Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
17385e56a4e86c95839658d94c7079bc_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17385e56a4e86c95839658d94c7079bc_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
17385e56a4e86c95839658d94c7079bc_JaffaCakes118.html
-
Size
7KB
-
MD5
17385e56a4e86c95839658d94c7079bc
-
SHA1
15be98d7d641262dd71b92d67fe46e8c1289e8cc
-
SHA256
8cac2c82b0150a56f7ac9882f8e54815d126eb8acd9fd52dcae98edc0ae53d8c
-
SHA512
c198f2d21523549efdc9275a5bc592a7097414f2d3bc627198c7a1eb4fd4f0c1c00e60a2c2660317013a5aaab10d4b27cd263fa7406dd9732d0e4cd310992a08
-
SSDEEP
96:uzVs+ux76H6LLY1k9o84d12ef7CSTUyzfCwdxCDdCCpdACcdScEZ7ru7f:csz76H6AYS/GOQZ/jZaSb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000cd98afe2742b581bf32769317ba3e4919197d8e8b19bc4aff194ce56777c1161000000000e8000000002000020000000bd55a2ca4950ba6339237664e08e12189cd1ec0904b18b951d4fc5dfd3dec34f20000000e36f7682d86f9332216e9ad69a57d74aba44ad152b6faeae87ace387e7f4526f4000000004cb9c1b6612f05d964c16b38b6351cbc6c0d92d5abbd3cce3c44862127dba1f63a969984dfa748a272f65783277fd737a7b040c04183b44c8696508e7b4a2fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C5FA7F1-34BA-11EF-90EB-D671A15513D2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904ed511c7c8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb810000000002000000000010660000000100002000000045d170ae49259597ff94655b78af6a7feb5aca3fa54d4f6d066837d32738e113000000000e8000000002000020000000d27daddb11955d31d5d710fd756820daae0d2f8ff6ea453cdcb0e4e2c1d5728c90000000f567e22b986ce70bf0fee6d1a385da2ddd2759ac0f1c644f5a6f7355aac1e8c5986e279cea54c4ab0841ad4e87ccff1d49d34bd70164d55eed98ac8feb90e54eee0e90b3318ef621a560e48c13e4b5bb32d691747096f162507003881a021a0302d4485d10fd05dab35d019f187e5afac0ac6e540f3a6c2eacc7115c79addc25fb1f4c2c1bffc7bb8f65c97b184023c9400000003a4987014c9b97c109a450e23eebe4f31e3b6ec448f7cadf4a8beff8087a2a01fe8f45253aeabd56ce3247f5cdc236b1755ad4ca36579df7907de2f732927490 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425677863" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2276 2280 iexplore.exe 28 PID 2280 wrote to memory of 2276 2280 iexplore.exe 28 PID 2280 wrote to memory of 2276 2280 iexplore.exe 28 PID 2280 wrote to memory of 2276 2280 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17385e56a4e86c95839658d94c7079bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8755c1f91dd4d72457ade1c00cdc62d
SHA1674193451c14ec1845443152f749647ac5435f16
SHA2562f934ee0ca25b9df243bab8c5f8238f012ebf3d4435fce8a2e26a42bcbf0b831
SHA5123a47591e638fdd99f3aec826a3005ad4cb685fcab80cda39c5cd7e3622eef42f683b533a269761372d858478378029a8581cf8ad4412699d91e00b83347d2ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee391d1cbcf5bd44a4a2879988522645
SHA1fe01d95dcedf4d26a9a0331b6a460c06b62663fe
SHA2560ea1c1680704010377b7376104565b2184020f2002478ae8d8b6ed2859a5b8a6
SHA512e07b7a8a4b1994650314eeb1e4746f375f1fb3d91e1faef05dee90a0ff8eab0ca0fe166ef9a28e1ffdfc51b3dcb98ab9d787e85b16667ad4ac19d90578917145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528d00520a11d6d9844d47a47fb13cade
SHA155b2e4ad8b0efdb2ee6714310f516aea27cb9fec
SHA25605132395e967782864f000e4b1e057a4019391fda7366299421b17d5c166d2f4
SHA512334acd3f4386b28d1b9d633dd8642d9a0a4657fcaff33fdea094db15b60c10e6801e3d71595a965877eb33fa4cbe9c59bdec117bbd583c12d2cd67615a45feef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542ee14a661c8afde62d88461fc8a0fc2
SHA1bf70a2ac212d92cbaedf88d1292984b5fe5dca14
SHA25601ba94f7c8b79e47889cf3b769cbffd51c4d1f99bb7e1ccb5651a357f505ec91
SHA512817528b22925ab572b92a2ee4309cff3cbb0d93be2346339170eae1df8cd9d4f1037728307b91bd3729995b37517bae5fe1fe7a84766e198f0e5d022eff00e4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc1185960275acc151e675f97cdecac9
SHA1ffc92687594f04f07c6e00f8f8b64a77519a5b54
SHA2564ac80f97fd1d185e66dbcc7e5e73037fd697e9ca29edf735657985bdc019c650
