Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
1ed04555c24342fa77aa518a0f9f47fb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ed04555c24342fa77aa518a0f9f47fb_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
1ed04555c24342fa77aa518a0f9f47fb_JaffaCakes118.html
-
Size
25KB
-
MD5
1ed04555c24342fa77aa518a0f9f47fb
-
SHA1
efadb03b69b4d6c96a80ec9fd0e3fd78eb68aab8
-
SHA256
39698288c1e6cf23c1e97682540a77af7e972b3eae40280845943dc90ffe9499
-
SHA512
df8aff98df84efbf2a58d6ea31d0eaec919f8a8ce2128be03ded67c72cdea6914ffef937d36357c60d44dd1a2a68217e67300e7f6a46f89d9448e936ff72acbb
-
SSDEEP
384:hnA4ywN5pKSBeztvukeKXXTujwCoAQ+JLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:J1LWtWkekcpdD1k90t
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104ebb51be81da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CB3A3B1-EDB1-11EE-AF23-56D57A935C49} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000c9221f174ca542ee083af9576ceeb16086732f4d2a14b23bd041c3b3717aa8c3000000000e8000000002000020000000eb35893f66335d00c223ceaeaba4a6e1d0dd03c446759b47dc5886bd3c63cc04200000000a4b8a38107d56c578808a431f85636c358c854740e144b70d74bd12859b123a40000000d36bdd8e52466b37813941d896eff0de6cbac2a482ec10e3f5514775bf3e0c864f9388398eb02b8ab9abbc631ee8a56cfdbe89ce89f4ed7719656955f18d7d10 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000dd68cd9dc6cf603e80e95b341222fcff3ec671497c60e4c89108402d12a94fc2000000000e8000000002000020000000eb7ea510618936522f87b70ad8327d7823b53603ca5cf6916afa0d92c4de867590000000a4d416771bf3a0c4aac8ae0c979e082c46bd0d9da6773846b67ce40ba616fb3bc1543195bcec4384ae5ae12f2f66734a888c626938f4a385b0615cae0dc404ecf720617c5c8d730b3f881f7c9e5780a314e1a9a2e4ede17906962fcd0989bd596ae11cab0827bb06650c44780f5c2ddeb8b45d732928908ea5aee34da44665ea52b009a1aa40269127caeff93d15a0964000000029bb9b2bae6acf11095963b7c819532aa6e9808e6b2e31831bb465f5638570a2eaa5227c0ff26f3174643aaf6bfc6ef6933744a82116cad68d15f790d590dd72 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417867574" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2204 iexplore.exe 2204 iexplore.exe 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2904 2204 iexplore.exe 28 PID 2204 wrote to memory of 2904 2204 iexplore.exe 28 PID 2204 wrote to memory of 2904 2204 iexplore.exe 28 PID 2204 wrote to memory of 2904 2204 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ed04555c24342fa77aa518a0f9f47fb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e1bc08660380a2b3d1836e3764a5356
SHA10206372649f40d98274e454c15b675e171aa30e3
SHA25667d2e86a963ba0654285c12d997f74455c628a2201f819c722b8c4dc48dd0819
SHA512247fc26250e24563bd5b7268942c8b733e6d7401cd11df77661a4c5c7553a23770ddab0bbd730e6c3e24dcee9563921c269b7ca1da596a759732748e2989b388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2e22c292773dd2ed8b649da38e523b4
SHA1083dbf8acac4644af201d52d4fea64bc87b18cda
SHA2568df2d7d7130dd93388b17c8a64c0187ce42995b47457c1f2b3919ea5055221d9
SHA512a86ec4a127f3d8cc9bee15c04b44522464941dad17b036945c0c89ccea186bf5ec3bfe037f2bb8305e498ff80b64e466e8affcec4e3c46d139ec76f4e43419a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5926f5c45307e2e6804c3bf82c928d23f
SHA16be1121845cbf611741e9bae95d95409e16b93eb
SHA2561da4cab233b4df27856f0f9c5bb29ff80d369a1b85d3fb7713be23a04f87101a
SHA5120d00f59f88afe71a62808fe509c2c8e19f5d10cc14a21d16b433a804ea602cc65dd25d4c543a8830b0c23dea9b600fabdbfe5a69e3fc60c893f0dc0709269351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54219fd064058ee747ef965a7a21365de
SHA1dc0b298fde211eb96c5fa44ccdd9be3056405805
SHA256d570236c278777a22cadea2330ee69b4846ea855a799308e9c301f26d29dfd9f
SHA512bf3f20926b1873e1f76280d336266c218f0672e4e57a79983691956670099606590cd58deb8593ec65153f623f8361928e1add7d85949757d90fba17abbd987b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d3676260d0f854f65e2e82b4cc1729d
SHA13328a2ce63dfc7a4e402cf4865b45552a88c1a3b
SHA256025e60c2fc249d321612c5af7446850ec46ed1f3676ab5fcdb82dd7e55432b60
