Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
615b24fbd1f043061c68b61fe58c6aa7_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
615b24fbd1f043061c68b61fe58c6aa7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
615b24fbd1f043061c68b61fe58c6aa7_JaffaCakes118.html
-
Size
15KB
-
MD5
615b24fbd1f043061c68b61fe58c6aa7
-
SHA1
506caf19be0fb338a70a6aad1fa26c7c87fd3395
-
SHA256
92c22b6c3797a1ea9888db9c673351b5c7aa704a931af8c60107096193409ee4
-
SHA512
10f6132874b67cd1dc59bb7f780813407deecfae85b0086c1406ed2b0a50759ef570731c2feb8b6a1856cf58a2574db9fb78bd311cccda8f0770082aebb9b1bd
-
SSDEEP
192:JuU5tMEs3Z6jB6S7ns7g72w6yg+zBv1JztdoA/mC/zJ0GZdtnqgYu6T9IQmDkDCD:7DsMSaK3MhwK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{444C4851-47A3-11EF-845E-D61F2295B977} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000004895d72fa0f0a3d4fee05b0d539a5b7af8dd6758e53712675b3da5cc1795c20d000000000e8000000002000020000000e0af0e13a18e88345a16357fec082892aed10cd18519251673c81a9f4bc20e03200000007a3fe9fe5191bb32ed217c0bd90851cb1bdac5399f95ba8b91f3b51cc16ecf0940000000856ea5a62ea69b1cf77352989e2a5fab27e4a780386622d44081d387344340b28029887dcd558b9b0c02340593834578e832ab8b294644e3da217ee1b2ad19e3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427757069" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000af39444a8651ec0e18516bea1d18b638333535c7e8e8d0d65abd8d276fa8a4d2000000000e80000000020000200000009d6b299bb2edfba70d3dfd7f2dd590ba7f91c24acf63409bcc3f77d84e5c011a90000000ff931412f89b2f80bc66cebfe63b5a7c2398387e6a11f30a62de291c5fe1a21e3438ef25fced1f5a6d59d527b7f093d7a55206d0dc25821af893794063cabbdf22ead7a8ebf4935b96a9cfb1fb29de7435083f2810d979c2e262ee43c18ee846da145dc2df3293f10eafd4d12c5a5a6aaaeee6eb30bc0d9c4693fa9671a694a01e4c217a277a3614ef1280961bd827a640000000af95891364963102a29dd49d7beab78ac124a816b3548743eef59dd2897f3386432add83152cee0a34f5cf13f9318b63882976455e3b7fbdb7b41cca60faa4ef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f3ec18b0dbda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2796 iexplore.exe 2796 iexplore.exe 2408 IEXPLORE.EXE 2408 IEXPLORE.EXE 2408 IEXPLORE.EXE 2408 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2408 2796 iexplore.exe 31 PID 2796 wrote to memory of 2408 2796 iexplore.exe 31 PID 2796 wrote to memory of 2408 2796 iexplore.exe 31 PID 2796 wrote to memory of 2408 2796 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\615b24fbd1f043061c68b61fe58c6aa7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d211d79a52627ccb4bc9beea0751244f
SHA14d0055ab30636b78890b8a00f5ea2e60efab0a63
SHA2563f130070a46fadfdb180e83a867afcc3c37149a06f7ae546a1c6ad2b6db7d155
SHA5121105fa4d85300d22a5e20232a9cd12cd49845cdb26bda0a20f65a40ccd02f4351772e0b7e799fa09fcc10167b57b17354d96b1f7efef68964dc7b44709f1c13a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9dba2cc87f56975814b3c9ce69f633b
SHA101fcb5747b73b03af89b6bd3b49b625a8b446321
SHA256fba12051ced3a9d9a9f0fad325045bd551a59dd44f0443067bdd64c2cee86a30
SHA512d26d833cd31d48e89999863ded2b3cb087834c2bf3247bbd9e978ab5cf78f5ac4fa05eb9c365d82ba40b1794db1aef912e95ca21378150d3b1aaf3cccc79bae2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a20af5c5481df79bec92e7a960a64eb6
SHA121238bc62a5a0d67f00d2ca15ecee9aa06e916ce
SHA256165f9fc117aaecef82443aadf2e850ce2beb9458bde6007ac8e61948dd572b1c
SHA51218ee7114347bb243aa5a93f19c2623990bc9a60ca444753bdd2d3cd975f99ccad28472d9781944b5dec0ac8bcdadfb9704010a3f3f9c092f5a39a474f54ffcb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c950b61e4eb31e79644f226225a123e
SHA185da2066c059c1658ee6cd842701dc5183fd3ac4
SHA2566862cee32b2f063c1f73373535f0fe2721f80e5c01d3177cc3a23a433e926613
SHA51221fa2f72c6806478b5e5f95922f52b65105fda05bfc73c999d2cb6b2ba717419d6780e8e01df8d4c0f7e9eebdbce138818f4f4abdf8f44946bc2963f1d2f3f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561c074e962c7379392003fa667211696
