Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17/06/2024, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
b77bdba2abe9daeeac5e94fa9e95c228_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b77bdba2abe9daeeac5e94fa9e95c228_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b77bdba2abe9daeeac5e94fa9e95c228_JaffaCakes118.html
-
Size
3KB
-
MD5
b77bdba2abe9daeeac5e94fa9e95c228
-
SHA1
f6f1724e75ce9b3650b8af0183c89976055ec0a0
-
SHA256
59e8bddc497dc6b0c181fb74eafb44e55f1a29dcaade7c9f048729bb272cdb84
-
SHA512
2dcadc2e743040a0eb1716943439f1d0174deacc6ed1eae29b00fa6e7eab580c9bf402b82b27c0b0833aad0b56f3d8e29c5a3507a384ef51014846e41769fb04
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000ad485dc2071f4d5f7ec0a3d0b043b35b74c88e8c36796cb37c43742742370fcd000000000e800000000200002000000057e3bbe4f738061ef435ee732f7305ec8adac0117746dba8474db6d41e5df49920000000fb43b8960ca1e99cc790f781f8efc34b9e66658d36d678814fd03a691747134c40000000e1af4ca26dbcaf30bf4d21ad3420440653f32476c8a7ac44f73e86f3289b30df216d601563642b17b9af3e62914eb4679dfa68028959372478ee6d2ad3061984 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ec932c8bc0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57D808E1-2C7E-11EF-AAA1-627D7EE66EFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000305d88de087c6251784eccec247aa1749e5cb230a4a0051e181a3627194315f1000000000e8000000002000020000000cf4a73086ecf834ba97da18c5dd594bacf8407ecd42c5ae769dc876fe23375579000000080192607a71042c8d0ebb3a6afe9775661e0f71559cb83a9f6248ad52d7dd7f1c05667fa4c656c9a2fe6dd05eccb06fd5a1afc17cec92a3145a04281f89870d8c7085ed0bbf35f3fd101775a28432c1eb0c7470c6ac995cd3c6cfe5369d109936f48751115828cec56d8c7e8400ecf2489cfa0eda90bbbc12001595c262089c144d83ff54f5b817f174911d75142eec640000000a93d0b39cda8e09420e5ed16262227c16c5bd5158533db344705d15986a011df3e2d5c99511d74d0b32cf33f29e03b13ca33026abd0c545c523473e7b168f863 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424772529" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 1804 IEXPLORE.EXE 1804 IEXPLORE.EXE 1804 IEXPLORE.EXE 1804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 1804 2376 iexplore.exe 28 PID 2376 wrote to memory of 1804 2376 iexplore.exe 28 PID 2376 wrote to memory of 1804 2376 iexplore.exe 28 PID 2376 wrote to memory of 1804 2376 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b77bdba2abe9daeeac5e94fa9e95c228_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53503fdfc065efa56e7bf719ad4889a34
SHA1d520e60e71675672deb39bbe98b415c87199e9c2
SHA256ebc74ed715cd572caefd73fbd12a8d05830234296dd34d654a34481e69a81994
SHA512948f8a5e1cc6e43f8f86aeb2f0aa2e47cfd54608413255d9e4928ce826d74691eda9b0d880c8633b7fe1768b78c481a463dfa0f37cfa52fba75811b334cc0a69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5085504672ff135355b6fdf5d44055c
SHA1fa1833a63cefb91e5ffdd837fdeda894d1631902
SHA25663a7bdc9ffa8e5cdfa72a7b0bb7f93b54a42fd015c72b09b6879b973c02978de
