Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 05:55
Static task
static1
Behavioral task
behavioral1
Sample
6d85e17bee7eec7b28c9c2a262cce0be_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6d85e17bee7eec7b28c9c2a262cce0be_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6d85e17bee7eec7b28c9c2a262cce0be_JaffaCakes118.html
-
Size
254B
-
MD5
6d85e17bee7eec7b28c9c2a262cce0be
-
SHA1
f00cd99e859e25ddbfd4988c1132ad6ba6e606c5
-
SHA256
9446b6b093835418434104bd133e8978fa390bd9ea4a70bcf957a82aafceb228
-
SHA512
241c1e460f515a130e4cef866907eec19659c6ac684dda1af1fc371a73fca385a9f898af1c38091acc1e8c62307b47e8960174d7405d99adac0e91efed932831
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422691994" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b8c3fcffdafc12582efb46de18155e890a5b90e40f81c45157eba8a924178c34000000000e8000000002000020000000386c3408099d434b86726b515a667ea82141a8d4e8c60bd3e60c23012f634cd490000000f0e3d436cec364366c886da8d147bbde0c1fc56cfb08743347f9ec2aa3c6cbf47bebb1771059989df60302ee578467040505e0fbaf9bfdfd7598b084f9a18b70240f3fcc1efef6b546b32d553da06aa885d61bb98e9b1d598d6668ddc30d8b50561a5a11a212a49b78289fd0cb5dcce6c747c77dcd1e1689f2d51d43d381a3b818cf0b035c858ed2835e5825a4c4ca9940000000b0292ebf32bf437035f9245a8d981ad264a2ce365762c1c44a33bcd07f30fa9adf91d9eae3934fa33580a39761c895e997370f96c45a07153f1b248df320f782 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005e806c3dc97cab65e2b6bfd88e29a6d23fcf878fc98ec63190d718d78abe51a7000000000e80000000020000200000002546bf4a7d3bc68d8aada891f05dd94eb9efdfeee06320536a852007cfc08d8a20000000a6cef2c0552a3b9b87d4637b40bc1787b66a73a478db279a44d0033b89204d3540000000e17807f5d8a09c16eaf35c22d5d8641106733094b2e2466b0a1ccebb59018e8d9bb88823b5182fad70861df60cf20bdf8b3db4efb387f4828863c5c29a1e0dbb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9009d60c9fadda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3858F3C1-1992-11EF-A48B-4635F953E0C8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2884 iexplore.exe 2884 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2884 wrote to memory of 3016 2884 iexplore.exe 28 PID 2884 wrote to memory of 3016 2884 iexplore.exe 28 PID 2884 wrote to memory of 3016 2884 iexplore.exe 28 PID 2884 wrote to memory of 3016 2884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6d85e17bee7eec7b28c9c2a262cce0be_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6ee80440d1f72b8b7e96605008914cd
SHA1e8da001c6443cbf63c1a0b97d0c058469ba588ad
SHA25612a234e01c530a6322b5b853c70e7a8fc705139a46599e2739b5dfd4b55e5c84
SHA512df0d119eefe0ab33542d139133c653c8130cb0258af328deed9b1de22862645169e15973a15ad81b3d42586ad835c016fcc995b68b2ee3a42ce7a926a68c5217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5003db809ae9ebca6ba31cbd3eac5b6b6
SHA1699b8771376478a7653b545bd856897d3bf62472
SHA2567747aa0106d8590b0fe1f43c101076e017a7fabfaf2445849185ac576e0743ff
SHA512dcf3f16a0cb8e740d1586ad30909f2b74e58a7878e1e5c7b8eb9fe5857edf6a5fee1f00dd4d4bd966aa09cc7ef1e1f893d7d87933b66f4ed96fbb7219b5c1701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50049d734d06a3f461c35fb6667ff41b7
SHA1de7b786c38716507165d33417a75d4291223a617
SHA25626fcdbc0e55d8ab7d52755b88bbb7fb1510f0355f6d3cf8df4c4cb8a9838c037
SHA5129a86bb6c17d2f2a8019bf2f62c21c2ead75ec5852e941703b906df57cdf944facc616178672db5ea1fb2b8ae20789e0fddc5e55d2e8479a4fefe512eb288b201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dcbebb38ce38f0908f9094486616078
SHA17ac7d44ed2d407fb9612f041f0bedc829dce59a3
SHA25615a64811986f7b4802ff5bfa82cf2ae7922e5bb247cdb7e8dafe00b6e1f03316
SHA512c04d4de6a1345737ca7994227b3c10ad580c7238de6bced82aa9e3f9cb54a6536bd9ef42959516aff32f7b68ca6adc9f08b0889ed65c1ac6d84b6c404df8e4cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570f8d54605250fd0bea3254f658c5b9a
SHA17d688e07c44a813a816b420d19bf426ab0aee54a
SHA2560aa720cb589922f6476175f6090d7252e54274197a5383a5577c0d122b8dd23a
