Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
6445e3b5b9410602c99171828a78d845_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6445e3b5b9410602c99171828a78d845_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6445e3b5b9410602c99171828a78d845_JaffaCakes118.html
-
Size
57KB
-
MD5
6445e3b5b9410602c99171828a78d845
-
SHA1
d0368078f035f06a448e29923da2ceca2914c262
-
SHA256
471c3a64ff04b0f52a1bdcc30cc8cf0423bd3fe240d66f955006489bb4e5e621
-
SHA512
dbd8ffbe192b6e842edf0fb6c830f0f09be536976518e923700d58e8f1efdce88ad592a00591aa7b302bda58173e472514b614af7cee3ea351792794a83ae254
-
SSDEEP
1536:gQZBCCOdN0IxCH9inf6fvfqf+f+f6fGfvfrfvfLfcfHfHfxf6fEftfLf0f7fnfCV:gk2H0Ixpi3y2WiO3zHTUvf5Cc1Dcz/aV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427834550" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c16a8464dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000062f5fc77aa6dc6e64b837697d9d3fc2a68f9b922ec699ccc51db292947b4a1a2000000000e80000000020000200000005deb7fb0c17061f1a735c6b15d01cfef7434c35edce73bb838c5be514af08d122000000069c33ac0c8a70a668c2a7da149ab0075bf74171a024d5f378a75ec28b168ae684000000026d7ed1250ecffafb42e29db975f56475cb4f2de6772c2944e4b0a0440d33edf8d1921a42ebdc766904b7d21b7a9adf42c578034a2aacf7c131b757c5cceb98d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA00F9C1-4857-11EF-A839-E6BAD4272658} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000b184d7c6613d9bc643d077feda0220da71f626afb92dcde9b5a10d8de3d486fc000000000e8000000002000020000000289c7314d83dae99c00b90d9eaf500e181008837992194892b3d0397bf976a829000000019e06813b879ec14ba659b26dd5adb690cb84e902473184f1966693a952b607d6a2d4e7e80d6fd2f9fc01816bd20367d430a2018c0cb6a0ae15342abcfb60a44f7b20b9f703d4c03a71e206df429f6966f22960991b2cfad01116c058019c45092656d6a21132c359863b8f413560a4b61bdd083f7fed3d6d491bffdfb736cc45ca411c5d0cdf61a1da080c0c6c0c85a4000000080220540671f13abe1dfa6bc84f441571c7c3e9ead52203deacf370a0958b261fcfa93681c7e684a0b1f45f9c9206121be387cf39c9933246fc761ed59739e0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2380 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2380 iexplore.exe 2380 iexplore.exe 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2084 2380 iexplore.exe 30 PID 2380 wrote to memory of 2084 2380 iexplore.exe 30 PID 2380 wrote to memory of 2084 2380 iexplore.exe 30 PID 2380 wrote to memory of 2084 2380 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6445e3b5b9410602c99171828a78d845_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f8ec9a799933492c839ac10fa58a1b3
SHA1081c2f3a19df1585aa14c21f5d5e991f371bfdad
SHA25682252d70d2cffbe30c91a70da8dc3594a3cd6899c103921b0f5a539df3d68338
SHA5122fe169e1ce958264bebe68a83f5197bc8287f6f1573a2ed2a13ceabee2e3831bb6bddc4fdf266d41ba69fb67e1b0b386c9fcb695c257aa82ed54fbdd3099f475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e4b9910a5261217b9b76cda4336d919
SHA1101805d9805eb8031fd815ff8864db9074ea7106
SHA256d6158c0eb3b857e08fd56b7bdb99d5a2b16f7d831e6cb3f01147690ac6a54160
SHA512925ce7d187313fb179ad43821bcfb82d70f6e02c591f17dffb786ffd6df8d44b3cf6275d25c7eb3562e2000ee10bb5be7d7803a45aa33f516bf03b19386fe76e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca6a97c4ac805645528b05e20c241f1c
SHA15655fd135fa7ed7eace34d3743bf9f98220eb75a
SHA256eca21b467cc5fba409700ed749e03e339cfeea7900dbdd76147274d956c127dd
SHA51209d98f32008aca5a9efeae777b9e1ca3f13698da5b2f663650474edd6ae80d4f01870493a540fe9fb6d034a014f05222214e2c93b943e6844b40a95c4d4f5960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eee79e22c82e10d1740d20c839643646
