Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
6eb80d7ee5cb08dcd21d1136d194cca3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6eb80d7ee5cb08dcd21d1136d194cca3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6eb80d7ee5cb08dcd21d1136d194cca3_JaffaCakes118.html
-
Size
3KB
-
MD5
6eb80d7ee5cb08dcd21d1136d194cca3
-
SHA1
c77ee35b4d97844f7f5a3ca74bbc2791f4cb82e6
-
SHA256
96e4be58e3290e5d683685e4974f175a36bd3946296eaa5c6e86016b6b4cdc56
-
SHA512
f9d37bf1f39d32685802591077eb54b1a7b297b70b62d3fbc5efd8dbe5f043606a4a179cc25771c1ae649d00ad05d030dbd4a9fcb3b3a00dbab0fd7ae8c9063b
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D91FE251-19D3-11EF-9340-6EAD7206CC74} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929fd894c8ecc940b4e0cf0a4ded14ed00000000020000000000106600000001000020000000f8e5fcc8d1c81b3a55ca4e933cc88919cd205b78a6c41849e3af3fb43bd02e55000000000e8000000002000020000000decc31a311b4036fcf3d34bdc7d3af20e49a9d2b911e9438b37e6d2d8680c37390000000607070b2bdb96b50d09d56ec6bf30e0c823bfb12a89942609424f7f0e8572e5e67873ee781c989f930b7182d2730f6a63b01f280d17c8a44a887b64f475291c8cea1feb173bcf4ac09b4ad5a4b0d6b7a98f4ec12ed8d9d460e352b20a34ff83f69413da962beea14d2007c5672b3aae77e1a6d92e63f292b8d69c14102b79e6c17b7d655f242108c02e7126c8b2301664000000077a55782e75157c175fd94ea9e523f1a1a8a75101857cbb3d88ab626169e8440d174bc1f4fbb674c0085841c7ba31887321d26f7eff3de923b2aac2ed463798c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fa41aee0adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000929fd894c8ecc940b4e0cf0a4ded14ed000000000200000000001066000000010000200000002ff736f8e8a339c39ec2ff89a0df31b4a4df3d3e84cd1f81c5fb427edfad528b000000000e80000000020000200000008ebe6a7cf2805fb0dbf81b5599183e7c545471dcfe6c022a53cb2bf0834bc98b20000000fe8b27460195b1c72b9fe6c5ff69913767ba66f5a48d64074a2e8547e8f9bd13400000009d7f995d826391c04a72ffcf222daa04c243976dd9141a8cbadcc14e8d6ac401fc4032021bd38d18ce1f83a880e52dd284346a572d3a5ea61f9b65d516394a06 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422720184" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1812 iexplore.exe 1812 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2300 1812 iexplore.exe 28 PID 1812 wrote to memory of 2300 1812 iexplore.exe 28 PID 1812 wrote to memory of 2300 1812 iexplore.exe 28 PID 1812 wrote to memory of 2300 1812 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6eb80d7ee5cb08dcd21d1136d194cca3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1f9047640f2be7836c09a6e61aa1f3f
SHA18c6e1a0bc6f5852736eee38b9e43d276f1752bc3
SHA25678f3514c4bff83b158d1fa2eabbd1d9ab8e614a09bfc3348e3a767a88e057cf1
SHA5129a3026fee2db97def3e862faeb68456c7e3bfd1f34f96ffa84908cc90f099697ebb7ea28cdc800fcce91a288f5d035b3f79c1bd4f5c3bb7486b511d5986aad8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edf280c0ca16dc4b38b158e8e6581d28
SHA174e24a5b0181a8daf0e63c097cd2524dee5e7e8c
SHA2569e0753a06bccd7b539d59231eb183589da325c44607c691beda15d31542a84e2
SHA512f668e16e1b5d3ec9e03eef282ed4a450f0661806004586ba973c95298baa391b43eb45045a5a5706de26123d124482eb3227e76882b25298fd71fbfcf6004d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5e08439373662c9f126727925cfed50
SHA1fc0c4be6644b5392cb6dee445d3317cf60479b0f
SHA25677b1e3915a5d9a6e62bdd69d658f42f648d70d913f7a0ac071ead04749435454
SHA512a22f6ee253fb9d9f572b9e024835b827bf3f02213de8b4e15a3fa0de30aa1f05743f274309a0317adda1fb1bd78f955ab0c5c9139b5e69fe18b7c3f677c27a16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5e77928e86f7804ab2b7c475db92265
