Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
6fbb86785eb5f6dfc51a63f7286f28e5_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6fbb86785eb5f6dfc51a63f7286f28e5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6fbb86785eb5f6dfc51a63f7286f28e5_JaffaCakes118.html
-
Size
788B
-
MD5
6fbb86785eb5f6dfc51a63f7286f28e5
-
SHA1
7a34d32af98afae410dfe79bcce30cf76d7f82e0
-
SHA256
4b32c9a078017a3ea2af464d3ccb4fcbdaa7642188ce71339da2d4f91ae0c9c8
-
SHA512
a47f38b8764dd91a75fb0758ad48e3c3666b729cbcdfd3d107a865d15e61b8c8c5c7616df659df40cfd8e6267c718e0d4db4197c213a71faed4eebe025d217ad
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A2F9711-1A0B-11EF-84C7-4637C9E50E53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607fa70d18aeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008b5a51718420df28af745a9f39db14a7f2459f91683d7b406e45aa8c04fe9bc0000000000e8000000002000020000000903ae01e24ac5205bd00c6480a0060f36e93cd45b3c543209b0653ffac66669490000000dc9e95de8ffe39d2a1e1e5ff1a726a21f2d5e5a4385920876b5da266bf6584073d5a536fff658bc77b1a9f9aa54545498573d281d998bc228242cf2bebef8fa04ae999670ff08037ddabc5b3fc97303f179c95499a73b2455a215f7b9c3fd5aba88fd315b65fbb5dac847943718597352b8dda5c95e08e85b347c815890e77e4d4c8378b6eac4e5e7fdd516de0dbe0e2400000004aeba905bebcfc8925055cd8d4d928dcc068ba9f130624a51b95f3567e1354f219eef04f9b74992e3e3e2aed86bd38ef9bc6d9466d57088a1affda44c0373b15 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000b295bbb568e983a90c7c9188536bde8666f29e4e8a19fd637afe15e5e71f24e6000000000e80000000020000200000005cafba9db966c917c5765a222aa08b5e52b8fe8a413bd049523a5f9aa3dafca320000000b1f89551d4484e77db5e6a158faf4257b2b3e6cfea32b0bf6be5ab67a008ed14400000004576c731c2671b9b27f8e72d2961ebe7080f44e2c5409fc351759606d0f081d1997bfda21a519c29a88580099ca720a88eb7adb943969697f40384cdceefa2f8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422743993" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1920 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1920 iexplore.exe 1920 iexplore.exe 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1752 1920 iexplore.exe 28 PID 1920 wrote to memory of 1752 1920 iexplore.exe 28 PID 1920 wrote to memory of 1752 1920 iexplore.exe 28 PID 1920 wrote to memory of 1752 1920 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6fbb86785eb5f6dfc51a63f7286f28e5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58491f5cef5247ead5287e9e89e508014
SHA1bb110dde51cafd32032f0f97e62f0083f2602994
SHA256a4226176096817437bf90b474e36e9a8619275f5a4700b2b04986bd358f90258
SHA512a319229f1047d60f4153d498feaa32a8c494ee6b268ccf61fe97f44d7fc4276237d00b2f8cfc673e6b4b7d6befaedac315e525c84e4868b32b41f63782771595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d2c283722a4c149195ab48c1935f533
SHA10a56a2ee502a529d4cdefab7d9afb9833962d2c9
SHA256325d0e07b6b29bb1e56b8182cac543afa40cb9c1b25d49eeb4828af28fa1f75c
SHA5125be877f460ca28be6239f0bec2fabb1f03d9ac53fa9a8d63a33864acd0923c6c322e7b3ba594dc108da53c3da4e7e55e2fd397addd724c7a94b7945b70303eaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e30a7670ad65f1b509f62388a0b5653f
SHA14a2e8aa5760e374614e4136628a602f79545694c
SHA256e36ec2f025f5c9de8fc0c94f7d60c460f746dec316dc35a6b1f6a05e2d10c355
SHA51269cc4d3d12d1059ba23f35d4728f88ff8185c040d7a132deb76b4b08428c9f1a9c0369de8e7db3d82cea1aa61a7cdea846fa80e60047cecfe597d8c00859c090
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5241fc76f8f185b0d43ff7ab7533135d2
SHA1b49e68b4cb986550a2cfb2f093a26e10bc9c83b4
SHA25639bf95fe5445468fdead51f9f918cff41c12dc9e8aef7b3b27407930c9b9e302
SHA512dc36ae0301389baf0de82fba110c475a2e22dcd5041fc1f741743032fb25498ce31d61f8804c25b9a4aeda438de1bab7eff5278943b5d6f6ed566a8977f7ed47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cea5c32975d4832b1e3abea94f0ace6
SHA132b26e6644903c9de43c8cf33f1e87e54a5f1c21
SHA2566e4f68448c2834a23f0e8af4167ac0e7579769672308883d63a760f7705b9c07
SHA512019991fc0e6309f284cc0dc99cd7953d0e3d32756c137c723415036dbe8935a3ddd2da97d2e1c6e1825618f3b86bf2067cffd579d396e4df8e429075897a2934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525ad394549ef509b4e9dd5f7ed002feb
SHA1d03690add11a1a85e1a850c2533627c649170925
SHA2563e3c90a5a8acd4fa92273789489eac8facd0af9982b5851c0d98881e1bdb3d79