SHA1d6a5e5900060ce84345ba077d37f728cd4f7ba97
SHA256e93cb2ced2bd072f421aa26e966fca222077c2867dd7fe5b63d5c8ee6115c581
SHA5121043d8e141f1e74c80a477c3cb6ab6176fb7df3e5cc1d4f8a7a392156b03505f15606f8c54a4e5f7a332c3999fb88b03f741f641d15688d5c98de54092cdac7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f98dcc8dbf09dc217341e737f2463a6b
SHA1928ed56b485996acb1e2000cc5a745c5cf4bbff4
SHA256efe15ae024b185b8e44237090b3e7b5a19c41ccdfd124f5d7ea1a6ea482113de
SHA5125dd0a21b813ca8ab885cf963eaf6eef7fa6978e3c65770d0d391d143d0a55ab47952d4b11d12e8f11e9fff24cd99c0964b8332fc459ec50e36d5389652d28013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bede0c1dd638fc8e776f46bdc77486e4
SHA1c80d4be51d43c6eb26a43eb05ae5f7d9adbbe7a6
SHA256d78ff8df94c2bb0e8a701e9a46f84495752730edb8d39eb374055900c3c7aabe
SHA5126be553d0bafe95bdb2ea820349c5e0aa666ab88a75b7048e27502c6373f32c26d4766880633a93dc48c2622835db8dacd1c0fc12de014001ef79d008a675eee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515e62d6fc68ca2748c61f3a5a155b792
SHA12b687097fd2c469e0c36f9e385f2b92c9cbdc9da
SHA256d3113cb0183f3e90912237c3026bd1c6ff8a56de8fa3d0e6a17e3b11c8cbcbfc
SHA512741094c05d34dd3153e8192090662b95ad64c27c151e3fb4bb712d129e2689653627f41dab1576acb37ccb716d88e3aa9b4910cb31e2634f2fcdf680fc5123ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2eedb38c3a383428940a146cf865bcc
SHA133c03a7a8e35cbf7d0acd6ba679bd63854f5c09b
SHA25610bbba8cb2ce5236aba2909184e76d6e2b0694f6769aca4fe9e14d0e24bcee54
SHA5127ede09447fd70e9d3c1542764ca9a9634b3b6034d5f01002cfa6770b487bff6f92f0a30bdd0d1a5a022166838dbf08c25a416869b9ac92336187c2d1b43bd236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50882158bb0d2206e0f5b41a9fc93f38a
SHA15ceae0792a07b15b094783089dcf5a76b7b54dca
SHA256034fbe3a6077945b0c4c865e55b79e02b61b8f3a5b93da23d1cbdf99e43b0502
SHA5123f88aabd6e1e775b30da7191c325607600dfc9de9b7c9f22ded0576901714337e54e8ef57f63c55b6fab6b54c0586835cdfbb2ead47fb69432b72e55134a08d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f33fd482890285aa2d5d7fcab1879d64
SHA1b1bb0c9a9d8087726ff5693c4d2cbadc0a976c02
SHA256505035a3c349d93fda58ed3956c5ce669b781f57e49cff0a39974bb4c82c70dd
SHA512bb36ab6139460a7e8c5a394bff0b3f7bd7bc409b8e4d3b2c84bb66c9b2d41e0e58a52fb4eb0c949b1e7ee14cad1466207892b93de4e055766f240e672856c793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569ab7c28476bc4758dad4dcb3153028c
SHA15dc8ed67b13cc14f6b2eac93485bacbc01ef9358
SHA25675000f3bf9655aee6fcf3f3ee343566379baf26a9fd0b4ebbcb58f6bf57a5584
SHA51280c25001f4d0dfdf676428a0691ac9c04437fbc23cb07013e62724aca6a361f507ab5e2dc5aa6c7bc3e863c876d89ed8ca6da3f315bd3991840bdbc107301a2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59293f6c10dea9a6f9ca423d6e654b73f
SHA179ff55018de031109da1386c26cb140046254875
SHA256a6388ed62a3c9e0ff23eff655d1614d26c64a8c6eb5c61b2ecdc563a1a4ff41a
SHA51269768f1132c1e80df6cbb540685b8eae299279407775a14d6c8ab60aa34254909544441a656d5e895e33cdc0ceb4e72556237333330737e41360ea00929c8e78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577ae54a221e27f0e915bd52616215f2d
SHA11db21f0748d1e4bad629453a8086c419105fa81f
SHA256873b3646e802c5500922b5370d9274d111bc2fa920f570862cfc1707f3245ed9
SHA512c5b7bcb0507c7d01c215eee2ccac4b7388638fda0917dbb65901d9566b29c22aa86a0ea233888e4770cde4ad18b180a4e2fef2fcc71f7892ce96a47a90cdb0a8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b