Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
01c22e2f0d7ed18b24532552181e7647_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01c22e2f0d7ed18b24532552181e7647_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
01c22e2f0d7ed18b24532552181e7647_JaffaCakes118.html
-
Size
213KB
-
MD5
01c22e2f0d7ed18b24532552181e7647
-
SHA1
5199dfe59de1178d00809bf31df9aaee9a5395ee
-
SHA256
db9d668123bb86e83973e4302e5d4b7d6786f0ba1505b8d0faecae97175f7036
-
SHA512
90225517d6f34d5c83539f5c5f0213e21c8bca48272409478bbbbc2f2912ac1b577f266c809c65d3360e6a7b0010dbec70f8c13b32f5823c54f0d19981712d89
-
SSDEEP
3072:SoU97GtaJOiyfkMY+BES09JXAnyrZalI+YQ:SoxnnsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420330671" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55996851-0418-11EF-AB07-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1996 iexplore.exe 1996 iexplore.exe 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE 1336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1336 1996 iexplore.exe 28 PID 1996 wrote to memory of 1336 1996 iexplore.exe 28 PID 1996 wrote to memory of 1336 1996 iexplore.exe 28 PID 1996 wrote to memory of 1336 1996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01c22e2f0d7ed18b24532552181e7647_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532d4223ea7de4b0631420f8bcdcbddb7
SHA103e689252ac56081e393c5ccd11dede1c9938544
SHA2568903614be185e111df1ad6e51224e216a651e48c6640bdace7e8e1f1e61f2cf9
SHA5120724cf49ed2fe8ba5e6521f0165e0476ce161d8b59f6feb21790832a697b8d78a0d10bd3d9e2e8d99615f119bfb49d2d5f5d4f158d41b2768c1e5eef03d61165
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2e54ab1ce09d5fc174a3bd497f5f655
SHA1c7ecc04e304802db26900de94a35bc1be2e3802f
SHA25601701439ac56f6ba7b69b41a495d52e8c698d218783955f5818e1b7dc9e67f58
SHA5127aea5ae5476a3bf3ce96d60c9a60ee81f98932bf982ef9871f9f39da2536f44f935933c79ee79666a463bd47b32afaa06b6994c155346d7d8708e3975cc38b40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb064bbed1a9aca999e2fe8b0a75fc26
SHA1d2d4f0e47c9f243d07eef537c028c1c07f1366d5
SHA256576e248247633b69fa9851617bbe15e38076b343b568e26dcfc1af4b7558d63c
SHA512b2683735fd712da5640b92f2eeeb9132623ec402f1c26ace2a63bb9b6f343aeb734f4022bd663ac3d1ff4a88bba387b690debd82b5b1e0d3b014f1dab760cdd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac5786179a15efd5f0279884ccccaf0d
SHA14e5931600b766073d7ab729a56897deb555d59d1
SHA256de32b76a26c67c18bbb89496d4e9e0f951d8df8165833ce8fe7476a1f2d779bf
SHA51278ec8b34af205ac552493e0b5a4a7a702a79da36d29b0b32a23301dcc271eae9de89136aaa9b75905e12d9ffc719ed4b65c8f2fdc37c48db4cfc501e8820a343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c366edf3efb32465d3d055f10f4a896b
SHA105e7b0b99c7623f77b8e935dbbcaa671c96c3091
SHA25608a7067ef5ec4d90f5e502b5d5203dcdb45d16f5f8b7877a8f07ae48c10677b4
SHA512f67d5c9af290a5eac19d53994e660fb2e1ea8649ad406129be51d4375f1d4f5f266a8487efb57751d05c45c56d6be3a86b92f9cdaaecb10638a7f72b07345a8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527e7a93b5a8bdb2418398bd95d24ffd8
SHA1837de654ba21e263e50cf0cf25117c4b2963eb3e
SHA256164dda4d4ade9d7d7a8e4ffb8e200bd6dead6e61ff1404be24605e4990929c9c
SHA512421e8db8e3923edf302f6df208cd917b968aad4f72e3be56ebe36c753788cf0b612af48927ddff680a78ee66d5252a06cbbeb1f9a6eb7f4fce1e6bc82a44f065
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2bd6dfb73078573c45f5aa0b06fb836
SHA1461703628b07665c0b6c22bce3172dd0be476b41
SHA256faf16b358cebbefae749fa2b2f4b66c939cb9b7660769603383efa7108541228
SHA51252386747e28fa2048d33f68509e9e28fe73c91be093bef8e3e5967e5b2299e5f6a777f1f737cf58a32f679a36edb57cffcf856b3783b429277dd166ea5204d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587e7f77639ce7cf60d37b65039f484e5
SHA163c9f33fa8595ba9905d0e20bb9eb8db36c0e2bf
SHA256f3b980e4bd7026cdd0b8402fa407d02c79a4aaf5c3bbbe8fa7978c5f3c276a66
