Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
b2186e2c9b83988abd2521183097775a_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b2186e2c9b83988abd2521183097775a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b2186e2c9b83988abd2521183097775a_JaffaCakes118.html
-
Size
738B
-
MD5
b2186e2c9b83988abd2521183097775a
-
SHA1
36b38df4eecb12c67384a5423c03913b20d72a07
-
SHA256
3eb8bd885ce594bd108557aa555fd8399a903ffd72b8f6d0645d8eac6bb7dbd9
-
SHA512
347c9737ae28165a611f3faeff66b97250f6d1bd446bc666ef3b880c10aa159e115d3de26d2e22a2988bdddf7b072cd7f626f5fcdb822719a23528e31fe5df1b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424680542" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AB8F031-2BA8-11EF-AC6D-CE8752B95906} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000c72448a812f73f5fc9338ecf8c86600f411a7fa1925e3db0d7d1b9d3b4e8f481000000000e8000000002000020000000155098106c1db8ec49a8062da37135a336341e565f02faca2887112d61be4a672000000004e695bdd343249aa1f2c849f4ae5dcb60c3cab56322a2efbe095c41729bf3ab40000000ba5878f9c46423483aa4b2de45069d1affbcd48d99c0e11b25f6e6ec1636c12258aa40610ad03328c53663025de72ffc897f87804d2e96fd978c22c5ba01eb06 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000001fabe5f3e623dae8e4e753f534f06e1387c528cabf01bb724b8a5d9661385c73000000000e800000000200002000000094a86d0353f800c6ce8202ebe327400c91aca3d6503bbfe8cb11c188f7c5913b90000000fcd4bfa81203659a13e82b32ffb9679693c1b153a5e62771ad63696525400aacd7cf7eeb78af946eb88cfe301fd94ae34d95bc6934914523954abe686d0536dcebe974319bdadcea350e3f56b201e75bd3a2b861f5958e15e0d14e9a96d5608b498c3242fbc9b6056492814c121b0b122cb16b341efc5372257e560d3dbb6dfe56006c1de6e8b20f9e86c61f7b10853d40000000b74f74ed93c586e906ea1e5a4c89773a051c6d53f2f409b99b1b404d5456e72120bc35d59a6faba6bcf1fb0bc037645bae75a8475e2d9cd772217ae2382ce188 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09239eeb4bfda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2252 1936 iexplore.exe 28 PID 1936 wrote to memory of 2252 1936 iexplore.exe 28 PID 1936 wrote to memory of 2252 1936 iexplore.exe 28 PID 1936 wrote to memory of 2252 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2186e2c9b83988abd2521183097775a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f90b8e9d9e4f9fb63cb2d944a51f362
SHA1ee7a670e8fdf73a8e8722cb571f87903b6db0225
SHA2564710463fed08be51fc314e6bedd3495a58ac4348c4f05d5ec9439e59aaa98efd
SHA512cc983083e410749685a70d44746cdc1040f0c66748f45141c19820c2b3ee1fa322909d06dc7d18bd1a18261c236d35783d0bdda83bce8f0ba6cc1f1737c09704
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580740d5335859a7ba17c1d9a1f43037c
SHA1cb84f3fada72683d97aafbbe3b63af45062019f0
SHA256db48634f9e78f754bd2570a4d226db2c7807f99777e63282df673ecd8878b02e
SHA512c58bf3f16acce09ffeb72013eb9018a63d1118efb6718f69c824710d43743a727782f9bd1b618b34d555931f0b2f0125b8a0bee9ab0cb47b4ccd17367af6de5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddff4188a87e5f33b591734094ab542c
SHA13ecbd1642c67ae741b36156836153804c14fed25
SHA25645c20d3cb34aea16361d866c3d07af8ff5d243a9778407bf7ca1d36fdebff3c1
SHA5128a1ff5d2836eecb7171b4ac7588e29d6e97f72860e8bd5ff2ab05748d5c69d9f96a88f84dd1898887c84d406e2d5a124557ce990095a726f7a0898b364b247d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5480e770add7662aad0caae99a6f33f2f
SHA1d279581535d517ae5008f5472a6e8042766361e6
SHA25622bd43f6dba4ac5d9964e76bf34498128b0d88beb514cbdd6b27bb28b13e6919
SHA5125b1e1ad9c537a0992f5488d4874c05359f92766389c1b8fbb898999c78d5733411d2697c82c9e34fd5fc0341be8213ece8a4484d49ac74774aeec3a2b3af1b1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55629a04736d9146bffbb1e7b601cd118
SHA10e14b170f4ddd8e9250f01343f65c2f7eb7fe0bd
SHA256197b64f011a125ba46f093533058fe17bba5403dc1a9c46e7ccf83e62ca445fb
SHA5123739e6160c5fa8baf0b065e5eaaf17c27ce5753db6335292ecc0035ba48f1e31f674eb4ba282096fcc678417d78190d67cc47601848be1891ff5bcf8c4f03a1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524a5364df1c1218d7f63325e3da7e548
SHA1a122b7343a3d6f0306bef521600d82a461831bbd
SHA2561b69d65a8e692bc620288562eefa1d03c616dba250cd368f2249ea7897f1b244
SHA5127c64804f87c849103f0a2643fcd63525ef51709507fa2ac6c5770e1421d05b4b02e60d1003c6acd5d7c012f76a49e2cc82943336d99b367c253ef27d56657ada
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5656e47deefbca80647a0b7668e238a55
