Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
6d9301ec5fd3986c00fd327d9ae8b438_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6d9301ec5fd3986c00fd327d9ae8b438_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6d9301ec5fd3986c00fd327d9ae8b438_JaffaCakes118.html
-
Size
3KB
-
MD5
6d9301ec5fd3986c00fd327d9ae8b438
-
SHA1
e2f350d3d1d18ac046e58cae81a21c023e7cda8b
-
SHA256
47956f4092b47ad88d358f1bfd22a3140f9a7a8dbb1d09d6607ec849f0e2cd18
-
SHA512
aca5e7f9a57fb20bd7db901f5d3ed8d21612b794796adcd7d54d6b3aeb719e167dc487d6596992591c5c25d30172b18aa83dc3476cf3a5a77eeb2e9387eced23
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005ca66ca2adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ae422f43e29e7479a643e02abae30a800000000020000000000106600000001000020000000b097f42b995175a57059ba75228f5d0a645af3be998a6b50d916ce57f8ac65a1000000000e8000000002000020000000f3611a78e9502c7a114441dcecc464c495e2cbffe6ac695866d6b802491019e0200000003ba8f3c341787d79dfff11c8122447c96639f75b69415ea639fb9b3b2cd7d10a40000000c1248ee6a155de4e593aae68f2ca56199018ad078f444ff515a7c31675a8e10c4cf612257920b8ca5afbdac65f7000f65c48b8fbc60b316349bd61c276f143ce iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422693444" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ae422f43e29e7479a643e02abae30a8000000000200000000001066000000010000200000000b8be344cfb459fb08650577bdf29e3f1f54b0e71feef98ed0591675613c63d5000000000e80000000020000200000003ea2fbc5b970a479aa718eeb895697fc2b5a05640e9f19fb92abe900890bb9fa900000003bbcd130c98dc8ad0dbe7d08d5fffe750f3cc241d9504c3d28a274044447b9bfde8104b83f5e4fbc7ec5cda80d6db71bdc79a806294266c9ae9e8ba3df4e7898a874e852ef463a473666ad5e80010f03878cd1defa560e2f2838e1e858944a1ef6b43368b6829109e6987bc74481e284050633fabd1a106fc748cbc2d76d04a9870c261360275317c3186e2054cefa6b4000000052bd433df060b2f2bdbbebd687487c3980e9df06730fce927256c1b9796b3880cd7c387f975c4ecec3392f3812d5b05a008c8e405cbd605ac2e8e3927f2b4982 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97FD4C61-1995-11EF-85B9-4A8427BA3DB8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1248 iexplore.exe 1248 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1248 wrote to memory of 2628 1248 iexplore.exe 28 PID 1248 wrote to memory of 2628 1248 iexplore.exe 28 PID 1248 wrote to memory of 2628 1248 iexplore.exe 28 PID 1248 wrote to memory of 2628 1248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d9301ec5fd3986c00fd327d9ae8b438_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7d89c817eae53fc032b029e6fffa24d
SHA1f085e5133411a8d326fc0b1f7f4666d40a67fcfb
SHA256e863c2ed16e9847b76328ad4d66afecf3f3ed3986add41e38ec3ebb2b64f590d
SHA51285af9d62be300b96974c8ae8c75279350636b31ae3c01b97c117e3af865728cc461e385858e9b5dde8d8438d7e6bebfc39ec3f20e492d955e34d666ac1b7df8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df56f45cd03c893f09df8f2eeda7a761
SHA11d6dec4c2852d1fc282b9c0cbb9f11ee5964301c
SHA25647a1d2e8e021af9c6cf16cce115f067fcf5bcd2a42b1f92b02dbdaef843a68a1
SHA512bd8ecd4ef034209e9657010085acca1d55af8eaf089607ba46a03dbce189ceea7ebf94e5d95fb1ada7e5f1a6b4983939c9563532c40c524a3657035f40ba1fe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad4e381f82a00c49a891ed090a89b30e
SHA1ed941c6e03edf0e45b781efe3b8018b7829210b7
SHA256b53dfa38cb2ec273bf1fa9dea91031d1041b6dc9e08b1fe69bed687f5d25b250
SHA5123ea7709859a23e8f4584b60349caa142818c0bf60d25f00006355343ebef3cec23f749fc508e77faf895f2e8557efe185a030d38346bbbe56876d6581a305578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572a71744011d7475eb018dacdf619321
SHA102ab3aa8990836c62d786505e0952bdec2712e79
SHA256c09570f6fe1c98399cf973f48a7d81a2b246be84449e6dd869f246278b576acf
SHA512ab6f8cfdbf502584bae125e6fd185bcb465512ff1d578d94d9ab9884bd70499c6080cb4cc0f05f7aa936e310fedd6183ae85dc82c12def63239b96dfd0d3f10e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548bfc20cb112d57ea468bf2f65ab15c9
SHA1e18e76317c0346b2bd09b1b8eded99051c48aca0
SHA2569b41e18531d5b54dd4d413d3739a74f7d834e31ec38a9690d0d66ceb2d3a4fba
SHA51248f26261bbb8eea2325939448984839edfb2d6070001fbaadeb3a162d1f655f9e90755169ac8747122dd50084c9d4d2aa545f21e825deeae607fd9e01da8e66c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5255df63f4c74cddf9ed47317a1f6623a
SHA19e560b69905c4623498a5362f82cdcb8baec8cad
