Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
6cb67374ad82eb80cc973b2ff4af3179_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6cb67374ad82eb80cc973b2ff4af3179_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6cb67374ad82eb80cc973b2ff4af3179_JaffaCakes118.html
-
Size
204B
-
MD5
6cb67374ad82eb80cc973b2ff4af3179
-
SHA1
baab60d257b7b83442b656ca46d52d245bfc22ca
-
SHA256
405b4a1a8f9ccda0248b7f40b21b3052bf5460fd38713312a38b4f513345e063
-
SHA512
6f6a5757a7f622fd07b9eb7f8410e83d273636f95f81b909991d6cc508cfa48adfc25666aa8b39a66f8fb98e3855e9fcaf964223f3965f6a04fa2f1cd3e02193
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa2188a4f5df33429e9bee829e74de340000000002000000000010660000000100002000000031237df02689fdf0f1466257a5c65b07d8791236f49b83df6f24b418bc843153000000000e800000000200002000000097123d4630b2f195557f782a266fa3241c6d1505dddafb4aa5c421a67e89568b900000004cfc9d2f7de96dda6bb167758251c4b1a93aaed16b4cb7ec7717e45f6405bb8c3506249195630395457ac78f1dbdfbeb70fa76d45d3555de18238c0db299620847c05181a01d1395074cde26982ce5814077e956c132ecfad065156327142f998663edd2563e4c9b5e1aeacb231d9b9ca4d8fadc21fa704dda3f6ea8d87254711677036687142454698c599cbbd7df7540000000644507aa45b4dd655d941f873b2b69a0ad1468c6bf43b25ca7e6e88e3c62a3d541041f0c1c1a4528e97361024590f48115ca9910e20a64bfc937c469c4307e0c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa2188a4f5df33429e9bee829e74de34000000000200000000001066000000010000200000007da888b93a217e0b9cfb905a94e3c77d32c90a80d04c82e0cbfee537c5556146000000000e800000000200002000000043350424a376ddf47192d701d1d4d7680afce9ab78568c6013f4707ca8155d892000000022510c9e0fad5d6e8c9036bfed08a8d06a6a0220444819c51f7ed0036d08e0d240000000bc2d41e0ca9a81c627391e198bc629bbd7ff8b6b4263d0e99e423766b159c397e5479bb4c3f79b20f95a98ed582477902f56c919b2096cff3a5338b1027e1184 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88206551-1960-11EF-BD10-4A4F109F65B0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a5a35c6dadda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422670653" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2928 1948 iexplore.exe 28 PID 1948 wrote to memory of 2928 1948 iexplore.exe 28 PID 1948 wrote to memory of 2928 1948 iexplore.exe 28 PID 1948 wrote to memory of 2928 1948 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6cb67374ad82eb80cc973b2ff4af3179_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54800f6c72437849a63e811aa5656a443
SHA145408e2e3074032eaa6f7ee6a83259d6293f148d
SHA25650a676c26385a9caa49ca7fd25741baee5f227d32506c0e4015a59a8452ee394
SHA512a905fc374ccd2a1af8feee111610374ddaccb6c595fffe50572ac245a758adb8990c8e92614c562f79253cf078461da3ef9b8acb13ad52b6be8d882196e9fd8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581d0e39b295642de9c647f417090fa37
SHA16186677cf138ee0312591a3a64eb006d48c26e23
SHA256a9423a8b17e300452d7e5aa648efe5fef5dc405770d7e7f6869a2d196f57643a
