Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
b39ee5d67b6e8b9c7c28bad417805af4_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b39ee5d67b6e8b9c7c28bad417805af4_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
b39ee5d67b6e8b9c7c28bad417805af4_JaffaCakes118.html
-
Size
134KB
-
MD5
b39ee5d67b6e8b9c7c28bad417805af4
-
SHA1
abbc2c68bdb53642631f126148b52ddaeb5d7925
-
SHA256
20b04ca620b90173c959038d0307a9a7afe2a5cc140e369b639d8cda6b2556b5
-
SHA512
97d14e05986d37d90c55964aff3c3433ee9663b7aafad303814805eacd5cd8548e67078ac7f64c37d4a21630f63e9d79d62e2bb2ea5e460ff5bcbab16f8c2cb6
-
SSDEEP
1536:SnNlb93yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SnjNyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424704470" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000008ffa17ec26a329f8426e485cad36a1fd06aec321ddbc240fa38335ae80b9e463000000000e8000000002000020000000d8f5b9f0a80dd1bf4070e4d69d5d3d364ca11e645957ea9facc9c1ce20e27d8b90000000de1c0321b7097718a2e63e06bb49701bd5bcf7d02d9c9705b8cbd23f7c7d387cecddd983b4a4c4d43c7a9d34748006990f3f757466558d38ce1a9fc08e6fa4dc503f933eac9617b34d9cebca1d5a69a4228f38841f701551987814cb6ba1eab2d545668ddab74a4efe197ea1d1425046ba76f8279b7050fe04862624f57710f7c89c76e487bceecfb6797e9500465a3f40000000d78882ae40c5c613585c107198c1b013548e2672bed27928392ce91b6f0af3be03399d4f9742e8895bc37751a7bc8b0087992f38abea3cb341e6572cf059f683 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c401b5ecbfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a36b449e08a556efc19512eae4e627694213b091af047b03600c969c947b120d000000000e8000000002000020000000fe2473eedb67fa0407b3cc07acfd75c9baeb3e83a39db2d3aae5036e6ae7a626200000008db396502bcab6b8adff0acb504617296455b75fb0bb8f8481dbd1ceea9765424000000063e5971814aa18009b884007848ee3133fb0716e73c41bb2ee88de795070042d58e404d6b2dca00837f81882d8411158f60b94fa48259a9fd887d0bb8a4712d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF9E94A1-2BDF-11EF-AF9B-7E1039193522} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1176 iexplore.exe 1176 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2936 1176 iexplore.exe 28 PID 1176 wrote to memory of 2936 1176 iexplore.exe 28 PID 1176 wrote to memory of 2936 1176 iexplore.exe 28 PID 1176 wrote to memory of 2936 1176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b39ee5d67b6e8b9c7c28bad417805af4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bab87e6fccabca3acef019b87dfc54c5
SHA11b1d1c426a08db2bbbd0d5adc15875e2ea31a07c
SHA256c3799aeafa0fbd00d4837db8c9d9cb5dfbc4a84e88dce9a5c1f14007a4ec42bd
SHA512ee178e08f42ff5d9352a5c5ad07dbb11aaa2457b2f3f8cd51a90e558d46ba6104f663e4358def4d3ad492ea012ab02aee053331cf6e6a1cc585748176bcdec8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557b2a54c65858ca87759b7c2f3d08c11
SHA18d17b86f73b214a7e3acd1ebdd8f904e4b963066
SHA25668ecae933eededc3cb4349903565324749e9bb53fe359ae29f522e24eb8caa48
SHA5121834924dda5cfd058e384a04fd0a04fbd9a2f3647395ffe4bc2499b2f189a5cbda9d1f69cee5be2b90a86af0354fb472e96e6259e6d874adcaf9b21c875ff100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567579305f2d1617b4b12846f7e1a4e5c
SHA177e288a6f68e2e6743d2eac7447e7f3083851a80
SHA2565f311eeb843248deece75a46549483dcbc0d21a4a0991191509860550cbb2291
SHA5127150577aab10288fb0826b9a0bb6a5343faa17bbcce041f470d10a4c1ccb874cf9e13b9999642353fce245949693c002f6da66a68314a02325bc82f310aad680
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558dfa644ec81d485b7c49b1461fb7b51
SHA14f559d6eaf970236712fbc7a1ef78a77af5fa2e2
SHA2565d53dadb4d140f4345ffe58ab0d281fb9f00ea5f8314139d63836513c419bc8f
SHA512496c8efc884aa93ac6bfc7f55de4aad8ecaae8ca5b402fff47b5115f42961b3b8f8ba0dc8f5a2865d5ff6fbc7b0e33c14c8407954d7a5562a491223b48c797a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533ce35f47b7d584cfc092e5d02e011b8
SHA192f5edbad14033d36aff045c01fa190db9bb68dd
SHA256e9ba649968a1126c54f198d931571eb337cbad2c92f4ddbb922d57cb9d225a02