SHA18fa8630d1b7a3ace4f0495a9604166dd39094c74
SHA2566c3fb45acc150ce0fffbf9b7f78be1582e1983d401d37f1ce3475c7e56e9009e
SHA5125eee335690b4b3189b67e6d27dba357bf8d25c337fe849f15d92b2093f8618a3c1d61ccd2a05135fcb1676ca6723de63c607d31ad13c41a083744be5264efe99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c6925c25a2b3ce8a35319c2fa15cc1c
SHA1b5e5d34d1538dfe6d8b15e6916bbc96cb12d632a
SHA2563516b7a8c3a2777246766b8b9a7c2b6e9c917cec506cf0db7c1285b71c1ec3e0
SHA5120eb07054d3deefb0a42421d19cdd7a606611f51cefff20befa83c3ab99fab255ea430c2df6bf369f0f1a31f042cbdc2dc1659f6d7404a26a7a55a0d6a5fe3c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52376a2f8353ce522cb85c9412042c80c
SHA196c7ff23a996c55c0435cc6a9000865447dd0846
SHA2562fbae06c367ae5673e62b9e008a205f01186e5995ac93d715ece92c0eb5e2ef6
SHA51295900ce62249d1ce6e16ddccf74368efa9ea2a034e8a3d9dc5862aee390f160f2fa6ff70d908988bd87e9ec775c5fbc7687829721de579d7c1123521843fee9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e73cc3e431ed7874556e800795f14c5d
SHA197bc9f919073dc108996d0412defe210819c6940
SHA2564038860d1c2e1880353f0c5a7953a3560374aed2355844e24a4712a472332d2c
SHA512c33c87c0b03688258e2efe9fdeed59641bc64c18f986389ddf3ca66d01f09907f35b0a3b29b726759393c62d6d16181c1897088b34cdce7ebcd886634529b247
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc1fcd31135c99a0ed9c640c93b3046c
SHA1418b67262ea1c19ae87c69450998519a7797c0ce
SHA256794cbd9057f1bd57d2d7763d90337c7c386627161a3682d095335276e031b05d
SHA5126ef5afd5b1f017ba69608be8297535f7cd1f3e962f01c1c945abae875a59623d441ad7be2c096884d19aab80f6e85834fe01f3ffed156128b5a02aff0a458d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3ef5a453004f2c41766661b590e8cb8
SHA1281501df252f3a0323e83a32ff59f5012e45617e
SHA25651df172a4b805d2d58dd52c3465551a4e93522cbfdddc3a1c7474d33a4b48298
SHA5127ad1067002f17768b7378fc5085a3da42aa501c9a1ef6283d7415a8f7652e25ad8ffb249c886c16199688d789d2c1f08f4ecdad731e5cc1688edd1f477a159f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5949f4a98a9bb6020e87c96bd908e5768
SHA1d078a305532c512a63e42f4d060f31a7b5ea4f87
SHA256d410dfddcc6df750bc7c0725b1e02b9d730ca409a5d178e36b6127d1367e12fa
SHA512f04952d08360faf7c36dbf21b42a004510b0048eded0d6ca39bb4010ac5536d188d3d63decd53eaba379714d1ee0009d485973048455e860254ce9409a4fff6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580860689195f837ee470e46ff1a1dc17
SHA17b6d5d3cdeacc5edb6224c9cc00ab1504a247c26
SHA2560163ef6f76d1cd3ea76dfc2240f137bde8ac9161e0728919752aba9a5b253f07
SHA512eefa653dc72142f49ff7b77157edc1eb5b14dc36321bb50b55dcfee0eb3c103e015a475b7341e6e64fc907bc82770392f32b4953a24227ff017391cc8117ccbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500a8cf518e62362dc140ad2c0319c74a
SHA1d938902117650f70fc31ec5589582bd5f9e14b5e
SHA256b26953a76fbad38a493c383f5d5dbfaa3a1ac80e3cbcc7d22a8851fbc862f1b6
SHA512256f76cb1f4869ba9d929f5a1445de1b8308ae1d7b1afccbd9af26fb869d2d51846bf2957d6434854aef07e23db7223039b578152bf65af616ee034e6f33cecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efdfa830cbca70996b93c89b83f92ebd
SHA1b3e8fd0a36385b980368e1e4936e3f3f14478b2a
SHA25640f5d2c78d6058771dfacc0b9530a872eed2d96b52899edf8791fff61536f64e
SHA512d4b3c841a4cd412ce9cb674413917c4ff7de0b719cd8dd48d4b4a8fff9303050209fd9951cdbd1301ec8061082bae92ee60f57d795c642cdf72b4bda6e52e66f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a