Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
b487e8585c00b989386e4847804e6d92_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b487e8585c00b989386e4847804e6d92_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b487e8585c00b989386e4847804e6d92_JaffaCakes118.html
-
Size
71KB
-
MD5
b487e8585c00b989386e4847804e6d92
-
SHA1
6a11033343fc94ff1656b12772f5249b2de09c8c
-
SHA256
a14ddac41ca34790bd971e71e65208e90762754e031e9a69023b7eb57718b8a7
-
SHA512
4bab44bb2ec558af6eced1505d96e3328998232c1fc30b1dec61a829a8082a3fdd8b65a8fc08014c4979cd2e2932084ad11db8f1f17d110bd451ec5af109a972
-
SSDEEP
768:JiogcMiR3sI2PDDnX0g6se6P4mLgSoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JovlLgbTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000af5c29e5ee63b86ac058b7c37faddd1e491abf604c91f3bc2e3db73060f367b5000000000e80000000020000200000004b707456a0573df11b2866a5d81d39a10e92ec6e318013b1d77f6d6604a4a07f20000000029c76399177b986b0b6a368fb933ec99f10adbd8e5b5a4fe8f6d2ff03f68a764000000062200c07f7eac7db7634ab11c59a7a8869e0cd463c0b76191da06e8096d365a367a3afe49e45351c2d54f6b3a6807c91e69f60c0fff1b6ef7a676d8a5f2cd9b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000781917671ae06ac62b2d304bfb1429a92ec9171442dc355623cdc18257e87cd7000000000e8000000002000020000000171bfe8a3f98ee705885f14301729aef2f646a10109a3a136c566e59fc68bd4990000000fe0b9dd2f8cdb88499e5ab4173c7e199df9ea737b90c2ea3821313ad618d6b44a15be2ad02e3559c349d6a5c4ee166a90f5fb0128b0ffe3cf790d4e4ace03cd096fc211a0684fdf65463335674d3e78a7b2790da26b073c2ee9b8ecb08409c835c4022ee5fc0b63cc34a862b5098a1ff7eae620b259e7d727d207b3151b386d1693684a665b8a52cb9218ac012484afd40000000bcd688c60470d0706b05bd2d5e6f8d5e5411fbb4c271d34c577f11a21894acefc75d88a3d908b2ac1dfaf06017f2568c9fb1343c8d541c194741b4dfe663c359 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424723905" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b8b8f519c0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2097E831-2C0D-11EF-BD87-DEB4B2C1951C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 1036 IEXPLORE.EXE 1036 IEXPLORE.EXE 1036 IEXPLORE.EXE 1036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1036 2232 iexplore.exe 28 PID 2232 wrote to memory of 1036 2232 iexplore.exe 28 PID 2232 wrote to memory of 1036 2232 iexplore.exe 28 PID 2232 wrote to memory of 1036 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b487e8585c00b989386e4847804e6d92_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb7b20fe00ad40a35698fde40065197e
SHA19867895ffdc0c824533cfcf1dc6518d563dcd099
SHA25622113bae5d005dd944dbea4b4859826b5106a115c8c4fa88395c548dc015a5a0
SHA512fda6c1b28d47a97f175e963620ef3382d861cde322245510104ce66989d4f3959a81c1a93676a2fda8903aefd1eb278a539b1db987c7ca0f483730d856c38828
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554a1de35eff5875179ecd9ac21fc5497
SHA15958119b182f7c3f8c1b06b7a283017e8c586638
SHA2560dbf9525b38801427c75b220e4e658be0285ab959087d4df76325a7cafd71bff