SHA51225c9318c4534a1ae084746a039fb28fc32b5ac90c6fce2be9ca80d065062b77fcbe3cd3ae65f043e9aadbe961019477ffab7ec4b9cf461509ea6739eea972f93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5654029f2ccbc9c740d129262c40173b5
SHA1d5047b25a683b9b369188aadd92a917a387409e5
SHA256eda78c342ef0ea7b0da5240550d05c32033ee94dc0d4435936cf7ddf3b11889f
SHA5127e582baba9dff8ee52b30f2b101b07d086cb1df758a1503f2adc080c0ec69375514d415c19a4f3fcf1bd6b45009a148f97153e390a9d9c7c291891a57f3546cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1dba7b32dfcfde2f53d5198e28a88ce
SHA140c708f1fa905889a9a0490c47f7b711318153d1
SHA25621a8236350ca23873af07e02033d88393e7805c7690e473fd00d947ee392a0cc
SHA512acc93e27c9d42ea5943ff12a588774a066d509211aa5e5c5959f910d887900dab50029694a213759018c704ddcbbc3f3de539b3b970a8790adc33cf17b774665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5065d799c549dcfba1906996a5529d25f
SHA1813a5162b5a3a472539c3fcc332dc2fb45751cd5
SHA2566a8d8731bb20d8adc2981493f22d4b7c8e192bea0b155e5f2991affa67210414
SHA5127f75ab30d04254c1d1f8015d2be6274412a5ded7bf6bbe2185c1d0bb871e0b289595b56fbaa814aa50e5a99188b7aa3bd10b80fe70c8397bd50d6d53d69c6d58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540bd18e169288aaca4ebf98f09170960
SHA138463ee064bcd5355d0b279fe9b629e34993ec8c
SHA25608c0b17c3abff07e77577dac53187ea1c3cbe8a0d9846d53364ffd38ee6256ce
SHA512fac0e7637ef5d366dd2aa2de31f752a1f6daf882a32f3725b4c9b8726b403e0afb840429871e5fc6e926581d5221db48bc47e875dc75099dda3ee537377da6f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6cfd72703b882428e6f20ade87be4ec
SHA1a98f6194484edd498bc69124b0be51b7f9e333b3
SHA256a3e77fdb42de35eb4f382d267f4420042df8c68f509ebb4c53b140951afad538
SHA5124e7a9522185557e7e5c44e73a56ace01734211903334c9453a257b72125cb5a02bc0014cefeb625e0f31ae437a18666166b290bfc3a0bb79d9cb67a1a2858b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5a135118d2239906b6a89d9c569acfa
SHA1ae7c9ecdf09997c84c6293d0d7486cea07c70199
SHA2563513fee1a858dea734ddfdbaed6bb9630ed61cd9e265aaa8c85d1d48bcdee3b3
SHA512e66ea124fd6a05369804d4c90cad9f21dc7a9d8288cafe65580ba455b43850051ff07dc32c27a77d7ea97ec7680b00437f168560f70f84b2620c5d0ec0ca47c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508ad35d9dff1a31eb54eefae72bcb7c9
SHA1105b580826344036718326101d165026c2027eab
SHA25606f62c5e3b1622827f2eb15edbf05b1e68549103fa3cb5dd5ea302d4a84b3bd9
SHA5128c1a0d178e092f2e8757468af85735aa38e1463fa7c9f6a85746da93e05c423116a039c28fba39f9ed228a96d754f38ad2b023c327194a392f9d7d699c82c04c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536da187e5832363fde61511fd75aa435
SHA15e420b68a5b333316fac1fb8d10442643679b288
SHA25699b455a6f5c583c03a4df8d745751e80088c1f80a43f7c50a8f85b83a6a8e861
SHA512c73c3341472525fed4f1b140af5a6268ab2cc8ba13c138222c411d7933eddc9040dd63726ff473ca093ca2a82a327ec21e509d827ec898605f40f45602fe4150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52627155f9484f6350d7ef2e6a500bdef
SHA16fec4cf5f574f8c62dfd840c1f61d4251c41f56a
SHA256c40c8bcd30af3ca56c7750f304353fcf0dd6615211eac21dbc3f975071d18d5f
SHA512c73b3bedd288c919a092b71c08609d997475cc777f89b78fca902015311918bcee37ad7bfbea8cbca732104095982209ce5e00c666a6d0254068ecac1ed6e203
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d50eda7451537f5191f469e825d4d62e
SHA19559a0ec0f7d36550c4af6d54d07f497b95997ce
SHA25648d287026a14e928c7552ff527448c400c9cf45355de80d2461e34ba6d956dc0
SHA512c58cbb9e57a855e7bba8636db18d759c043071223ecc6c198ebb11d79a3f26b26e60aa118c7cd029cb238717fbc0afbb34333b4c9d8cdf341b14559f573fb97f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7f9650e717011e3e133438670506aa4
SHA14c6f973abcddc170a58e487a3e49f0a6b92ed687
SHA256a64a96002900f5e6a17f814ae0f8f8e51a66d573d1a77ab73df67ccc97eff4f5
SHA5125ec7417b32cb1e91b4660a681b2fb678b42ec4904c6fd8aabd75170d76de0c453cf750e16cec2eda2059442e7893b013f4cfd9a7da81f18dacc5f06ec4fef134
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b