Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 10:34
Static task
static1
Behavioral task
behavioral1
Sample
15aba8f55ebce11ab0006e5071bbb4d6_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
15aba8f55ebce11ab0006e5071bbb4d6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
15aba8f55ebce11ab0006e5071bbb4d6_JaffaCakes118.html
-
Size
71KB
-
MD5
15aba8f55ebce11ab0006e5071bbb4d6
-
SHA1
34ff672d8c9eb5c3f8ef38fa4d606ffb6af39679
-
SHA256
f93db85e3ee80e687bd947eb55f08ded9b974a36baceb919a42789457d3a615b
-
SHA512
56037e5678f7821f5d4edc95b15da31a94fe052a4f3bdf35d9477e644c87592cefe2e8bb286c04724c1d101c5d3e6e295741f9d759a082680afaef1e2acd33a5
-
SSDEEP
1536:vjAqsoLmD8ZeuQ94yGTAfcturN+rkO5elcL:B9FKlWDxL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e8dea47dc8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000083a79bc453caa92756b938734b44fc889b90ddab4eaafec4ab0508fe6b145874000000000e8000000002000020000000e6ac31bdc1fa9ac6db60cffc0b1a373a612d5b8a95de6f79a64ef6bf2be30ee5900000008eae853cdca02b519f2286c62a5ada65e46b62b4db5c01d4e5a424b8119ab1bbcb4b50a92f2c590232a30e351321eb2483539a27a0322238a562188034f426570d71b32322d7259849870137377da830038c75aa7179c6c90c7c36de643a1ff92adda5993ef821bd9419593e190014fd2f6be00b82f8fe1ef3b3952b2dc6a9627a6aee47a8b59b7e5ad06575cc99706a400000000a9e5e303d8670bfd0f970293ae247e9a2f6b7e12028d72530f340a34dbca2134feedc3cd13b93260ccc9fd64133f23022fdeb8977706169eb1e8c2637e131fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b90ed200d2ff8597de1475ddc68ed1d44a2ba9e58dd94c036f055d7dbc98fd54000000000e80000000020000200000007427c3ce97a00942e9f3facda767bd0cc4c7d80920d6a5d5ea783781c1e2168220000000e79916d03831fbd579d7298b91d398b462c7d1788a542545bb0f80c9167539be40000000ccc9d1ae20cb6af462d7bbecfabb20320ede7cc20ba8144d91b86fe59b76ef522bb6b3e72400f76fb42ed28dfe8286976e25ede2c4b01ea44e7a419a045466f0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425646328" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D00D9011-3470-11EF-A0E1-D2ACEE0A983D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2484 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2484 iexplore.exe 2484 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2432 2484 iexplore.exe 28 PID 2484 wrote to memory of 2432 2484 iexplore.exe 28 PID 2484 wrote to memory of 2432 2484 iexplore.exe 28 PID 2484 wrote to memory of 2432 2484 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15aba8f55ebce11ab0006e5071bbb4d6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bee93dafdb0cc2438ee4e6e733c97234
SHA197e335a715f5a2b21b8ab86b29c22efaf0f5c96d
SHA2560e8e3e6f671b3431318d6e46aa6a22acd538f45de0179d30385561441d05e2ec
SHA51281e8be9d937f71de3197afac678c42f2ff3f67f3075ac0f84d5935aca750801e762d1b3c4c0e16896807854a88d93ed63637a94ee76849a9877dabb6a79c380e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588228f40697479209962db69899ce848
SHA17859f270ec5edda3e4aec3bb3c51b72f03c756ec
SHA25699c23950510faced3f7cc977c5baa208f700c39eecb0d9f0b95f62821b584607
SHA512e99984173e1871656b4aab033e252701a1a8835a8ed2fcb1235a9f99d0ee2cfe9cdb33c29e063fa15b5c239bc85d29716b11f15504081d6c587ee805829ab39f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589873e78834cfeed9b104c1ad0a034f8
SHA178c79992a0aaae02efad4d8e0aaa46b1c5c79799
SHA256c635a351ee49700a72e3aa6dac848381c993742c8b4283bb2944bb524be87bfb
SHA512ab392d0cbf9df053b064fdd73fee32dc13b88504dcdc44997cef89fe340f643db45ca3f1c1d049b1d9b28d58acbd854fd67ae22e4c9c5251ceb876030bba8a0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1fc418b8d363b90d8b33bae78d337a4
SHA1468607df2fd7dec5b0d342369c6e3261af9eea4a
SHA256d24a0531ed16b6433201e334f9f0559bfe0892859ca411387f7efed049c97aee
SHA51230021accf47f4a4e9a2ca19270fe57d9f3b9b72f08b6fad4345faa409f29349670d1c4ecb4ad08e281236c2f834542545b6d9898f6f0d6f314c129642c3d2f40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b56207c39fb26a11e0c675504942dcf5
SHA1554e12a787014a597db80e506210d2e272c0d2fd
SHA256cda9a4daddcfe7d3c77f5b20013f6fdd37a14741f93d21d07431f6fdcc6f1405
SHA512fa728e49178d64fafe34b37b2ac0a1c9955c1454739ba02b7421a9f6085ef260d16526756d2dfe7d831fa50af3dbd392332037e6e456ac8f32f576ccd8a7be36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed7869b67227ed6cb6af9d6f74b583a0
SHA141721c448ba18fcb5c1f3b28f64175126b28dc5c
