Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 14:13
Static task
static1
Behavioral task
behavioral1
Sample
6eca891d78cd7b99a3714ea7eba97312_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6eca891d78cd7b99a3714ea7eba97312_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
6eca891d78cd7b99a3714ea7eba97312_JaffaCakes118.html
-
Size
240KB
-
MD5
6eca891d78cd7b99a3714ea7eba97312
-
SHA1
d5eec37c66db052a8d1abcbb239a4e6f50ad1d9d
-
SHA256
f82ecfbe189ba0a769f251b05122f6f292f7413f13dcd1bab6b02f8d8e3d3651
-
SHA512
2b6fc9a08271adbffee328f2ec3b6b45da5c2d9290f64900d4d52e36dd3093c56b41757532ad7e86489689816b65b7c6a85474f04defa802887e21ee08c7c128
-
SSDEEP
1536:hdYkmQBvSMT74TUWPZcLOMCtScOGEPSA0fYGuaerW6h5j+jOpLvq6vW01e9pA7NO:hdYbPObpf/5qh4OOB2hsnBKt6Keju
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFA0E371-19D7-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422721858" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6eca891d78cd7b99a3714ea7eba97312_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD53f51427fb35335d3d18cb3fd18ec3802
SHA1dfb4da1b914362de8e2630a78d9036a7ca564f78
SHA2568931b5b993fd29a2991317518d59a9fb385d073833e752abc2c589217f63aff7
SHA51283a276fd198dd3159801936495ae4c7a83a8101ce3974dd1614af338fc5dc2abdac6a53857a3ffbbfd1113dd014fa059c14592d1e16b2742f2aee6469af8c701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f993396890bb3c55a5106cbd56b8dcae
SHA172bf0319ec765f134920018c6db29507e5a94d6b
SHA256590a98f4efb66506ca1f199d4fc3e83539ad1f3095148ea1b93097a67b97308d
SHA512c32e9a1ed7f8eb57ed0b26c40ed6a3a53541a72357343736e18710482b335e3dfe09e1d067c0c5473ce2cf3109436a2f29ad468d63e18b0878750c77a6496bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cb0317f535397915fcff32d8dfbd610
SHA158fde23377162b06b372f58777576a23bd1debac
SHA2569296288b8c67a4b6212dad35351af37f9020f5fcb3627abb5aa098f1737b1797
SHA512d86a68d981697289c758aca9b771541507e0c3df76573cfce3728a9c05f105b95a15d2a21713cd3c05fb293a7f665a0f08473e222e17cf69a814560558f8a406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e49580ab709de59b6bc5c0cb5f5e8d8e
SHA1ca200d3728d8431a06d9e16d624fa82cc4b942cf
SHA2569d5a7dc64bc6b9127f1ee328a4399962b5f995643d0d5bdd905a1087aff347bc
SHA512d536362a5c9e1bff6b67e3cec5c4bed22850e876ea1f388fde7747c465ecd2d9ff85c6655a0b7dc4c328efb653a275263441ecadd8baec16c32b4468f2d9231d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd01de75e607ed856de738f012541716
SHA11e61abf5b7cf5bed9d79eaaa7accb50b60398a64
SHA256e65e76d3b592d45b91a4c43e234b30a91bde330930569b699c7de88d653e4878
SHA512d65c43a48ba2b044fdd2d9c967c38cb937fc0a6856840a4ae79e416ee821de6e9c7991a54832bbc7af1917fe5dca791afddf39363ca03ebc89482b91183add6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7ccba48cbbab820f3fe0ac791bc2188
SHA18152d8b20963990c3a5fff3cc5eae6807263416f
SHA256201ecc281b2a7f18633c4543fd843921239352fe3ee50b7cbf57c5acdca1bdc0
SHA512920549393597fb4deebaf2f6e055bba4b2da5de1a14cc710d5bcba376058c988527ddba43377abe27322672de622d05b04f236a2545bda981451f3ffdd8103dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff3c228f614054aa7b42e7012713e295
SHA134219b4c20bc63edf600807311e2e51f4eb58069
SHA25604b870ad1fdc6e76fce7ae84a7e1eb90e6513f45174e7c2a835c54e3ca8063ca
SHA5128608073790606d8dc0419be456ca3491c507279d525629f7af8f9b865057167d3c6c6818d14f820589d2f1f1f766fa95551ed5e11f2c9e5cfeb643ff8c97aaee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbc9875ac76bfd3d22647381a42ebb8a
SHA1de1c8d77c65fa2b31b863a15fe71d305a391de7a
SHA25606172711668744521252f2833b549fa5a2569c43612d97524d1925e21c444698
SHA512afb9cb621b394ee1ba5d4c008338ba1b4e8396f3c76e772495b3905d02c7a29c3030a1f894ce6e0ab1cbe96c7fe6745514d231cd7dd6b070032c36d864d676e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59752fc01c07edf3d507bc9a5abfe7727
SHA1d8515040118a5853d298d424d9389b0478de2959
SHA2562a463dac32df457ddcaaa405972bde6cc02bac9def99a7f9958056c3939d6078
SHA51270d1a1c322e817c950c7305dd8dab2c4919c0d0edf4e373f7dadfb717816998b34e4336d74a57c24a0c7adf6e7338e4e59bd27a7a5869dc14b392424762e3b1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4418eb2b38c8de2d6cb94320d8d0f22
SHA1e0dd2dc6f4145b4ff2cd48723e02680c779b3949
SHA256fd1f0d155b67671163a51488ec37fe45956cb7c9b7d0d6dd2b024f67fcd4a4c9
SHA5126f17a954c593b5ec1f995891c99aa4a10c0e68f6aa46862f92b176109a1c33bebcb0f811a7e9867e760474f9221af255da9ec1922d065503ad10bec883929e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a6618833023d6cba816cde4f12f2b7d
SHA17857c4acb8c96c207c5c524270d595b61738a025
SHA25606050dcec420f91050631690ba9a97ca3323c0948a4f9838a9aef0174e82f2b4
SHA5126ac1ebced3515470b5312a5f769f3a7d2d6add80ae91ece24b43dc0cd5e75f5f90b5c08bd6754d23fb352bd95277abc6c4567e566a3194cdab1ae166162c8887
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b03376ff3c0f20fd09f44f9a08f9bc2
SHA16348e25eba93c7cbb3285d4b795d46edc9090e28
SHA256a1ca1f832795f6ad963f0c6b383be8a7086460b6fb18395b1bf29c237d540149
SHA512375c78a9bdd53ca6093557433c61e8d40ceba573d50198a4b8ff98dc3105b8dfaecc7ff45e3b46264439455d99a27d5f8392f0ecb60d9072cce84af4014dcc9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5069af5ad19ed0bbdb1009dfaacda4a9c
SHA1f563d7ab615b2643053d3c3e0032ec75a6a54195
SHA2563199fc96249fd3b6c9da63f6d2de1d23acc8c29f3dfe420ec817c3031094d8d9
SHA512e66ae98706c6016d507bff0a9fa60ea71e3a3920b64781726be9846c5ee30511f20316089eaca99f9b6f4b5e26f1401a879c311a42bc04f19fbf128982cb14a8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\b[5].htm
Filesize178B
MD5cd2e0e43980a00fb6a2742d3afd803b8
SHA181ffbd1712afe8cdf138b570c0fc9934742c33c1
SHA256bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
SHA5120344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a