SHA51252f77041f37873c33e7adb13802c8de5e539051aef17b51fe22508dd51b6eacceb7176aa946a534bb24f002c10694836b7365aba1e8fa1e98d18c03fe1ed7039
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5142eea1fbe502cf52bb334b3ce427394
SHA1e65f3e78093f590a80d2e16054f454207eb19d1f
SHA2560f31d651eea6c27de8c9bfc8adfc8499ffd1b06b574d573a944e2e5ff0401398
SHA512961b12f5edc7d5fa85ed8a81d0504d60ddcbfa82fe83605b21e36d0fc6cef8317ab98350e3e9226a38af18f17ba6fb6a39121e46d240fe92986c6b569173a9d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b6852151f3fb070350604bbc847aaf9
SHA1c5b9a4ab7004396a2b693ffb979112b9c84d9aa1
SHA256afc03601b04ef48d9ad0501f8a4070aa651c74fdd46df594b2a2eddc8cb441a6
SHA512d766ff7a415c8efa72b64238ff5bc8d4fa01db9c45d0a0a387265f9d28bb453250ad9f5b1222870cbf02bd10c0eafc52dfe0349f5c92eee07248fd2202fbd89b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d36cfb8522e84ff4fd75fc8c6a416d2
SHA182a7c580b15ce2faafbc490d4dc922275aaefbc7
SHA2561e4cbe8b2785204ad4e518e7a479a7692eb9b413e11855919159c6c750c63bf0
SHA512d4608389dad55378b1f9b7cd3151e450a0902d4268867764473fb94a7fe095ae4c27f1163804f6e76e8156d55924db16a712592683de898de79297ab4c1bf4db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561a1840a3129edae8f44a43669259225
SHA1fc2bc2aaaed5267d70c343b75946ce0628f982d7
SHA25603a5cc912ea2b6a222746ded2206f66b92b090ec935b31e75f9547dff776a1e6
SHA512946edc04b2d38a752bb7ecb0f343cff7ab00644606a12b87011f03e59f5f80420baa6387a21b02531b37f88b5663a83f8ec81c2ea98d1ece3877ecc84be34c28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a545dbd8af7c4b457dc45475d6df4171
SHA1b073ea28edd9b3f54eca0ff06900ffcee6ef0d47
SHA256e91cbf8c9c60da3df418324967ac29bb552b7427815cdcf2674d14866da0f37f
SHA512766a09e19546c42643064965945ba380966d2a7c5173851bbe15e0774571ec6005fd94cb2cbb5dd3e876307bc6aadef22abbb502f65249ef288928159fc6d2e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cade18a610b62194f95a79f8be0b5f91
SHA17cafc3eca6ea3be9ebee0924b9d134306f8128fb
SHA256de454030e48a0bfc234405387a96e3a696a3046451959eb0eac1399b9cbaf6cc
SHA5127c2bd2782f736b58f3dd699ed601d3fcd1d985321c587c196d8f94781bf92b933a725c5ec451820ebacc13d60a7b0b339aac2badf780a58923b1b53bfa35a367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f79e11fa7ed528f0dc074e47f14dc95
SHA1f5bc7ff86cd9b251a1b410d5a1875b9c8b5457d0
SHA2562d6acc5c1010198eac9782cb00ad5a7d19c47d9047b815de9b33794d89f7c0ea
SHA512413e2f86bf870aa67cb0ac5de3963fb2ee28e1d5ac4eb148d36b724eb6c023a637148c53b0c0990383ec31e7f2db5a74594607a5e9836912e179910b8c4bc4fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e23fccc8f4b06782d2d9fa409c7160c
SHA1625f19b155721795b7213cf8532a04edc428fa11
SHA256f1c5f31ddb6408a6d368525e5c5363123207c791836796f3bfd84e54622ae16b
SHA512e81c5954bdd02d5270c724759acf472bf2355452c6aa4abd8adaeceefc2c19bd17a1406568ce45744e10da046b898608845f2ab271ad487c648410924144ffea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d74815b132179e5a739f2c23b34eac89
SHA125e5790be9a2fb6f748bde94776b14422322d2b9
