Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
-
Size
213KB
-
MD5
6f6116f4f7dcdee173ea97a897983cbb
-
SHA1
274111fdf1b2b166067d016ef8bd4d861825fb79
-
SHA256
0abeb1ac104a4b23fb51b910c8074dc809b0178cce0389a2811b49e322c9e247
-
SHA512
d7ba9b7122e60e9271c68ac78140561d1883849f5f1a1ad1de5fe09d437768d590085599903deeb6efdf9c472355d751627bd9f0d24488aed99f7541df727234
-
SSDEEP
3072:SI6V7V61X3J+yfkMY+BES09JXAnyrZalI+YQ:SIgAbsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D62F66F1-19F7-11EF-A4F7-5A451966104F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422735638" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2600 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2600 iexplore.exe 2600 iexplore.exe 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1968 2600 iexplore.exe 28 PID 2600 wrote to memory of 1968 2600 iexplore.exe 28 PID 2600 wrote to memory of 1968 2600 iexplore.exe 28 PID 2600 wrote to memory of 1968 2600 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e08ae8bb428c8d2af995028f1495c0b
SHA114d7d9f9865e503d6805a2877e6e777c8d655cb2
SHA2567374ba5b48c48fb1de09d343894117a808cd1d4595de344e1ae2688cabbd4953
SHA512cd5d365934f0a9aa0166baf8063ff7e9e2794a62f3e5048396657fc296b18ba8c8e6faeef711e30ee283df2d42887e6a6575e5d55d41f6d9e735d52456af8a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7c367677aa928816a2c3567189e8e22
SHA170976633aca6ca74ae7023ede5fed03dd9da9db8
SHA256a5ef7155a143e790a2cda0ea747feead4b08f14f597d381645a535a9dcdbd8c1
SHA5124c133ac3d817a8bf593f540b418269d04f4fbfeb4cc1eb399d1f2e167b4791a026a6ac8ec6a8dc87f73b34d15228a9d30e8a3aaf2e66cc0c585d8760712c0f97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a16b7b532ae8910fb55a4951d19401f3
SHA1c67085d3b48034b20d3c94e3376204efa4ffbf22
SHA256d77a908870fe12d831d0e607d2ae3f0e58195b74eb0d6e54adc8644b6bbe405e
SHA51259150650d38a80d6ce8f41f4a46f3210d6f1e816acc67a6888a5f2f6001bdeee52642b5dad96dd5f561a2579692237b00af6cf32cc8a063633e92767561718d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd60311642fce544a444a78a532b1bed
SHA13167fc190feab72906f4b5f6fc443a1de47d8303
SHA2566b327e628d7eca2918761325c5c335d6bc3afd47c1868044daf054e7baf4d893
SHA5120ac6fc02bd7806a35be02b54e9f47d444d398068273ec5afd7f6895a61f60c6215777787379fc560e1bd0d817562feba0d170003a98a51045de5a73a60475ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d390f76e5e2b9633756ff0858f22613f
SHA1a146606c7316e7f6844557964470ca49260d55c3
SHA256645938b9ea01d25a2c1a73dba8c03a572627fad696f1c75e58a680d8c69ec45e
SHA51266cb3498a0ba0323e3344738b9327848ecd05878acbeda1103705b47d1ab0ed3e4e3979d5b43e6edd3c681be96ebf68f2ce42cb44bb0a4a98b86f1f39347fdcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f16858f86d133526a604263a05f121dd
SHA115b9719ce68db1641096e62f4dbd725969923f16
SHA256854ae0c6399a272821d88a80f6cb48c5e964a8f7878b206dfa0fcb879ed4ea8f
SHA5125238e01b748e4bd65103c8fde8fef73a0fc4fa01cb3268f97e13f4b9454311d8d80c8cb9659c7640ea2f9967bc38d6af26288ce5128977e2e6172e677ec21953
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572a0f8c023e598857a8cb059e10f066d
SHA16a362896631bfc7d0991bb0cc14996f8b02c04c4
SHA2561de0326729e536de94ad6f2aa553546556eb5e04b912724f81a8312b378392f5
SHA51203d6e21cdbee2a7bb68aa3f3c072e1f0529b1fbbbe4d82c15a1f06aa6113e1f683f07171de0c4a2a3b0421ee0f9817929bad90e1a66294b72e959eec2755248f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ce5a9820add885981ee92d27262d997
SHA1ae905abeb3c41b6be3a0189df623109e93475bc7
SHA256b713fafbba8dd7e05a391cc41b4c1fa72bfc88447d1fe5b9d9563688716521e6
SHA512877b91ccafa7fc1b90829a7da7cab558d6df458969eea5e0be4f8a6e6c16fffe9e3de1b17bc0a6d69daa6d16d5cec4de391ace5a60987db336f7b48771b24e48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ce204583ba479a8ea4ec223f451abc8