SHA512a65ec4595af09c2e08bf7bc3e604ca78c2a039f6786de37d0b4c85df34806e43d76bb10f7079ca374c68de57642feea6a249e89caeeb71227f9393c6ed2f8eb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ee07b4120d742d3d9078501b7db71ef
SHA1c9dcc6b8fc1fb4b39f903be2516346a8a4ed3c60
SHA256ab09d5399d3682e8d750c414840e46d7c06461e7b52ca7bb15a6c7585a9f06dd
SHA512b1e46300cfbc4c9480dd5b3bcc5b26f4a8dcfb1fdffe87f6a8f4b31fa29c5cf5a5bb4761025894b43f010b32ab659e7ee5445cf759ef62ffeed6856e73d81b11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a131a5982d5cb6c6af5901349254b417
SHA156e0492499e0508e7b2c6118c99e417441bc7e97
SHA2560ad2df0db94d9be43d90505fa9f1d45ac3cde51c81c5aaa9871e1585247182fb
SHA512466d15e3bd1befda0e2c80fca524d5dcdc506a6c06ef64be6d5bfee4e22dd7b3e1ac1284c4e813c266420696c6c3e7489b41812fb9765588aafdc64207e32b9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b11e09395722dbb2becd10f2a5090640
SHA1effcdc9322965d23d952cc0662789218d858545c
SHA25643de0f461c177dcf714469090b73c6241102dc9a0cbe23d44d3c6551c22af0eb
SHA512c350009f99703fe5ead2a57795bd56c6b42c0045999ab72b0db335a477ae3e986698d02da0e5f5c1050bce406e913db793bec4b13f29964d7cb1eb590bfc9caa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b098415ccbce7afd250d2045f2db472
SHA1a8d0411a4e33b88963a2374beb8084551e59aa89
SHA256513fa6411a0dc8545c539fe294a398e934be34f7afae542d3059c303dd7abade
SHA5126fab2dae948913da98179d3d37723f0937aa101198b48ae9664c8f9165ab0c9502db84eda40f8236c7b122700083ee8601b032cc566bf5b9c14cf099fe6d6e63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fdc955650c396c3bcd4ce8ddd4d9afd
SHA18f5630bfb9b08891b009c38e783f774aed964a32
SHA25659215918dd6310ebaa91b287c2b0ebcdc2ce71d6220635feeeefa91745d361f1
SHA51233352ed665f31a541e7cd40ae13ec459649516f2b99a3ac6a94ef42beeb9fb7b8bb97cd53efdd54d460f75f257cab901b2db720342f12d57d677826cf8a38a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a04900a77d368d8b8d80a02e3e0f04b0
SHA154e1780b2dd0da3e825537c9405fb9780bd7c79d
SHA2566fa993dd7bfcbf645ab3b99143a648ed4be0a4cdf6a93d02e97fae7a0c43455f
SHA512b22906999d44eb23611dcec16e813fe259f54582d327aa50cb60ebd39a94c0363602f3cc243d04bbc95622548a32c01522c160c9aa61d90feb6afa7b5b1ea958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5964e362d296dc951f66f0ce6f772b080
SHA1331727504e367d322078a97310566e286ade8588
SHA2565c555e5a6030f5835a4369ba95f3af8a636ecd29237d488da4c527f5ce068589
SHA5120c04595271876c1b09444b045975e425b4124cc62027e0e681545cf2ad935df86e2c5a32b550cabc7c48d202875be63509ff95e18b401f9dc973e5d4bcbbf600
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572c29eb215c8d0e3868a8e395ce487da
SHA1bcf71bdda84fc3b9dd3c6935017ee77a111f93f7
SHA256a986ace391f3f6a841ac7bdc1cd43f909e64040384831957186eb3c5c287a108
SHA512a34345732480c6b0dcecc1ebe0feb9aca86913fb7054bc2a2eac94dc6e02ec3b538db9a4d0b6e1ff077314c6d8ed4bbbe57aef4720f4585a3ce8b931761083ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc3a74a2c0f8566dfc82e5f4aa2ac1b6
SHA1b10aa052e02f2d81d1e61bd71f020d4577960d13
SHA2561bade59698e6283d0dcf169fa0d9b6912c00b96b81c16f41d0728a6497bc84d8
SHA512c0ee5a5ee81f5d9fac88de32e1b31d89c1d067c119d6bcb9deb358b997e6420ea7dd04a6f6a69aa86beda2b25c48d0a9fe7b9c9072ead48495d5ec8ce5939698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d460e2bfc078eb6b9dd40a2f4b8739f
SHA18cc85752de7793b7b54e47e7f0225fe5b693a081
SHA256ef435e4175b5a534d5cd5eed9101e0b44b96ce27b4db07caf176cb1ce2c4d97b
SHA512c8a0ddb087000b8ee1b204e1c51f763522556a49a53f0ae00aaec38b90d59d4ae8e277049386491a53b88f7ed2ef592a2609d9a604f7b25c0de610c1850c9860
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508d0329340b50ce302fc8c3802fe9970
SHA176f8a2a1d22d14eac42535d173cc16ef784d335f
SHA256a659ec8032f36f1ff7fe26a6a9be25192e72e18b0057280ad0821395d10faca7
SHA5123291b63a731459e0be6934f7eae5cfd4373a2d49df6a609827f7bcf2508fb683783030eab844088554c7816d2c63a4889fa21ceb7eeb869f4b57a11feef843bb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a