SHA256a040ec3e367cc2c579667b473769057d642fb7a8932fbcace112a1a8ca93733a
SHA5124e4657152e9a59ef4646a4be0809211543e3fb2c2efb36ac0c75a73c0e6a6c0500e0bcce0a2c8b2ccb319c1208233618a1d5a7d69e1573668ebcd7fdc54b3964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b64441b38434cb802d519a2de01712b8
SHA112e12808616b277af8ce3eb658a0f9b36b4f7f2c
SHA2568aeb26bfc7570331f3a4f285671fd8a06c5ec26c30cd9ffb766cd036f7f6a2c8
SHA512dc528aab3779d2a0b315b782b0c4828eef37cb8bd94a2d9f7be64281f9f04753322f2b5d7b52a80e27fe978b30f0957bcfa67652a21d09b609e644606bc0cb6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56493f1b8095296f4d6bcea573dd19e98
SHA157e7f288f5029bf69016778ddb1fb85c669abb32
SHA256591753d2c355dc3fb52939ba98b9c5390786114e7e5c1d85c01d2a4d33207106
SHA512de5c4a8209d10312833ab5675db7a982a52f7b7a8660da5b82b9a10ccce0d8e733e8bd13371811277b95c85fb8b15b5006e9efe07f951e52c186fdd712225b9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea4cbba266e738d435f60adc3f48888e
SHA1322746fc8ff932fea03ac275b0f64c48a44f1250
SHA2562489644bfe937193eacf356c9951bd6f0cdb28a96182596f085b7a392ad3dd3a
SHA5122ef0d4d73cfd7af7846f2e0f7a26e7b61c798053a9698d2b23ae5a49d57a8afb8960050010887c6c309cdb6a79617c9a4966e73a7010692f71bddd8f2fdff2d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc012841f5306c0bccff0caeb7a3ad7d
SHA16eaf29e827f0ececba034a7edcd7115c53fab5df
SHA256ba29ac5a1d6a0e2c900afc07afce67f83d1bbd94ad0c09e78dd2ec3d4d5073b2
SHA512ddd3e6924bdf0c136895761ef93b2acdd240b0e087809903a5120303b3d05d657376f23dd41a4d9094574d3363bca616528ee75cc32c5da86ab39434fb1edce7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d268fd0af6a0758a3046eae812463bac
SHA164798e0d6a30be924ed18648251d2d218f8ef22f
SHA256ddf5850f5bd1b9ef38061a55ef132a86fb3b604115a49ac10e8b8f1154f4e8f4
SHA51266db87ade207e4036d0190712ce6317f7eae9878b0413d754a77b7d8be1c818090b66e3b46b6e43e2cf40997fe1a362122a9f1e2639a50162528e3defce735a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cee90c9f8af18fa4f443b4bf54591e5
SHA18bbb405a43040d770cb49ebe8598481538e21150
SHA2564d6680afad72bef26955ae916b554a6a852420c9790e7b1e7ce24739bff06d0e
SHA5128316543bfa96f43e91806c1c83f7b6fa521a6f59ea3a59724db5059008d7b1ac284504f1920c371cf34eb88180a7f020840953c66054abc72b824096437699fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dd73f9a32f88fe977a4d279a4a458ee
SHA1f5d2d9376b9727a2312f43ac99db3b2a3da3a006
SHA256189965cb98d8a1085f56400ede4d6d45ea405594738979198feec10175c0f04c
SHA512d3ed4ab543aadd2b7a77109289f5712100a623db80644618afef78c699eaff6215ae1e1241358efc4c907eb6fc8aba3c9a38266a0d42bdacc997a000bde0bd93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aebd7df006e65ce7f731b058bdb94e64
SHA146e21c81761a1fb8db30054333f468493e612742
SHA256c3bcb40f09e5cc5c9449b70315b43a5e8b34bb28766083e84782599d161fbc6f
SHA512226f9238d0331eea8afa90a2611f8e7b1fb909379aa39523ea75e0b0e32bec42614930a0422dad3edc688b223933c3db80add97306090ebe1166ba9a08fac363
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a