SHA1f8947964ce17c0b905c6f4f73d5e788dff9eb0f5
SHA256ae103bf6cc0d2c30667906e9180336e36f5e2930dbd65bccecdc04b09a930579
SHA512bfa08e680b0e2b111106766809b6ba3f053073c53b2d59ce89fcfcdfe84f63534b6f8131220fdbb512ec557c560b391975ad32ea1ad10226a285f16a232aa44c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0a63f206b3b870fcec5a487bb9583c5
SHA1296efa52b63e789d9e67078ac8c548547339a32f
SHA256764fbf97de8f15c236a519662741f2dfcf6e3723fa1ba7db47ce6e0641a667ec
SHA51222656d69ee510eadabf1ec94dc632a7bdc1a0642f9c67a6faa2abe83b816f261a57db4d7fe21941052fa667e95ef95bc4145e8c2fd4b178df40b7e9ddbea9375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52130de13205db7fb4e2f185df1c4cd8d
SHA10530803fe375ade2ae022e093e0a94f4899e4b07
SHA256b8bda7712bfda0c840deeafefa3b48c0dc75c2fdfbc2e28520f5eeb6fa82f6c4
SHA5129eaaecc09f4a276b24dda31d2f01086f3d0f8366391da971776cf06d487a959c28d665e6480ee40f16ef4b3be7b396acdd5784787eb4359f29cd40e494c74ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514740b461717cf0b2f7a6a60f01c1957
SHA121c0c83443060830c651f9d3d4f9aacf86b4ed02
SHA256a708ad1736484bc7d203ea6deebdce622f53f1e02364596cf01e8c999a03b0ff
SHA512d4eea536420370f909fd427853316a7ade526eb5c7b9be7501355272e56d7dd0762c57bf317d0df8a345c4a1c55b082c5a95459551fe1f14a5b6371f2accc028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd4e6726c6196145e99318aa713e4d0f
SHA1040074f9331d4b13490b5370aa193076210b3653
SHA2564adcdd4cfad6cc602d3db3e9e2c8d72c35a57f786efe96cf79bd5bf7bfa45889
SHA51256f74e7bd15ad624d2a814cfbf0fee1b452ae57d6e31aa9f5c4145e17e6cc0bbe07270d9177564e8411d786e93a2d955fc5793ad57eec6e7c2456433d809aead
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52328eef34be0d42f7222ac778be05028
SHA1b9a7886a0cfbfb2cdeea88febc8e7e0389a7776f
SHA2569a9c18360b481f9c2b18fc1fce98ae01380cbf9ad2223daeca9bb9eaa6ed0adc
SHA5129d9a2bbbb3b41657e7289ca6753c020d2e6c4ea3e5893bc59f06ceda429623d0e1fdc09a75ab9ebc2e840c934fa1c6b2f7c6d01cfcf7fd3ace8b2047aa7bc911
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5490be0645d1e949acf064a7342dd47ff
SHA1d65df53197b70c6e7e5f18c0dd424ca5156eaba2
SHA256482e5e0a03a2c05d217e62468003f23e40b8eb00c45b18bea845184bf9719b4e
SHA5126349e3d2946cd9a05c6200b5761ec73d9dc41bc8a54b54a12c9ef35c6c5b47fd64decb818c8c3ba0b87942c7014d5bcc3956e5eb5fa519a0b98d551b721c69bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fda60582780b2d87da8aa50b06f94beb
SHA1ca337b07f1edbe9569e3a1733d10b2b1e59799cc
SHA256722424a4cb7c767c6da687d2591e3099ec55e34b59c822f30bea59be1bb0b21b
SHA512c66657d29795d1958b2da7d14513b34494f1a383a3b119a843c4b0bc345133f6ab8f35264dbe934caba266d0f96b0a87b56b3d7cf6ee32f03b53799bfb8e098d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cec982abfec58ab5d0d805284577fdc
SHA1498a1793ecff2094e5771fbca422b2b6663ed58c
SHA256d696f64566fcec4885c72f2b4dd70f2620d74c3824bd349a46efb00cd1f2d8a5
SHA512108c47f35068d66595838dd6c23be37d9abdb46e20a3a03a5d545057e6d5c038e85ecf2bafea87a30b3e23f9578a75b6571e34b7e9e30c4007e5045f4290052f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da13d55c9e2ab8963b40270db0b43c03
SHA168c9f3fbcb28ffc072c8a9bd4f77940de436ef38
SHA2566d16a23569415ec03c546fb8f846f0e1ecd1a66e69b3972a507ac6254831c0b4
SHA512f9bd874395f46837dafd0e626ba322d22b1713ed4635d83cd9358b63d370ea0fce14500374b8211c14922177dbd818932e3c2f9593d04e31b71f3143eddf5401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52386a8bd79e87578a7399edfaa3860cb
SHA1e36cead8922f63caff6882a83062645a133f5727
SHA25684532b5ea2d88fa421d96612f29c87af43762f14e5b7456cc336b787b74c6ffe
SHA512fc8b1d682b8cc78d682a6704bca818d49f9fa24356fadcd6d0e63930c4c9b35fa5396b2e5a0e9328f4672533c5f0fad274667cda0047a11d8278d1ee28616ded
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b