SHA1675a8d90d69c95a92e75ac07db00af3ab645bd19
SHA25603bc9f3de71c905a2f1da96641698c0b5d1f7dbce7296922c5a321b073e14510
SHA5122938b4b8ab108d0043fe10bb41938fcf358e175822a616ecaa99d62f51dfed6362f50e125b0c2c3868a30114a9f0105038c34d3a0d31493d27ad4c800d2e2064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b9a4dbdbd0734e5f0498e6fdf550bf0
SHA1a9aca697b1f6f603348edb113a64350edf7b32a7
SHA256ca9586276a452a4cd1ceecaf814e74b489bc99dcf721fe760d485f686473cc6f
SHA512dfd16d905b5bc401722307700bc0711a15030eb367210d241ed3b7799735a5049e0be08f7fc8a2418fc242e36ab691bd37fe08a1bb8b534324175b204b2a9c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bfe42def18ec9d9cb20a8b50d9b9b05
SHA173f18eee5eba7b3861d7e3aa927d7c15a1863632
SHA2560d6ea403feb6ec3517e595ae7bf8bb7a92acb882a6ff22941a11c05ee2209081
SHA5123043655222d64dafecc2fd9d763140faef87dca859752fd45034bba40936574f1421106f4eaa700b00c607a1f7948ae4d730eb963fd09f0161922b1577cb56f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b56bb704a2898dfb1f08b98b634358d
SHA14d60e1da8740d14f919a2bad465a206b3cb7c94d
SHA25692fe84cd4ca89181c5fd0875c9769c3d740ee87efadf209bdbe9030cfda5bc4d
SHA512cbb6b9fc58db21f59511a359599d0490e8056ed709e0a9bc0399e1507d40a1606c4c28570dd0f9c0076161d67688cf466dbbfb36932a3d70f154b9a03182b66f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587d106672d782c03d2b2685b876bef4a
SHA10aa7675eea03511c4f79607f4b186f3f05551f3c
SHA256537d0772ac65193910126d2408269bd810b00c6b13e956d2443c7484c057c637
SHA51229ce3324310883df31c2881b6145138d81c9aac7cede8df34fc7c35c3e887f36bc0b18e3238d810d307bc7f464d18c7cf842d922da82758126fe29ea6c34e699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5075169b1c1e57af96f358cef3d390027
SHA1540c126000e1ff5261c8f9e546ce0e4de9b39293
SHA25669400943066a7a24133896783b096f1a72987a2ecef7dbe58a7b5dfedcfaf5c0
SHA5128c77d7e05c1214a5536dd6e94ee7cda8615cbb8c80fd7425c6edb47c390313c69fddc6ad6b52a4ea975b984ffd98cd8d3d63b7377b14e1ad5fec4b935897b79e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fd5cfda5ef7119f52b4d016d6b319d6
SHA12b051e73944b62b7f9f9121d4d197be1fe93654d
SHA2565970dcf91127872014d3f631aa001b5fc1cd31b7366ecbe72cccd185fcfb654a
SHA5124baa3e34a6153c7c450c0501e505f91e4e9de887fb6b1e81c0c8b8a44988b3af555a99c49b5acadbe01eb28cc3d5824beba9d3dbc9b6945e1685cc15924e2ea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efbeb45ff57a564542e957456635ae56
SHA15223839cad8add623b47bdc24fb2dcc2136a20a5
SHA256a472697a4f02f2d36a4a4566973ca03d8257043eeed784f3065e78aa05e3530b
SHA512c526616882ae2141f9a0a4cd8f2d49fba1a2b0346986904f0a063e06d5afa4b128d246e637da04e73bc56606fdfb128a0b7c57ac8f38f4252230d9439efefdbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d92bf2ec76f28f0b7a78e610749b918f
SHA1a85a3e171bb20ab1fc899b65da2d745b17918e0d
SHA2569b9eedfdcfb22c09120ed302ffcd20b353bda1ab77cd590631c8a95f8d07ad9a
SHA5123ceff0fb53756cd988c030df5fddf1df8f70da433a4e04445a0d2c576e3bf3dcf861346e6abed3f2ed421d627405590ee3c91205cc02586c731307fce2b5b2f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c55db7aec373dae208a566dc8c1b381e
SHA1dca3d4acbb10884827a88e93627b7ca772756fa3
SHA256ba3122766eedc10e1915f90b99f9f0fe52bcdae839ffc29cb145fc1adee96c1d
SHA512ebd31335d356a784d6e505ef413d3a3aadbe2b6c4e74ee46ee8e9dd4866d46a9d7f61d4d0419711d3956bc47b12b410725e59af975cb2fa4c7780793724df55f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c501827a5be7d10514f95850b68fa2a3
SHA17eddde8fe9391a39105a398be0f54792790159e1
SHA2568827af3168e954dcd5ad56dbba39cfd98cfce39c916bb097f5ddfbb56eff0bea
SHA5122478683976d7493d3d1a84320c2fb24feb0276355ef6472089259235ef96c57bb4c41dc460133123ab9afbefa228a72498b9ea89614560264b29fab6c6cd3f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab52a700086fab44900a509b28d51a4b
SHA137d946b44602dabb0fe2ab937923fb179a50da4f
SHA256c3b68c63b89abd311f1292688eaf48b6888da22adcb67953eb550e9e0288fe26
SHA5129f67d852e0606faf3d467a596b8a6f0ef6ae6c10b12b83a1a0a1f84a3539b2eaa3735b26764bda9146565ceb09e3a5320b9a812379e3709bf3d00bdf51c917e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513eedc00fb4456876d5dfe052c83250a
SHA158ceead771b82b43ceba41edc88866822d5704c5
SHA256bca35f461e565cbff4efa0473f3b0348809e8c1352f91ce581f504855c46c9c9
SHA51276ae0ff2d0a8e72d7a722f88699240e9071f0ac23bb56c53726d7d3dd9e4a3710b2c7d712015f3027e50382f6812f74f398efb7e38c3122c68e47501223730e7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b