Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
6505e3a2b87676d0a28b5fedd7123f3d_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6505e3a2b87676d0a28b5fedd7123f3d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6505e3a2b87676d0a28b5fedd7123f3d_JaffaCakes118.html
-
Size
122KB
-
MD5
6505e3a2b87676d0a28b5fedd7123f3d
-
SHA1
86f8a1a6eacc53982fa3297a5f1519dc4ea2e553
-
SHA256
62e371cb41268f13074d8422875f7a4ea6fdf50ce2de3c8f9959139f0f4d574c
-
SHA512
92c804fd14c888762d2c3e6f67b4615fddbd661be8547442a3bee928a44a66a74e592913f8da31a97b675dff877e035fd4b794b6a38cace1d120fa3686868796
-
SSDEEP
1536:CEVdtmcz9oINM4Yd5fj4oL2Qpih4ZH9B8E12D6CrH:VdYcJNy14CM6ZHtGH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D889F8F1-487F-11EF-9FF1-E28DDE128E91} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427851808" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000006d207ba4bbce443617eb9ddd86be814cadc8e1a39d21d2880c1771f30ef64855000000000e80000000020000200000003563dc8731ae76c84f24aedb56145e3e481eb0af094135d3ce5e48bf0705625c90000000eb1a21fb9c56fe38c5395f79fb523d09e90c3cc0329a6ca914533e763970d1528ba4e4bc191d3ec5e3f11299f1193261bc672e681bd531a511a584cff6acebae87868bb7f54dc96a0a3e85f76b5474f5932ed663a6f3d944fb759d4b3cef15c8f69f3a650813558ae14e7b7f9c58a3956c951101d6f23b3e7dc15166dcb7fd803d92b4734ecba5add27735c6acc6037f400000005919c6e88174e8bb8b6a5d235b917cf278eff4a7c52bc9807aa909d181d4d8f78fb2b9ea228eb385083754c6029836325bf0f1413d74c63e76f4c211c249ced3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002b478547c7590d8692703ee5c370b32e34b5ae4fac2aeaea3108c52d1f681100000000000e8000000002000020000000af62d228aa01380ca5359549f3227cb1f678cad0df95970d698504f94c507d0420000000bb493d9bb4bbba8bf16d840b7ea8dd3e867fee786027d0b9d1fa7752e9aaa3bc40000000d492f5c5e7bc2f6bbf42e2c65a91d71330a2aaaeb6ec6777741f4f4493da4d88c012a84f2a60bc933dea6530bf3df2b02f69489feaca33d70a3b8a82f62e3d70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b882c28cdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1476 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1476 iexplore.exe 1476 iexplore.exe 1640 IEXPLORE.EXE 1640 IEXPLORE.EXE 1640 IEXPLORE.EXE 1640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1640 1476 iexplore.exe 30 PID 1476 wrote to memory of 1640 1476 iexplore.exe 30 PID 1476 wrote to memory of 1640 1476 iexplore.exe 30 PID 1476 wrote to memory of 1640 1476 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6505e3a2b87676d0a28b5fedd7123f3d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517b49042576ee67300daa628509ac040
SHA1cc3e1b16e039244dc2f7811b1dcd58602230968b
SHA256566549f478d194539be07f63e9b049175ed4adcd9f0ad0a0b790a8b49e458ed9
SHA5123edee9e4e2e77a4f4b84966dd461f9062fc318e5db708dc496803b8379a01aa1a603c3c46199a88e25f9cd038aff39a429810ca2d3b251c9ba58feb282e0d6a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db0613e6bb9b21f280f67bc95f6513bb
SHA11acde202f1e83c3850acc6f723a12734f70d6509
SHA25622c397c17aadf66f1dff9b0b94a4f76ccb83025aafe95cb0ad651791d6de154b
SHA512005ce029328b3a14f3efca6e077e94f8090f3cd1561f4847bb8d0f72f2eb33d81045c17ddeae66194792e81aa641f7b46eba3dd82fd736f4c6709f56b72b3e72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5d1bda791bba7c6c3e4c6960ae14d5e
SHA10fc66ef913a1db587fc9fa8bdafe52123111ca59
