Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
b3ad0e31462d61f8cf5df4f923fd8ad0_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b3ad0e31462d61f8cf5df4f923fd8ad0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b3ad0e31462d61f8cf5df4f923fd8ad0_JaffaCakes118.html
-
Size
867B
-
MD5
b3ad0e31462d61f8cf5df4f923fd8ad0
-
SHA1
271fb7188a4112d009df8e6bf5c6054785bb4bf2
-
SHA256
2b4d00c535576cbe4002861bb79bc3eec167913a0ce41ad2881765e23fb53618
-
SHA512
1aa7f6db270b5602b5201348a256e9d3da9a2a8a37c585c35def2153035e2a2e9bf56afb63a1d0d5d1ab523ad9e59869a07c6dd974c88bac76adf133693fbdb7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A9579D1-2BE1-11EF-AB3F-D2DB9F9EC2A6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424705211" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000d27b79718a7df243c6e3b58d0e6ddf07e581d1d8dae59c0a19afc26ba0703e4b000000000e8000000002000020000000f05a4e4a1d9eefc3ba6ef8b85a7f840e57f70579a4e2516068ce342c7e8b53fc2000000039bec687c876123e47c3242ac51dbc590c2e1ab7d711496d1269be4f4d2dcac4400000000f41c6d4020bc95307cae37bb9f9ab28290dfe6a1c3747a2a19787d20d613f58faedd5e2e5f26a97b10345ac323685f56f268905322377e5a0c588242ff8564f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000079dce03b2aaa8a3ec049ef8d0087f4787d051512bfcfda013a21e6d4f0196ef2000000000e8000000002000020000000cc6c2cdc231b9c37063a7923620f22f7cc6339aec5f4f9bf667a50cf827e62f990000000b6b3b898b114da10226d522225f7f35c5f6235b25e8066bd47788949d09c3e703e58b1b1a3510c5746ea184cdc939eb2f343ee7587a06adda6a86b58b0537c15f15bb2ea99fa9bcd5e48f597b078de9ae1d9f14459ff0e2670ca513a9c9a91427c2743b740bec2c7608b9ee38522fe7f127dc2e1873421b6bcb5fa37002f17fa47a97aa8557c1eae2a0f46f833791e5340000000b85d4425b7d609ef569b2b117870f9f309802e1d5a50417e6ef22a8ed52ba2452472baa468199aa99fb8d43a6d9d4ca5e07026fc97b736e9f05d35f1d47517ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2067215eeebfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 1360 IEXPLORE.EXE 1360 IEXPLORE.EXE 1360 IEXPLORE.EXE 1360 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1360 2208 iexplore.exe 28 PID 2208 wrote to memory of 1360 2208 iexplore.exe 28 PID 2208 wrote to memory of 1360 2208 iexplore.exe 28 PID 2208 wrote to memory of 1360 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3ad0e31462d61f8cf5df4f923fd8ad0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52527d53115cf6bc889018c4dd49ff81c
SHA1f1fab0defb900f77d04fc0bc704aef6cfbedef8f
SHA256c0fbcc0059be5c75280c0d94ac8f48fda853fc9e688b494469dd424c87a00d0b
SHA512c68e58551262e3f0ab147a0a042b5c9db335116e11c0b518580bf09144a396e7f970bcad0c8522c127735d39826ba265dd3a3d646e6a88f4c5e79bcd829b342d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5989c8fa246929ea90c91cf42977c9300
SHA11c5764a57e1f69ef4a0cdb88766ef400ec27915a
SHA256337bc6993fc221d982207b048c26baec99e4b965b66f375154461e4e42edc270
SHA5126d116d09cc08824c5dca98ca1c252c973c7a1ac3399d4d5a150097e91f0d832891eaa2a817689e47949d7427f5e9c0f3ebc9e883f50058075b681343382259a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfc95bf9aa1b53332bdd75f1b27e2f09
SHA1aa245f3afd9e6a7c666162d7b40b7b13fa5d927b
SHA256fe1765f4b00b67e62265932b85304f949deccf32e4dbc329ef227a3145f73608
SHA512748ccd39f8c33fc89341e7511c91249c31c47ef78e637e610c897f28d51810114ea14098d7d2c1fda63031b3bf3f3e44d17dd1926ed61e4fc855446f69df6c80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c76d30c79c49f29bede2231b870b65b2
SHA14524e5299085c7002ece7880a931cc5be3de2ca4
SHA256db42aaedc8566e2846903b42365d103e86278904eafa09b371078a7239a0b019
SHA5121a17709584f29c1ffe340e3c398cefa9519c880a903604ff0c8e1642c85db695f88114974eaa607d5c0f684cc88d4df0035e38506c41009117fced8473f6a870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52923d3b159ad3a58ae65094512589138
SHA171d471781f9478ac1594c34e2ccce86a62b7c619
SHA2562ec7747f668e028ccf928498543d414402b59ac22c089dec3e074d5060ad2c22
SHA512ee67949ef99fa2d3abbafcfc6c809afad0fdb9e1056aa5c3509ccac87789630c7bb74923b22738f8491a5723304cb6c53d0084b889759a7b186dac542626446a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cb1a41a408336902f9b58688eb0d852
SHA1c316ffcd3dfea8425cf0f147e21ef602d2dc50ab
SHA256c930d438cf5e6157758b3fa92c8d30d06ac5ab37644e0bf1eae69782cffa0736