SHA512cf9a55ec44ccbc295be05faf9c31aace62550e7502bd517f2edab24c724fbe08601be2f76eb8d5d3f4368ab4e0ebeaa67a365e067c0a7842079478a5ecea8601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9d2779613fec3f0ee9ed6aed6df2f6e
SHA134c6bc79078030746b843fa94cca3c03a750e23a
SHA25644cac81a5c935d4addfcce2c8ef2314b5aadd7c80b3ff626df05c6cc003ce34e
SHA51230e3f4f46359a2c7ece0d292b129f1e04e30f16af5d2749cdc0359d0c217b1e104c80a3143797778d0d9c970f966e8f8a43616f78e4b1771fe79728a242e32c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf9ca4c0c11509fc15f17b18bb4369fe
SHA102ae2791d1587127f34fe130b37632fb276875e5
SHA2562963bd7181a515f68f6911462e92f6350f670ceae7724a0b232666dfc71238bc
SHA51273a72b38c15aa1733b63e6abf88ed81f1b91134e7590c021c83cfd949abf60e22d73e88f7ab0cc49a90b31313810759574090769ce77e48c786623d9f0a2395d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ede7485ebd9176c7b202380e72b825ae
SHA133404f0a31cb07b9c4bdc9bdae48d571879a5a9b
SHA2569de81726d57d09007c0e6d385c38965afa980cbc308ad8dd2e8e5209c580922d
SHA5124ad127998669972367f18d6be88501b614068d2d815e0580b17b0a871e515438fd960e8a4b7bc55ebfaa30ce0b08c9e4a7155c5fb0f2e4acc1dacd77be6b64b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5497830a5a4512b82c852dbca2c02d056
SHA104de265e6d05d02a8c1aed9deb77025811d9ecbc
SHA256119f0d6080c1a14134bd5285006698f4b0ea5fffbbeda863b05cb3b47e3cf706
SHA51260233c3db7817bc3f24edb60b28fe6c1af34d5e1d04a88bf61dff0679d4a76c867a5f035224e761cc9223fea23b4bf62005dea7a7d7de73ff2f0bd2aae608487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e86490c63012f614cbee21b01b92fe2d
SHA14120d48204d7d6a077fe9430ecec5defab07aab3
SHA25626080242b97295955e474746ca20feab8ee71c9194b1792c4879fac2968faf4e
SHA51248df9f9dff4db17affe0090fe5f6f976a4542a11a82c48e64bd8a741190672e626105ed2e13d5a5b471bdd1efa2c67ff98cf942e0e1975e4abdea388c8114a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f8287e2348c0604c69b41021e9c4778
SHA151c62670cc22cb1d1e67bf5caa63d29106ea6ba1
SHA256b61ada808f2d3ad9c630e0838deb1e818f86a222de7f78e8c4137bd985649dbf
SHA512cd63b0b08aef23b51e9b66518179eab4a34979cd6b3e7fc956f7f74c8154de3a4550caef6122a313633edca77bf4bfd0ec49e9ff50098ebe55d549ea63806bb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed33d00b2ba0c05aae74c9faa838421c
SHA14defea26f66836a8b2d5f8b95347b389bd7fd67a
SHA256883e3020c747f86c1b00c8e2f7edb8279376bdc2d83f9c97aa50e8b78fcba085
SHA512c5dc57cb5b46d894b7ec31708a28bc81e3a55e6e5ca73a12e5f1f6348976ecbdc94f970e4ba19924c40239253e779bc6241150961d6bac034cbb065f643a80a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513468c629031efbd3fd249bc11da9be8
SHA1e65e2a5c0e91618683be03faa3126ad41aa145c3
SHA2568674c56181bc6baee1419f02f86649b4a33741bd7d91235999d413c0ffd2c1ae
SHA51243799c6a018c33dca28851100867660f8828264fb23732c438b47c8617371faa7c898f61bf459b0e1e77cbf193ec06101998e452f63205875882077edc603a03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f6b92b170e0c0debffb998eb4e93df7
SHA1282a20e548d675f3bf82a90ac6b80fa5c4ae1fd3
SHA25603024eb7b2a5d073f98282eb951d63e39bb0a711c95a34af83d4c5520ce53f8e
SHA512ec68c7176cf5163812dd43558ca592f6ec3155a148cc612422cf44499f0c19534d0e9e720db7b18946da6b6a19ccf24a2ea996a761abfe9aa84695f84969a34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7b25b9370b648c7280bc21f6e2b0540
SHA1b1581635f748f6bd173a9e90b2c37cc6b449d92f
SHA2569997aefdae982369dced614f756f42d85f3543105b8e52cd0e2a367a938e6bdd
SHA5124410c63ad45fec845f30d8c3dfda365e17daae1099f93de5d0ea27b1988b97831bf6b613d2e394a9ff06003b9416116cfea5614e839bcbf450b7aedf52456558
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b369f1a62b6a0121d88c86f885660672
SHA1db9e2966743a565d9c35429e7fd3698bd26da6c4
SHA256ab6ccae0e0f58134baae9cfcf5aa44675df7579f1d3206cfc66bc2c6bbc40302
SHA512ad81f1f063dc4af975b74602f5a8129a43891012f1e52e51bb7433f79755b3fe7a4fe88825d573dcc4f129713ae7ad150e36a06e036660fb119766b35f2b4cf3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a