SHA256632e862e959297431efeaf80b1990efd7894e17df326fcddaee30b1df67870d1
SHA512cfa211de8f172f7a8df8c93a74dc67251ea4771a3f77208ae040d00086ce7ad06c08e6d3e68d758a9167cb8f5a1b3a452bebdc8ae617e0620a0c418297410942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec869ef45f4415ab6346e73bdcbf1add
SHA126baf6955f9f2dcc5807dc37c76e2d552f57bf8c
SHA25691f4ec3466f9ad7c0cd71c1a37e0ffd543c7cc5019c009de26d5ee582c4e758d
SHA512c866b9ff2dca85fa4ffec7ce190d731be9dcf507c22a822b9abc548e0a81a6c0a2eb0aa3c38c513bc9bca51f3b8356e6037338fef072a02e41a328709af43422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da0310059706bac4c01ce7d9bf789163
SHA164517d2d74d63852f90f67651859fe5a153cf2dc
SHA256caabfffb63133c4f2b673e3c5e27d770263a36a5462fdcfd94adbc15aef92e16
SHA5121313f7907a95496a8c038643ffff42b977ba5e50d1275aeb233b261757d2ba439f27749cf136623e14e4d884809b8620ab7cb60088c356288279777ceef217b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bfb5018fb6237074059ba33c3568f23
SHA15d44a679e45da27ad4b7c7169034208e8faed15b
SHA2560ef9377a715f90955a5c436c5fb4be5ae1538c1c8ffb9884a89ebc381e76ef87
SHA512e1ff19b3dcc4eacf40c592828223e446f7185e33877ff39b27d02f56faf9d99d65dfe3cf3fd12131a351534bf504397cf8a0d065aa9e3fb4abf8c9842c99550e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad2b6ca768e589df63e02221b2907af1
SHA1c379beb0c127cb7a757a4f47dfa54a99d1ce79eb
SHA256993b17900ba764aafbb2b8b4480b5de8c1cd13a931121d1da6bc923e19981db8
SHA5129c1d2e4c68499314eeac02295753f8416f6fd1eea689bd588eb1b10a7d10e4fdaff19d024fd5162eecffdf6873fcde1a9ee5ef1444b29f47d491d46cb67d410d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514e4b88210cb2214b0187bacbe3d3d6c
SHA1acb8e1e4c5e4e6903fefe35e8ca19416b410aa6a
SHA25600f11c8bf4f11a3cd07d6a0d85416d3f91757c7a8f334cb3dd51a0485fb99ee9
SHA512ead5b06091f271e5c8142b1457a306f40812fd1f518cdaefeb2fa852dd85d527aa9a9683d22b022bf89f544d19868a12c6bb4d23179be14638ab4f3a9932daf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5865e498b41dd1a5304b32aadc42c1bf1
SHA15d4f1ecd4071b65f83f5fa1b27a2d9582b04b585
SHA256f12c6676707041e0b72584ceb7e1962f61921de44e5c6bc7329a719e7573c41f
SHA512619a1b98489ccf802bfe0b1532596469531a5563c4ad6d9bc776753d5274622c238130a805c81487bccffdca4c03d263525dfcd5fdc331a14c8c6ac578051acb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be7689bbd25bc441861ef03e701fe529
SHA1866e2b8280bbd64d10111f4c86081182f0533743
SHA256aea9892704df049d070ab8114e20cbe2d941ba20f6e24975855915433479c7fa
SHA5123c4d2ef931d0339dd9ccc75a7c7d64dada06d1e5b23af83077ee2b8b61a09df6b1a548f32169d0a3fab7b4199b4716c08323bbadb1393ec3b1c7d57c5ad41c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558fee98c5eae4565f0cf192fdfc574f4
SHA1f2bef0cd2f2b4f01b04a6cbd8c1ef93512a08734
SHA256562d46e2f217450cb45243301cc6e89f4de091f79dca1188cd4cb379d36b6cd9
SHA512976befec95099072461c98a342ad75ffdc1ea36a236dc1049c8daace95f4b8ecb322f0198fd35eb529131f688f6e6318340cb78446cd4de4058c2307d4a1bb4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a92297420060e87a16113f194e45cc00
SHA1f7993566afab271a958270a91bbfc7340e9cc18f
SHA25663d7c49b25b9a48d3297b1deace6f18549a537aeded97b3538f6d9bdd6e2b5f9
SHA512e38447c41e61c29cfc711e7dd0a1f457a7936a929cf818e09fb0d618121a0a7208cf56b486790c58e5af767c03c21bb1e1fe512ae7314820217d07a2c5a9c5cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d590fafb3dafe08da8c12a8758db5d5b
SHA1e944c8524f587c742dab826eebc78acb90f7f341
SHA256838678ebc19dfdeaec6d44edaf0f6fc49b31bf4992f3ce36c21ad2b5f14d6a87
SHA512e2a06bce42abb40a36127665d7b5ac2d20ec9ac69396ed5cd05ead833c6ee0c6bd5b45244b6c83a808bf947b6b5c124b762bb6d0a372298fa523cb2a7e4454c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5887684837d0171eca1ff8870c9b8f960
SHA166f22289ddcb406cfc65612693301798de5b2c07
SHA25697b9f659c01617fb8b767d9621d2a2c7bd24e7f3e67fdba257de5e4e0573ead4
SHA51276eccc350b86f736284acd97374c9eaeb9b0e19172069622d169cb92662465d32673cf44f1e4956b2286b7e02e614c74fbf55f029f1d90995f9d2cd52f3f1a01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcd218659bb6b1a822199325f7f21daf
SHA1471c8b989a6735648f7d296ef18c3856f823b3c0
SHA256eb77020838220916946635f55fccf9bc187ad51ecd5363b12ff6f5e12252569f
SHA5122c52c8036df5530a06b088bed761e648fc6bc215096c24c20c93c2797b534a33e4f2cb9f1550782228767f17008581941196024c81dcfbe5d0d892256cd7a8e8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b