SHA256a37c767cab809505e0782760c4254f631608471ac0a1244ceed00b46b496222b
SHA51204dc5d751e9de2db855242cf24df94331e8319c810b47235b813c2356062c4d76285b1fdc01e74187a81a60eebe876ebdfb044c1cd70dbc44f89772afb892af3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5daf8fd245ce096a4c2205088d4a63bea
SHA1a503e78d0e8f37d6030e9739c3c2e92a17b11e3f
SHA2566a797f71c44fc62fcc29ca957a5b5c8d87c8baa5e7826bcc39ad842774d03b61
SHA5129b275cd3ffce6213ae5877a375215dda5b2c64e84de7e33469ece1e2c0855d18ff896577be749e2a424ea510a062224861bbf158fe549e087023a8b8d9dbb347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a89bea052179ab60ff92310bc686d5a4
SHA130cc4f38c2b07d291969c38806b46b275d09898a
SHA2568c4c551a3d70835be634a312d778662d29b4cce22b6d951b9dab60e1021ff53e
SHA5128ac0b24f22d20104504f257d0f985aef26f9807a84a03b568b16ad9371b3e5e8d4ffe73d2ee3f8ae893bb2a88adf4b63dae7a85807899284e8c47325b946ff80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a499a1f363ec08eb7136b89bb4b50092
SHA1cec174b1451331500dfa0f16db76468ad0d5a2b7
SHA256cd6de288ce202f8b8e21bcbd343158a06bc2c024772ce0d31658516b03bdd2df
SHA512d9aa030ad0fc6af96f6dabafb0e2ce93e9d137528a37c235df0febf9f47d1d8dcaa803d70c8b9a8fb2575855625ebcef559966219406b9855de6f3628deff804
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c581b3dd9cb05ccdfac9ef8fa160d87d
SHA10b8c6063de767a1ad44fa2efd45f5f3a7633c658
SHA256e40c964c7a97db661611916a4fdf31306460d7aabe2048126876f0ff7440e0b9
SHA51201403d41d32edb4aacc2d41f033a6bb3c9b0f3ced40add3e98382f0bd12f72188961a8ee0064454f21ebb66a9e594a5909511430f177f2b71f70ecf5bd92edb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567e5b9a2f5bbf2b3c50db20481702b70
SHA1a2a53ccd7661791679c5b8c290a6751fca4690dd
SHA2568ba5678915977651c455515716402dc1d2b6f3d32cf9eab329030107a9ea2a4a
SHA512548d74e6d138d50175e7d9b4f1d4d8afd1ff0b57711f44c5fce928dfa2c744ac4a3269ea631b79fd554ae128d2564fe4a96f3eda3498f3495c618960936e5c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540b0be1954f71f77d04ad01266c9ba19
SHA190069f939786bfc2a26d431eac43372101eefaef
SHA25659410a099b917f8b6686e3053aef08c3d6ee55fb41f8fcf6856ec892f887f216
SHA5126d2653c1e2bfe6c17880c7449702d40574922b5d6edefd27d1e2da77a2fff7a40dc03671ae5b9fefb9a611e44d36347a6851fe77c72dd94191a99708230beb5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c6b9efecdb096759359ae6d1f5ec00e
SHA1a218c0a4489101a32880a6cc45661902d47881bf
SHA256b2424275781dfb96b1959f44c98fcf1b8d13cabaaf5bfe4c4cc421469590a138
SHA512f31d732a46b9d71bdc9b10190465b916629be90e57b4436fca4e95bb44d290a8c8e73f312b1fa239bfaf11f4ba0f27b8744128e26ea47fc3a452653f273a4343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4f19bc29595222bc18c47144f1ff4ee
SHA1e5f68f556f565593c789610b5b56a778b4acaec1
SHA2569f7a02a178a59080065745500eedaf5732c45205daf60b3e823a85948ac942bd
SHA512222cc14f3755d6f382123f5062251f453b310db5586acd3bb97457cf1a0b6ea17afae8087137b6a3872471f0dbf47191ef1d241f12809249d28f5fcfa44b83bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53726038932007dc5a8564f1227c9c7ad
SHA1917932ca71f22715073e0d3b7ba6c24090563fbf
SHA256f1a3a2ef351b0f5311af23a70f69ee0099f7924d51a7bd07dd0925b7f314006b
SHA5123a9e64ddb28dac6d26382ee2db3a0919f683645e01e47c09d7c5c74b8c82ef9ebbe705d4d87db39e5b1e5a8cee65e90aa1fccb029cf2eb25eb6154c596806581
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b