d7f7204390000000baf3b5a86b5fe88b2fc651fd8a221e16f2d8b82f79e942f7e5090a0149b491533d3277257da84ff51a25c837fcd6db644b3f7a83ecca76732d0e00d8fa1d5ca21a095ed2ae737d4400e56108568e90b3d14bc23a0083ff161b2797ada7c57b0b99caedd694a4e22c69e4e8df4cfcb405212c899ede60025aa5e0d4804250b489822b50fae1a992bc786e069090bf600a400000004c24dbe9a2548570647858deaf195edd1189c6caafa954bf185265755347d84cd54e71e9d7d4f22281f2300022756c9fa15716522660fdca432619351cc2ffed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9F5FA11-1879-11EF-A7E9-D684AC6A5058} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01df4c086acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571497" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1648 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1648 iexplore.exe 1648 iexplore.exe 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE 2824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2824 1648 iexplore.exe 28 PID 1648 wrote to memory of 2824 1648 iexplore.exe 28 PID 1648 wrote to memory of 2824 1648 iexplore.exe 28 PID 1648 wrote to memory of 2824 1648 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f0af352d48ed28e9b41d97fe04e1266
SHA19794e924bdac773711eac3adf02a94c6c3676662
SHA256fe0f9d0368cc2b2a3c8a3d64df58332b56390d97a5bdf08a8184177c3aadbe46
SHA512c4d26fc9af51673a3e8653ec36a323a175e543c1dff9a62a60512d9283f50f043bfe0ee4bbc19572fda8fcf173d766c428c6b9e7b3557cd60c83f7e20a3cb83c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572d083b55dd7256682d10d1182621139
SHA108485018f73a6472e30fbc5e7294d6884563129d
SHA2565e6adfaba6bebf5acc265cb67f0ea3483fdf72e7a526eb1257bc658e75a6bacd
SHA5124021eb948b00be8aa9b4b97eb99ff772be47239a3a595c8c9790ef2eb4555ee3c301f3f34dd4a1f199091a01534e8d726a114988c26bae1c0f386c0611e4f260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5540cc5b14b25922cf51f8d616864e408
SHA180edd347e16b2f8cd07a552cb9963d0d457160de
SHA2566c6a8f53ac7da4fcbdfa5680f46030689a0a63f503efc8f780d418fea623c9e3
SHA51281f2614f92d3a38961ca5bcaae97d9bd6493dd52b2f31734a81ae4b13928e93076e83728a1b683739865349a7150855bc65a5c69e7e7d55ae5381561e8ccef16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d42e505924a78f21b256262a1322431
SHA17309cefffa05547bdce929e65e677bd804ec42d6
SHA256f3e133fea81259c5e964a07d4eb4e7a0f3fdb2d50f17c58cf3203a9a883a72d8
SHA512aa33f1b7207e7c471569f1f0b1948a86c7ca76ff41d0822cac6d4bb7075b15bee77f416d90ccde2a7eaff8dc99f290e177a3ebbae1d9bfaa57e89b2696971a92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553cda048e651ec9f1f7ce09d1575b16c
SHA1dc283459217e0a0b6aca3a5dfaffe6ea068590c7
SHA25600ec3b677ed5311749a158984d39c04eeccdd39c6eeaa73de03320576595ae67
SHA512ae4d25d612a2eb3ba62387d3d9c683fc1c7e9a5f8571a65ce22bd20af2cb132c15de3a459a7c693717628b0b4bdb603bbdd527dad1290f2c464fc3f4c99e252b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cb45ed432a951dca4a7882b37d09199
SHA1975a8d7ddb2fda137ec4af03ad77907238755c4f
SHA256910dd40c4a179ef01362a28f609bfa496b1487df4d08cb7a261b867a9204badf
SHA5124dd9bb198d057a6c2a55cefe1890f73ed27dcde00fab62f1a3b8b53cf3bb7dbb22d90618287f4efd36c96cce4ce4fa66efc098a288e15b7278f47b891095a0fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e11b1a1517a91e14267bb87de181cd33
SHA118aa82e8dfac5cb851f2eccab125147cb454ba26
SHA256ca24365e4a9688cd9ae6ae4869921a1f6e39dcd9d38a98f92ab98c67cbc3ee21
SHA51250a5906a6374bc50add3562ec101ac82cd7c9a25e2cab5ddaa39807cd635967186b76c2d8256d0721ad22915fdb2ef183e545e0f8244213440de83caafa50aaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589452e27302508f6ecbe04f4bac93f0f
SHA11fe7d5f10222f893cb350b924ae2617eeabacb2a
SHA256aae3799eca48850e0b771eebe8f03341fcf23c69ebef359e62443bbc97930d15
SHA5122ec52f4e32b526009d65f4be721594e7aeff7dee6aa1ceea61c622cdd77943e8eeb8196a5e489e85dc5a17dfb778a7d0732f0479f2a5d5fa9503bac6cacbdf3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553d722044094c62e70acdb183ae9c535
SHA16b75cbb37649c946e982adebcd29e6195293da23
SHA256d188334e46d075cbf70bdd71e25f30003743604be7cabc832612ef6aa9a6d00a
SHA512240d800dff0f694a04ab03c2295fbb1c887a3c7885798ab0f72ee5702788df043895b6509d1aec176e17b64a8ae77e20ad49ecd0e85f0b533ae0ec54198cac28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518e0b99392d3f93f1933efbc97905089
SHA14ce10d3973cad2178792ac59d233c66e55fa870b
SHA256e63cec1f568d5d8a8f180acfb4599d817ecb7a96bb54431dc694cba5b86153a8
SHA512cc6039c56730631fa06a72a9f06e69bfe02def84b2df0d70719fbb4abcac41327c80cf38aa4d3d03c0ef9985b909570c63ba668945c3863fa23ca0d7330b580d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a