SHA512d227848c7f3ff6f98031c880a3191af814dbabc841e4a360b9afdacf2b42a6a21198176c2b264f969a96ad34a3ea4e9596d526e889f00a76488f90b3ebc0bc26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee40baa3e815a3779fa7239031d12229
SHA105a95b206188c45ef9a4f66dcf58b600689b51d0
SHA25653186974ef4914dca39f066dc5cf97fc10b0ed96fae596ff8e76204add97b4ae
SHA5122f70447571fd790ab0d95775f98cee78cce31fb70432e3e8f62509c40a40fbe0e7822e440e1b85034a83a936146eac9abd0673e2acaaea2d91c1940b316981c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506a4ddf21f235c67a47a22fc2cbc257f
SHA1b7ab477ef12304a787cd315f65c1258db32db710
SHA256e307dba16ac28aedf9e7363c3b1852b444d9a5f979c83689a5e992eba93cc67a
SHA512b2b53acb84e915bd5719f52b621afbcb5c215470ddcd8fec9004a8631a43b42a2a2f9a603a48cd574d18c1e7b8566a8015f26e7d5e9b7a75880293f367416c88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a39d851dd5d99d40bf757c017e5e9354
SHA1270c4f528ebf6d46edae91526d9fae256d69a7ee
SHA256c3d455514d806343e01439fe1b210b206c034b2acf4cf705f0551608df07711d
SHA5121ab44bb0327f99634dbff94265180d0a4e73e0ecb02014878645f13de3fe504382b254e657d67d578e87c1ee85cbcb831398c2e44523a9272ac5b2743fb6b437
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a71d7c5cbf127fd3fa897863d1bebc63
SHA1f5fa03d20274d064ddddc4f6d77cc3e2e6cc817e
SHA25619fc7ba2cc285baf49fdd3952f2507ca565684f0a29b90ff410ea7bfd75cb742
SHA512b1cc023612ce6f9b14c9c5d187166b1d651aa131fab28aa1be23b93ebfaa399da368b8798a5a7c0e15cce5a3585aede2712f6fe0d91331d78b48549945d5b4f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a11fc98e8edfc4d12ebc6eb5190321e
SHA1d2cdcdb1c8b42d99666cbf596fcbef49f4489388
SHA256ea569dd698cdced75be6aaad9a14d30ecbbffa853c004f87434833978805c7d3
SHA51229765421921f40cb0291d9fedb72064829ad880b84781fed4ed8306f89ca8aa675908f681918b558fe47a7ca80c35b89124b863cb8bf6f0abef474caa2a8c6e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7a35c79b059fbb8e6f69932674a6e9f
SHA12abd7e79125fb816f9a8e2b30b5e1ce4fa5100f7
SHA2568e6e4d04627ee20454ec7a36f367887c017681d87533249db839dd7e3c3d1fe6
SHA512f949b336809d295105db8c9be12e88f57734f7fda8a5fb915a2ff95aaf67503330409ff7b84701049e389abfc8200ad58d2ef4eb8cf670d8be5b3fd783aaa173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f80bf8bc9761208022088ab8163c595
SHA1432a5d9184429141727b9a95863af115b08424f6
SHA256709ddcef95e9a35435724fa2691d64e7a39cfe98d91b893a92a4de96995d238b
SHA51297d77277b6e8cb9fb3793032a79394d661ef7b298a1fac7614426d8a02bcf52284a082bfb982dd837bad4ebc748fca0349dd5584c87bc2f7fe4875d220376490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55051f1e7ed37cad3e5b01dd3e2195bc1
SHA17ec484d093aa86e3e6304e74ba744ebbb714613d
SHA256d995b4f63a9a735fd9018aab74e1aa9b8fa853f7835fb3d77f674c6885817f78
SHA512d6df1c1a0122fbcae561bcf1098f456e771783845b5d38d8fbf66e624271c46ae110faa26f0e24f76bd54983e8c13042bc66d4387dbe0a70fba8f866289158c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5522f1d8fbd9f0e05f8d3129dec84ee55
SHA17c812316adf5c4207315d6cf8d879546596f6eab
SHA25682797e4223e20259e0d6eebae725381d2ddbc2f3c5c3fc2a3a8981db1d455620
SHA5128bcefc7443986ee338395cbf4cbe327758685f8d34e376699d364630b0d481d28e0143f7e0b2d8e717001abfce4de0e175f8f8b58010bfed8172d2ad9529efb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f5cf93a8f1acfd4d852d7815203852a
SHA18609a266afe1cc3fc6842fef885c50f0cc6744b6
SHA2561943ddd83ad751801379c94975c87c8f37eab8ee3557be236d76dac12e2dbefb
SHA51224b848b16847a7b3e8aff72528890f4a2d1d2f9e76a04b59d7aaf8ae536c57585eb8838f5771b3eb4511a59789638bcbef3261057506da301cc4a8b183b7f756
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569b0a5d0bad1c801765e12b1a2375a2c
SHA19a4a8ab14943c4d9f5ba64e03d605709076251ea
SHA256be7f3000eccb96054657067f4c0e4a38193a4ad6dcaa750188689d387602a092
SHA5129d0f61886fb25ab5f92d7c070b0c0f9ee403cb3973117a07dcdc76f10fc71b2ebec5bbdceeaf912b19752ea92d0a8d9a0ad87d9d90572364a7348620ece4bd26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52db794a9cbd7e1a6d05488bf251a869d
SHA1b63fa79234ed10d11ece6ec143e21bc9b15274be
SHA256362486ab16272a109bc3dd25367cd24a01b0b95a95dd4bd6280ae249c5b02893
SHA512fe2ee708cab70b12990f02393cbc586d2c37896f42473b969e7475a2a2006009e2438659696337b2b4170001b60396d7dab31a111419195417eb2ef3a6e488c7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b