SHA512cd922f1906e14a18423f07e9723b7e73827549d598fd15948ba92737d36469ec1344b41a45c6af419313bffe10917771d7128629f7deb155d8fb8032502eadae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5853df22cba6fafb710e789b8bfcc1370
SHA1730536527be75a48b28b8cce474811423f5f2d14
SHA2563796a6a82968b8da8a091dd363b4cdfb92236631e78eaa6337ca66359b37ad47
SHA512f7cda07b30053466b5f34ffc44dca45e0d191c7f5b82dfc5eb2f4ced94066f5c93311b99670eb2021d47faf33284daaa8e09784f65a61251ab3f92dd09e0ca5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1ddc44dd72c40f99902a4238ce3cffc
SHA1d137c67b26f8f7d79b0a14d510e86ebc1a691197
SHA256c1f6f1a29bb8c7e14e7edde3f0335f7bb4c53bbe2562aaf357fa40360501369b
SHA5120a6258924db33e2f6a3af5236f0e8d9dc4880a9cf8dced20f90a51147f63966be423cb1f64b06f49547450f3309cb3374da4b135f5d0396afed8519e41e0a137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5975785d4c0b12fe27464f5cbb8d2c626
SHA141f5d05796eb0de0c9531d661d5e5cc48e427cc8
SHA256ed2a14f517df507ebf91639efab8c19793cbee5e4222e793b83ddd548002ff41
SHA512f8f82a36fe19b6d92f3425a5d2bfcb8faec92e4bcf90eca58367309dfb4cf5488d73017db9dc470d854c729b963f5acc1ac78fc49009c0d7e4daa52756c1773e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b69d520c6a6e814495103725edf8d99
SHA19c1c83ecbdc40a1606a773ec83892662a856b0d0
SHA256be7d88d64aa7d8567df5cf2544c720d4d3f620ebd0a4bd95e466f1887f2878ba
SHA512a560c06c8dcdfb0d331c6a376ec0d7f60c5fb56d95e75706317d671f2bd36ce73baad90f29b378e259632705234ed83d7a1ed63861538a0221e8e69b396d7b29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc52d2753585d67b0fb936de1e8e197b
SHA1183d47fdea86964730be3066b75b862749cdcfed
SHA256129daad871186d085c30e5272010a70a0d53d9bfb280ff77970e690c758b96d2
SHA5121102074e1a5583a8c8ca4c6f41cd225ff89aaca22eaa9294af0a8ac7382fadc5c8278155b62c4fdc6bd5f714577d3e6d4a70ef37bc720856aadffd6086fc0362
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593b19dbb404d9bf11a2c179952e299c1
SHA146451cdde0e19f003335c13e48311f440cc848b3
SHA256d189506eacc34d6c4872a715ea4e3963a19676d4cd9bde52b043108f38ab845a
SHA512f1d40e9060e92d2eb74bd32bd7bd9cf87eb98de12f3f08e922da0c8e728c89be199d83ac6bd324034199af9acd6b9f77624927a6278095a9502f350352596964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c90f028f437b1badeb14df9a961bd4d
SHA188af1f2368982f622e881480cbd51e874bf9ae8f
SHA2563d902435ea7babcf2b4f43390fa9967c87217b6a601435c0a6f835ea4bf4ce53
SHA5120e0bc017d455187bf1f8bc12db4a891f63464ebb2331a6a05632689c95cf83c0f643b95a67bc07f02c47e84445fc6a2ea89eb0a83ad1f217ca6cf86999c6d428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5867f506c617a0a19566dbd788d942264
SHA161618c038d878774fa87bc5286d9410266c892ad
SHA25685aa63205634e5958a2401498534438bd8a1c198531259cd8698c923a1de6d44
SHA5123df056186d794266ff8009ced4272f03592fb72ec3bdb52a1555b4ead91652bb760338c0b6c9a2fc9e27c0a786bc3a85153c162abd7b0ecbc8a4bb19aebf1f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b4aeb1076cdc0da004e38328ef37e3d
SHA16496417895df0c9faf177058dfe11b00f888de0a