SHA512d3c69ec52da2a55336bcc840c41aab031c34f47239f7258a7d05334c2cdcf66fb3403e1c1461acc8b3a249211339321461c215f014505843604818a0d06457cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ee4a7113406df06eb1d8e727f9391c
SHA1324243c5e0a83bd4a9a818db18bde095da658012
SHA256818687279b7f4ee7916768f4f3f83aa37a35a50a1f1abc6d45a790344097faed
SHA5125465a1d89a7f4fcd00f6847dbae6fd7ea2a6899af81af7e7f84fdcf6c81814629580cd56241221110766d86653fdeb24011ef16a931a2dbb2c86349e2e6bd40a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5529702367e759c2cf51593f6ad259863
SHA1edfc0ab90041678a73e11e5ab222fa13af6ace20
SHA256f674fe2e5883bc11d1ea5c557dd67e0fe76b9dfaff194f008e7d01e8fca3d701
SHA512626ad26d9a421127e75e5ddab1cefcd3fa38eb759dafc96ac1ac72dd4b52ed549255e8c5d5b5de8c08cff8104e718ac912c4bca2877931520415e69963ea213a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57743b4186a84887f8c47d5547db05dde
SHA143f9ef02edb9840b01ca4a684ba9f5d934bb30c2
SHA2561bcc4b22c5c3efdfd1cc6a8fb196c47acd39c3faae26a8680df90f54a7dcc3e4
SHA512abe5ddae1b684e35b30cd1575b233ad4e3e05fd7b4c70f7f588bf3135b8b83ba89b12a6e9c32c3aeccccc4803d73157cc121db5f637e9eb511695e5e5063bc2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5861b5f6ebebe8924aa8878694da96b0f
SHA1f0f9b41dac09922b333581c8beadbe1844f4508d
SHA256234e5b759e24da836b08e6304d509bec479973520f96f97767c6b2eba3199263
SHA512b17f55d7ae914187b71c5be93cf693ffe59e70231c03e37a36ef812c8ae9895def746970db1779bf8992f4c690aa13a7b582175d240b993f2753bf4d61e9c76b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf2c73a69fb0aa832046cc9a1e14e20e
SHA1beb18e7f9169d1370696bb5fc20840dee5c80da4
SHA256672528f476196515ba9504a5528ff40c9f4348f66bf0539600710a7ac3eda247
SHA51259747ae7c53c1e58ae497eef5746be5dc0b991e6c4dfff8e05b3731f09d2d088a31b7c642c29b47f7edab34e68b6018fa4bb30b85f01f3587e533b7cd2895249
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51791668917b17332d83eb82db28941b9
SHA1a24b0e915b0304f25c8e8af6b6b388919b2a5dfc
SHA2569df13958094e520c6c2e9c414bc7e586f252e59f974477d89a345caf453b46cf
SHA5122c50f3576ce7f4752b81ac1e27d9db2f9b05775e1bd00116ed0843591b70d3fd4096318530a2251352d98cbd7eca631726c7add2ceae075eead13083744ea384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4c050f5c63f8667a8dd237d05ed77c3
SHA1c43de42eb0817127c6cd886ccf1653d2f7c9aeeb
SHA256649e1bae9033de22e60a042a4eb1f612c9586d709f93fb7c894f1ac95fcf9462
SHA512fc6cc7ab0846e50e634e973c89f95ab238d5c2e6c6e8626ddf355b907d148727a692011814796dd41e146fbc6b691a2f9436081c76c4ca131de9f98415ef8bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e35c9c15102abbbc73cb2c6b2a7c260b
SHA1569d285bd9457d6f2a2300640efc415d12ab5818
SHA256a6ddfec2923ae53fbe6f18b302f9407e3b85edf954cc1c156337e77f0c2dddb3
SHA51262d4ca25114e322338e918c47fe40d07e60e339838b9b1307a1e759806531e29cdb05a497a33f4fab822741c754bed266685ef8b0a14612cf737d08385278c0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e0c99bcfa01a9c4fad451d2a0f2c601
SHA12ac4e4027e98fc9a9f1132c71299331de0212d91
SHA256105252e34a999f6f7e3cf9d647440e2432d1c09df18e1d37443ad3f1fc7a3467
SHA512bebb42b29b6160bff308cf89ec7994c478de6f3c632e98b21ba58d42bf92703d4bd5c05193be10b85641b5acb1e8199a028b9f3f087f126e8453f70b225ffcaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508d01ac720cbfe870e0538ed23f8b19a
SHA1fdde4870df09e2bae97e1f559e747ac8e4a2259e
SHA256c51978a2263d1e571f78efbca753c78cc2f3f91e87358666534b52ce0ceca387
SHA512520bc0cc512878ab816608e04aaad81f191bb0ae32435506f62f801b83d087c91bdd2f582352bcddd45ff9eec38b2341b2e0c45349e573b86f4e5e8f13770dbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea2ed1b4cd17922ce6937f1a0cd2cceb
SHA1f4999393fb7a01eabb0899dd06fafe1dcfa46c76
SHA2567ce873d7c6b7fa9556ea20fa34a3b5cf23fdc2b1435c35dc6b2e163fc6cb3160
SHA512a094436c42b6d2f6a81234ca5e350db99caa90454070c3dad319999968448710be111f6e9b77a48deb95784bbc98e49db6ab448d3e337c705c38e88db2cbd38b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad2e55fa1e6f1f378a1cdeefde0117e8
SHA1ce1e9865b7c02b672bd2ba20fc86ce945f32fa33
SHA256d432b4a5f36114808b67bafe8ff2aa674209448b7ba866a52abd153749004605
SHA512c8e38948a97bce9609282c899970b8463604b45d9556909e64667068521b3e3d01bcfa3cd129e6b428f72f7d00b0433ea7adb0256ce4e76809465ac45a7a5359
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a