SHA16b5bae8c48fd296d526afbf4544d36ea1d837a67
SHA25627e544b4caa71650c9b94f1138848d95b8ba3fb98165a51f75469c81396d9274
SHA5121b52ac3823a9b682ed4f640c0e363caaa596c60e60cbb16f80aee7b29dd15015008f3094cb3cc0527b7ab38ed1462b35b6d16b5bb0a72ba2b71e6d9c7b003dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b5e25d394a11f790667d6ffc2d91272
SHA17c60769d6b9850464a03351c3834b24b2feecdc3
SHA2564d9854f231165075d47eb65d6efa7579eb19b03e383ce9dd0c6725f0b504d2fd
SHA512ae72f246e5ef03aadca24627e3fa49191e88420758467ae95028a55a75f57b02fa57194a9e8cbe86f66bf3d44906e15bfb9b7613f6374064b1f725efcf766c98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518800b29a64ea19b228eea866fe8172a
SHA12c14809be1ba44a06f9363367fd0af2bf13edbae
SHA256cbd54262ab9c80c4aa14671e8ec66d4c3edb02eded3724ea3cddca630bb027ff
SHA512ff8f5f07a023b0667714df3fcbf7031ba8e360c1d3dca4be8a5ab3f454e65b358d366333da6fced64bb9037ee8b933bc7e1d33169ccc52361cd98f3bc09de248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5defe119021ddf343d84835aa1d6b5d53
SHA1ec14a19731aef250340ca08803900538b99ba330
SHA2565042b7aeca859452450d2c4da5023dbaf59d3264b1987ced26894fc80bf9ce30
SHA5125e0517ecebd2f486234ba05815dd0749e7bd7fa2940e800a7e2706499703827eab79146947b580d9e4185195c34c31a7048981354fe6ab25af9415a70086c0e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59120ae258be5904b8d256666971e2dbf
SHA15298e30cad1254a86ea33e7f4546abde9e3d2906
SHA256623c7ce2bdaa7f3568584d68a15567ab2c791a96766887e84151d5ec7bcd30be
SHA512c499792c099ee69b87f558ab6a3e9aa1ae3e60eed09b2990ceab99d4dc385a31b638bc40ec4ce73f742481121772bbbb21fd394d8807b953ba2b595626c88c98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576566b29dee639beecdac8dd06ef9a40
SHA11efe9293287282c418bd68ed1e5fa405f3070eb1
SHA256a4593b620881d265d8b6657ae196f5764ce8a77b49a7aa9600a43c2c3ace3045
SHA512439f86e78dc514c8daf3fcf0b62b4ff4515b99fb7c483f582347c25ec575d7862248d84dccb5837c17d80c7af3bf1d43e2b192fe4b4c1d9747e94afad151426c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff48df9798dbdc8fbe0655fbf097a220
SHA175385f771ff3bc981e4a8356c76727dae3136e93
SHA2569d99653df0ed317162012dc13a81bfd0bfd4219d93cf669977df15282b14bafa
SHA512b8e7012624bc30df66a5b7123c8a7c442fe0a8896809d052e0a4d48d03c4254bab010ed925f0b0fe29a37ef6da75b273cd913b6402097c09d76310e9459d3faa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578e54991f49d0ea748058fcddd22cd0d
SHA1f040ae93c45818f4bec35dfcede87159497b4dc2
SHA256ec8321199d57f20502902dc554fdbcbc103015991519f50fb94bb1a574ba6079
SHA512097f9057cc539897a7ee90d34e60c6d26628848d75ed9e1e9f03298452dbd1ec073cdfa804f02ac8ef734d5e169aa609c6f2b8471affa789a4d8dc54ed96466c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5073207f736c73ef05d120f6517e3d01e
SHA1a009149a371de5b7c8e8d0abe3bce35b3a01ef7a
SHA25631dd05935165ec4e49dcb9742dbb55003a4686a6179e9030d20328218fc946b1
SHA512e87c554611914b246aaa1356214439a80acbe28f56fa843cc358807a1e439f139c739b8aa7f39bd46e047ab0afb7f258f126e0e7a54ae065cb9f29e85f9c7bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5146d39f837027971617c56ec47356f0c
SHA1585513d4dcaae2c61621e73311c63052f1f7507a
SHA2565b7dbefd05e5ab0659ee66f065a4a353ec893598cc3e95dba5e3eadeda3fe40f
SHA512d8d8199d2538a7d4152961b2bcf5e1176fe6b28df90c3d087a28eddf3ef62890b71012ea173d66a55eeffa21222ea18ed37c47502b6837370f562debf1f58873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514867b21397fcba84034cbeaf0954a96
SHA142bfa6d390e95d127adda51c159f8f90924eb1b8
SHA25634c938ac7c4a4cbaaab5f3d8d10c743ff51e435dc5f086918c0f64ba25167ba0
SHA512581fbbfd3e9f374de11cb71dbad61eb3aa1ade1c9528c90e98099d1ddfcb7d49ee5e8999e246139b9fb9a910110a64ec6f2a77cd06fd804a3a6a8905275d906c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a