SHA25643d009a6d055554557e7a3da7bf019f8fbbc3e5ab94890e20050d8fb53851a4b
SHA512133e7944515a4c08e878fed4d5bd67fc09337cc68692ea08162269de91bc9110423d996962158fe329e9d73ebbbad9397d4a2dcb064e3d27041997ffbcfb2b66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cc21f2ec7c3ca57897ead8f5fd7168c
SHA1852ec9449005aa8d439372c5711ece88aa505b37
SHA2562c831d0f5ee42801ee59f2bb2e218ec884f9a6ef79eea7ce062de41991f1fb4e
SHA5120af90b717942c580a3fb862aee74815e6e2f217899efb41f3e462c810c9597b1dae492564cdef65cc5604db0297a1479f7edb84c00ff5a7749e528fc43cd9f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f09aca2f120e1388b66a131d8cbd256b
SHA1e5855aee78f372bc1b3bbcd8b152c3e18e93a562
SHA25638d9d0c45506812cd7ea6f85e987aa25f21ae849e5eb68074c2c91d7adf5d979
SHA512f1775c98c86d235d5b85134c8ec7af3f4872d62316f9b094cd8686674e3614521aef9e45bc21166e6ea4a931df463dd4a895148f15197610c43f2044e8ef82a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a9ecc16703bce75f5ca12a90804f8f3
SHA136cdc7e7bda9885ba3353268f0e84f9b41d36007
SHA2569e5c9e3b1eda499814190a2badb79e062b0b4268d3af0be6bacda155cb71db27
SHA512fc25eb2c45ad99cbc900a56cdd412c80dc920e24092f797e4b15f84f1db48442d773df485395fc363b1ef0b8b4cab71b7261d0760d5abb52165b862cc5e28ffc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50364741c3793f562f87dc88a72f121f9
SHA19c2599de12c12ad7a2b65fd59f33f109a1226637
SHA256aaca3eb22674d3e92de21dd125d3c5be18a45c0375fe53b22a53a07f341eabd7
SHA512a67f5f6ec6b0fdd29fd475d8d5eebb86482dfd8530357f519c6402d5d52f13dbb1ca6fcd14eec543434d4799e57671d5ce388f757cb04b23c871354c6fa892f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ed3c8b273735530860d104842719ce8
SHA1a9a7b6802088a80855c9787b44362c2c177f4f0d
SHA25613fad8dfe9af00577adc6c7a2030705a9f428bb718578956951937d64a9cf8d1
SHA5122c5b649b5e281f3a4b4fa00d24254669deba6cedb175535600b78cdd42ba5562beb29cc1aa7504c60f07863e5a494a38a87a9d9ddf35e93bf3c020bf12497e8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef0e5c4502f0efc6d851d2a7d8540d1e
SHA13e60953644098aef2016280131f1e32fd5ee2b38
SHA25682db3951c5bec0474e360133f9693f8323575bacbdfb7abfa64b5f02d52e3115
SHA512b4ad70189f1521b8f9814709e76b2ab62c1289f913bf88780a196310c2cded0f22a4e89f01f119cc25f100c8d3bb74764ed8c637a4fdf64f908cbde2c98e53c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ebd6a671ed651073a5dd7efd82d58c3
SHA1cc865d0fad66c3eea2fd2459f9ecfbf7eb630b2a
SHA25600da3609ecbcb17e19bded91d50a156be8f8832ba824f98ed1f5460ece940753
SHA512e450212c8293ef585c5066b785ebce6d7836f288aa6fdb11a865813b5840bce53a0f17defa08baf6d707bd74ae55627d84da96fbd44f463f8df4b383b1635558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5038f32f0cb160e056fc65a010f6fac26
SHA1f8c5c313f179e4944b98bc73a3d0616dd72f197d
SHA2565afffaa77c7d6622f541a43af4a068e8208e39ef2228b10d2d40d0b164121804
SHA5124b082c4c160eb0ba1af98cbf90f464b432261eeebb3682d61362f46a534d460725ec7e9c321eb07bdea0370a87f36ebe469e018dd1004d4d16df484c31b329ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf96a77fe119744900b501108484ef8b
SHA12b56d952f3cd14ecac8b1319c02d6f1d2715aebb
SHA2566bc24ce54457b20183f8055bb6d05f05dc56e97afec13d0fedd68c16967d7c70
SHA512183979efcd6e1a61ae8fbab9122fc820a827bbe6a5eac388e9a0b7e366551832cda9ff4c184bbe9188a7ce03444a3aca7285cf2ddd12a588e158150677030921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58238fd8545c4299136ba3ad65aac5634
SHA1ae0be40abf94fd60de49fbd9b8ce14525b160b56
SHA256d89ee4276cb3bc7183d986849f80fe440b14dba6c42fc3c9a95a636950edf86a
SHA5125e7c9fb8c6cf2d3548cc54c0a89aedacf425e5a72ec3b74dde884b33e25fef773f03d635dd5dc5caac7ed053b93e2c4d9a6ab2af8f767763ee386ed395764f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590c734e4a9b877c473a6a7ec251876f3
SHA1a0c8fef73cae7697f1df64163c017dc88b353ac2
SHA25674f4864c83163dbd93ab03cadfdc11dd1413ab760686b57631cc869a34d84a13
SHA5124d844c4389683b77c7afc91378add971cb8e4c59e86c3a04683a0ca1887ab9f87459e76a0e63c9f00da5c54988a7b117df42e2d949d2f839486f4fcfa6bd8c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56018981f0bd9eece4c68c3c5ac75a217
SHA14266c462b2418fa752b57f11be12840e52a7dcd1
SHA2564745e693e3f30eafab1045d628e36d685d01f5741db0d878eaaf9a0d47bc4e5d
SHA512b725a96e236afd5154bf7676665387ff14eea5e14f3e3c150013e73d593e6f2b6822d09284ca0ae9ac8f852d514ff725da903cecd55e7186988eb98a5b32f380
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a