SHA512b35bddcc711556440fdd7ba3287ef4b34c1e8787190827d3d887edba76e466ab908c28d5e7b3cbac6d1e9cdce2670f64343b499e562c1c2c4ad0bf604eb7a899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5522238f1bc380d759714b3a930dbc797
SHA1f9143229ef818ddc60b083d2a03bd9d5e9e2d4e3
SHA25696d5c77f8076c4eac7a866c64db7c9a0bf9584661b5838fd414fdbd4bd38c68d
SHA51213f615fb634e6d65f17cc188185c98e1e6fcf1286ee6ec989b34de7b8b4629f5ffcca3eba657649ded2e12ace984a7a7d883c184f0e5eeb1f7f206fdc81a6363
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0527eac04c94d42f3315eaddedb42b4
SHA1a9093a5876d1048e0a85e57e17b3055f546c5aeb
SHA256a8bec283b434cf81212f2541250c677ed3d4c5fbf6c45ea9ea2931ebcf656ee0
SHA5129fc5b53c56e6d9213a263f116eee7e84dd71ecc264159a76b7ee4e57e9ca40a5c05abcfe59a04a75001bdcfa48f43014249224f12c963199217096e6b0f77b1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582167a306560ada743d10a050dd917de
SHA16ab7ad375a1806b006a7af3c70c8844f6cb9a025
SHA2566b1a0568c0c9d2de01db4c996589f1f026d3c7018b7d9641aa6c6f6a49e9039e
SHA51294864770b98f6e324fcde23a7e20d62cf139915875b9e8da12723453084bd5723e325ac7b101c1fa4362d98060709f9f911abe6835ac3ddcd3d3b2ed8c58a3f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c003ebf43826e15b128560cb897ad0f8
SHA1aadfea18684517f8e39dd2ab83c7f839aa7a7291
SHA2567f4b054f2dc05e4cf9f8c725add8362fd9d75da015848b127217042f64765325
SHA51261f8b3b1ee39995aa8ad26a01ffd2528b06a11f9a5e43643777be22e54aed2d1e69ec81b2b12599214adc4fb68404980f5a8fff3b4d5926367977d9b226f2e78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fa0c12d2d56d9d040800868aabbcd87
SHA146782b24ce646d29034c9f5fb840ad1d52cb5b24
SHA2566fd1ec8be92bbe63bb0c384383f9efafc247c8c7f04db1735d5238fa80aaed91
SHA512a690e37b05862b5dd21ee20f7b12821f4174210687afe68618f3ff97e9ed06ce31d50bb65af1a1676b3afa7633b01df9bd5996b4caf4b5295c43172adca349d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1fde6889a2f3339b148d622948b97f7
SHA13967917f1f313ec0613cd6fdb05cccf140759a90
SHA256c8f2131331534159a1d1d532cdc5094e554aab543498c4d839d6ac5f2f3f711b
SHA512b7a5a258ffdfb45194cfa1f6655a3e68f828f2e6dd62a2236b57accdf91e23a493165cb3525b3bbeae507897645d2c289a6738aba7e7c8ac02921fe2b638732c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55350923fd6eea99e20778534e3cd77d6
SHA1a3b4caf8830d9841aae4c67061795b513f618d97
SHA256431728cf13a49dce16cf2034fa6d9eaeb28759c4bdfd678a151835debdc0ea2d
SHA5128ae825746d899d9c8a28b3169ab4b5f651ea8030bc5bf5405e7774350f22f198d803dc32b9af3361139146c7780bb40069a86aab4a999aed24d45b9763d76e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52652f43443ac5d48000c0dd53e464441
SHA17da4619f48b1c8aecf1d6f75dfc1a00282df2c3e
SHA256c1e3f3c96cd5cfa72f7dfa0f7f33f1245a132cb53a2ee1f4236e9b664ef1a2ba
SHA51261851a22cd6501e75a07eef82bcbd9b52e8382729b600aa265c7f3774d8f4c35f57ac8d10d41b1b62f0f3795147404a11e3dd4484a5e06536d347d2163e14094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f212c85592a9aa8c41d5013a01cb292
SHA11637f55a055aefd37f18b231db0fa383543fa950