SHA256a476bc2556eed9c79db9fcb2d725e8cdbca54e1b84ad092a1f48bc5157d219f6
SHA512649a23ce18baee37f058af80f63d85403c0752a6c69d780d235df1389c8ca60a4403fab525e2dc5b4d1e1eb0296b25a868be20c6c87cca21260b4eb42f8cb41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d307f3845e6c92b5621cec7a7537cd02
SHA15fd5d62acb30db2156bb14e6e17c0674c8759404
SHA256c68a35bfeb83ee3bc1f243c6d268303dd19ea10697e35eb504b4f183a33eba5c
SHA512d4d674ec8048860d3400820a998679e834b72f81f7c568bdb3dd3eeb9d5133aa695e3110d753756312e653dac1c7abfecea406a50c2548404d759388151e717f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c8f2a0c9c28efa32b182e7119d1e311
SHA1f11713c39c385f0d766643e5633a15acf580be71
SHA2562ea40d9163f89e2f969e9ab2eab70ffe91af224d2cefbd30dccbfeed4c3af90f
SHA51203cfbf2f7cbdc3902e0fa918f7da5c8e34f0a2298569480e5d142f9cc5eba25e51540c763224f2822577390d37cce64987d64456bb8eac93d75bfa1b1c7639f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53657e6fcaf01e3b4f94755e59f05d94f
SHA17d9ae03f9c3931fe8881a6942c0eccbcdf2348a8
SHA256d580f9a54ddd8c9e6e01cad1f2b6afe40a19ad30839b2f2aa72a2d67454707da
SHA512600196018d58ad5a1e64d8aaa723a623374b0d7dbed465fee67e902e9042aef2b486329e143f94059504ed60ac891942287261d68abc97a2b65d373b8411e300
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52847995eb09c02606ed16a83a39f71db
SHA1d730e6cc7d23ac63534453d7418e6f55fccb3085
SHA256d0dcc09b1f12692fc8793461f8dbf0c6a575dc008cad50ba92f4765b23d8ea57
SHA5123278de7dae8e385b28df8f5e2f6961f87a7ea7d2d4364dd20ada03fcb852fff50773aff79347205451cfb69b28f8c71a059a852d1d02c0d00eb49667c907fcd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b72b40878151af02b7b8c5c4e50ce2e5
SHA1cf267f89e2da5500f99d0fcc573ff2fa5ba91930
SHA25646255ad058b26f34ab8a6e28b3d5e62f2ad0d013f6bdd4e1fa36fbdde6aefc9d
SHA512ff97e5a03f88bb404e47e98e544ec0b852ba490222dc24846a0569c6e531dfb6cb6ff9664ec0fe02d24e4e336639dd57d63e28d179a1bbaa2aa1fa7ebcc10bb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2f5a9ff31f594ee4459bb6fec5037be
SHA165efe43df9515f171b2872f91081841e80fff164
SHA256dc9653eda6d1dcdf9501e23e73d7f3bd6c97e0cb2781ced8311cebe9d83f374a
SHA5127be3f7e9dfd3a6a547c260f0e65a80a4b4c2390348fedc0f14556cf49c72489fa24fb25c8e97a6adcec08640a2f0a6f4e0ac4308ee731f72989be9abf43001e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bf90fcb688c1f6867990b4e335f8938
SHA1d3b35c54f7c09c20f6afbc68f5e73039fe18249c
SHA2564204e17820bb618d35626a5e6b368245cd0bdb5e975b54bd2ec4ea6359a67680
SHA512ec1d4571154a49c694f2cdedf6f773c6030111ff803b8927494a005d7ebef60a01be25c38fab1a81995a83b087dc41b59b20163a5b6b8411bf84f9e0d9ecb973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7fe069b0a944a11524151df64dcc314
SHA116cc429588ae02b5d32fe8be35e4c8f2fce945b0
SHA256d7384a607723e342ab58438203d08542cf6d1c49b170491b505012eb40e30a81
SHA512b28e4b99d58a0722b9ce884972b66b50e9a8719a81d4ad61e7c82c322fdc81d58d88660d466251b105153d28099def7f6c48b1bcd95568411eb414145fa8d9eb
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b