SHA5127ee52ea240a64b4dbc86996d2f09fd8b2bd360ed414a10c71b09b201cea3acb71c31bc9f477ba58f9bae34aeb68366d46beddf86c77b6a2378856ac4aed377cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5808c67329526ae8dec26b6f0dd70c5af
SHA1aede90d6c1cdba33ce50276fa17095c4fb729e4b
SHA2567754bf5c2f2a686721eb4c9539b8410e1e4e31f1162ea22331429d4a604d04ea
SHA51257e1f4738e89fc8bbbab81383932f18e7e82b0358f7bf42d7d3a4bf0fda55190ea413984ccfbaca2fea5963975af8b404b3647ced840526e4f3e2a59da85255d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56577300e696b4140fa3d2959d62e3752
SHA13c3076c918ff69779c1787028d6d4419459dab1f
SHA2561fc74d337c11b510413d66881a3d253aa49d869ef6de9fa5ff8a06973a3f59c9
SHA5124fb2fbc16af5381f67e4f39711e198c0d574d0047cd867427b9656f62610bfb56d8f3e7653be649dd1d58f0e04b1987b21a76f2cbd396bbc796f127e0ddc4b6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c47e23cced0a48df2f226fbef1f1a0d
SHA17b6f07369d5e978e0cbe59c12a9ebc44f972f4ce
SHA256301c619d36d4746fcd85ab03105cf86dfda2a5af3d008da19cfb3536926350bc
SHA5120d6d26ad7dc3623fad384e393feecc92d99b670abc9cced54ae5070a3a070be508920a86cb6372bb207619221a330d550255660fb2f6061678af431c77bea36c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8e2e4d4127c5a512d5aae7df7e85b41
SHA129f74f9418f11972e0b87ec90db4cff91a70b5e0
SHA2563958ae43b389abe33b6cbf96ca07a924ae6d87d05113ed60c93babcbf3f824f0
SHA512e8b17acbc9b816adeda3c261d16dafe46144c74ebf9921f7cf032ea54e5aefeb650dce074b011f6e621e3b2e3281844d42ae64f90081f569c00eb58050ea3568
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591a923f50e983d5c5e271b59ba9e4926
SHA173939d0025f6e0c4508e91c66fbdf807bb11483c
SHA25673b1bfa39b9b90159f3db9f6bea7b9112209ebd5377f0916c5a1f4c8af1de779
SHA512d243877d2bf20983e37bf2e7db77200e08362a905ded9f84796609c77d706417e24baf55f055e5d4a128c3ac50b05cfa434bc9602c7a38a172549c5fe2642d53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3080ef5978846172ee137d57460b929
SHA123e37e432b1366b44d21b1686456f5db0f48d1ba
SHA256a691839b30da4687c3ae17b30085b9ab2543af83ebe582c3b9c9e37e1d7592e5
SHA512f7d5b79eb26235cda19205df1620d9f9ae018d8bae8df956459cb702df9e0a00ca49e099d2f86110bb683e65a96b77c18152773c7522c089eacb7e3074205155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e5265b7dbe889d4b8ad835822348b52
SHA1a72a7cc3e9bbd0f820c9f1e98eeec82a91a6d5cf
SHA256dbe1d8195dff7302b414f80ba3e4d38ada0a25da785b7a06763b78bf65549acc
SHA512a22f9f5ea302600c0b220b9bd081fc9bf549dffdcfda460d252f1706c55614cabe8dbdef4b7f1d8f80d1d13f33353eb7252a2fe8c6a1a2a7de2abe6094e957a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532a60e60db58c8df8c23e11a38e8f637
SHA13df410b2684ae92e98d598ca1268d50bd8b0e1dc
SHA256f315fa31ede812b852087497a3aca105417f8e2afa5bedff3db2ac7620863942
SHA51213609e074436c9536a27bf645957dc9af435cab9a2eeec4380472a04cf9f526e750f16cfb298aae23a9a664e5a9edd62953f620ac19f23f660609e066fe0ebf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a87d5f55562b907a80b0e6222fc8c52e
SHA13e91eb369794f6443a242c595ed11a62bea578f6
SHA256d34e6564ea3b913f9d2e806d8a535312c13149650290686b2dd5171ca33a018e
SHA5127e401b04ff580a6706f5c2db4cb8f034894f9b840d270e664d6c5b2590baa1dbc6ffc8d00b0396386b21187b7de6a1143a7ccabd7799d492d3ae7ca30120847a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa28fe60b146d4fc16a1b8492b83183f
SHA172ebea78a7f0d8c1da6bedcd9d11d7da4293190b
SHA256c75d0ecee3e1da07e75ce82d4d382d330aef6759e31908a492ac7cd6fd64c85c
SHA51278233d7d3daf6894b25fe508f86a55ffdda4fb85eee33c6907764a88508183967dc29ef4b69bc2cadc5d11b7d38588103443b65d1284d9c4412a138bbcd88df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de3c1c3816b59170c97d4fba032cb712
SHA1cd6b8458ef17b63b73132f452f277252f5c3b858
SHA256cf58fd95813deefcd8c76d68f915499d841e95ad3ea8251548cec202202c4078
SHA5127f90bfba1293f43bf49cb5f0813cb3f44f6f9dee61dd05bc96a736972e5a701990b6c96aa03f05a915d5c6a328fcb9a42ea259339a012e6efa2eb307f611d604
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b