SHA2569003af2dd8abe7319edf7b34e01f5baa9ef467d6809cbe7b6c78a559e6ee3291
SHA5125a315fef029c19bee54000a09a0b8e0ede53c1a1a4d3a5174039e219d08a9a311594099bfbfa9677c8052904f536efed387d0bee80de4b770f7757a5b2cae1a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519299ead5b4a3c4d7f021ae936235622
SHA15d1f5bd37a229124286806fccbb65842e6a174f1
SHA256e50a2284e54d87a228e4778f574d29829827acb8a7f44b5dfc59ff0bb9b24bf4
SHA512559c8d882432f3f4083bccb0ff1138c9b101bd5df2809c011ea4fe4d2974a0b976610bc8dc3a37eb87cc92eeeecef7a45d5f576a88fa155f542938a805040ca5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f29c124be030060b7aac4ec83eaea1b
SHA1c55325f8e326ffcd75ba28cbba6270ff57ec6365
SHA2563babd79387df6cc5eb335f8fff86e214b2b60b62bd319dc2cc21c20cfdbaf7d4
SHA5126dffa0750081a9cb674c918a39c1f74d17fa51dcf355cc8b22fef29c4f4efcd6e4f11642353a5ea0fa3580c1698fe92f12a931d670f2795165423407826ed342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e1b24cf1fc6430f000e924a7c311bae
SHA1d1afc92d20ad174f54729a0459e8c1860baf1a3e
SHA256816e59f943137c1df300eea4180fdb9cc85005f3efe7652e5a7afad8383a670a
SHA51263aee6403b75705cead6a8fbe13e4f445185651cb5873bafb70cceaa6f3c3983f8f6adae570a0d8998b0e4b862af831864e660c121690c0982d111d84baf6fdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1e6d965e2fd1bf67e06ee088966d39b
SHA1135f20c9e1d0f2254dab69c01a661e630bf7d236
SHA256894aaed4513bbe3f5392d3c5eb269bdfdd70f51e3fd2d07529ef018c5d9e149b
SHA5125f468038a8c1a458ab1871318950109b5bccb1919effc809d183f4ae1d177e7645ee1ba28c144da3e351324c2151e8883cf31408d90177ee421791899e6b6549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c820b1b25a3f49e2adcd9131f0d14331
SHA14ef4050e31ab2d53df83ea5ec8ff017eb6b96733
SHA2560c948b79214d6c4f3ea2a0677745e0efe70bd9e9c48840162cfec2ad8b4c34b7
SHA512d4d156393be29075fe8515f4501d7301edaca4e46043fa6b74f5973b134ef7bf37084dfd39ed45fe93855c90664f8488fc69eb3a98eda376916dfa5dc1dde3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5039a170b7a893fa92e91b6d2e97005f0
SHA145bc714802277701636bba15e03b1a2edfae4cf2
SHA2566566cba2f040e1ce3cfb73f0f00b31e14c5ea117482a8423f0901e03336f42e0
SHA512f143b79176887d08cfef14227eb61cb5900f0c766d38996bc2188aaeee3dca10575b118d1125bd5e6d14600a4a833e645c0b8af9da5246c152de94766e97da0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d0045ac11b19f80827dc3e62e436377
SHA1483418891ee6799e3f3091cc680a93629bc1f131
SHA256ff51d1de78fc1fe092cb2de1fae8bd20b57d67fb2aa17bb3d42e25d788722372
SHA5120c87bcf492c82231bd84e3c6b1fff673def5ab6139432b031367dd7bb845606b9be3e15c615eeb1a113a542275a93e9ff893dac018a28d06f75f1efa72dd723b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b2a0ccfa23b0f2deb751327ac01c200
SHA188fe1fa5bd7589ab484fb4ba47417a87596e3044
SHA25628bce57af37ab3b55bd7ccb765c8e1df8ec0d484a1b512b5848985ae427f1258
SHA512d914a9e8db5dd86219231e8ee7643dd20bfd770b1369f3a84ae622c0711dc82c5a00ef91ae94730f21e173c8d1c3321fbc23c8ebea2460c821faff9a1b60e49d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b