SHA512de293870e46a8af3f182aa5dc225a9c404ac875f0b1d7b81d29d8a3ff29bc73760a04285c3f543dea17d39060e06cc384d6386c4dccffd49b3e1be477c2778a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1019b839f9c0aaf5decd52bde1cd711
SHA13a665c08b07c2a6d48ffd0752dbd55ec593b334b
SHA256e0c6f2b731bd8936fac686cbc3621e8a28b657688c91a59bbc0853bac270e529
SHA512193deb971878bca66f8aa338ee94136b5083f3b4b0c2c997d0516651f00e615525cf055a2de2662f7e0d5236931a13d9b50cb860624e41466fbac2464015f7f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546fd7caff51726111e0880d960f0ba8f
SHA1026990a6a6068375f61310ad0405a1733c8031cd
SHA256b0468def032346d60fa5e8e8be320f70e405c6d96dfd77415ad0176a0ae25c7e
SHA5120fc1901dd1e5e33c1612b42ba8b9928d6698fe591af3c377ed5d21151aa68077c6c7187c45fae41e8611f095bd8916647f2f229994fdce6d915cc4a2b90d2658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507d4fbd0eb561603a91a2ed07b665c51
SHA17aa66109513fc208743bf2b7081107aedebeb69d
SHA25638b634e991b3798c960c19f54b064272c0f09cfe530d55cc5a04ed6cc1b84f2b
SHA512d8ce4599c7e45da1dab267b4720b752f950808a0972b84badc325497298fce56e414d40992f71862bece736d84b2bdecaeb1c41c3a4152793846ac23f5536549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7d5360315a79acbe278ffd0419438be
SHA1fa00129334cb33874655da9b0feab124c0ed011c
SHA256808758fac6c705dbdceec3e83977612f92526d8630d2aacdb7b96326c44101fa
SHA512205526d4f93ee28349fcac9dce814880e827d024d2b430d4012eaa4b08b9b93ed5768dd4f145d0caa21b8f85b6448feabab1415e61ffc35ac564876438e26a33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5638be6ff7a2ad609c17e55e7fa6d2d8b
SHA1d568bab647179df1c8d127685817b5094e69d244
SHA2566ad415f8fdb519896657bc37de766758c15ad03fc107f4a4b357e44e18c8c7bb
SHA512c4e89947a7c9b65f43ee066a532453f223fd836cffc1f362f8fdd4e791fc4bfa4e0c0d7507eb36120de125eb08818178091ae03b5bceac8a7a78e0b48c16be63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59665bfff5f09e19466da89496aa1da44
SHA1e7b83743bb657e6e2b91ef6c11c286ec44f223ec
SHA256dd903a6e3c478943a7c856aa4b52f093e8f4c9a1ddd193ee9dcb340fedf3a603
SHA51221b686c6006beb00fa85baae5bda30ac34cbee8f91600ea9e1c5ecc1905da69ecae322e7c537731c6c9773e254a6703e690873bb2514be9212aa475569baa17b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d6b999cbe4e729f0aa66436437bfa7a
SHA1e9892569fff344ed4d4d793b5bfe9b20116e2e44
SHA25630e1d5b3765152aee4fa690f3576075ccd39d4c526722bca2ac5783af8759299
SHA5120627a75a49ae2999ae1479830b3c30933d5ff975aac59f81ea5a7c0c45e1a21fc85f0fd67b2d8b00ea2dddfb0abc1fdb5320c22bb385208a6d4686a37a319a8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57aecf6f6b9b32937056b801e3f70ed9e
SHA1ad0085722ebb2ef5b02b5c151627ecb1e28646d5
SHA2569d3d5211e69dd663f87e67880b91ac5c9e341766844e1f0df489855d83946bd9
SHA512508d70e15437346db331ad4f3f4e50580fba7fcd039f38757955ad1e235ee8440a7e394a50bb0fbfb3e8543909b048a5d1cc9bb54398d262c0cb6996654ce4f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c419c690b3a4829ec03e0e5c119aa0ee
SHA139159cf32572aaef8f0440c466b9f8e818bf2c8f
SHA256346a0d9c343813ca291e9a23eabcf73c0a381f29bc298d5d254c77a41cc2511b
SHA512c859070c9a967b885d78a6381405ba5d3aa8f8245b66b9b7da5a774e52033f1e53e74a2b93cf206e09d0daab7fa9d408a63427f64868339f508b982f05323831
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1046207cfb437498e46ac20356dd30e
SHA11dbcdb135b2004606704dbfa7fbc3b083ebfdaf9
SHA256c122836f2027eaca9a5940b6f95a25c6d017e178a383890e1611631a278fa702
SHA51206d7390e5cfd55d75783318f922af2e98da0b966dbc1e4a974fab1e39872b0276399cf17c5508573eb2e9709dfb45f9e73fd95cd1d9994740fd93a5268d28017
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5660e8891faf99c8dcb873fe6a9ff444f
SHA122c360e18caa740c038fb9898d936883a4387fc9
SHA256214e1663d2b9f7d76cb58963485334f0dfba51ab65fdbdafaf41c2bf0d78bf1b
SHA512e4dbaf3fc9b3525a4d97d6befe96d41ce70abe31cfb22592bbbe15a0c88264e188d4884f5b3c4f804e24d519b14dd0ad0036695464893fdccb53941abefa23e4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a