Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 13:16
Static task
static1
Behavioral task
behavioral1
Sample
00da5c13ef4b5e5c9bb0f9fd51d92d81_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00da5c13ef4b5e5c9bb0f9fd51d92d81_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
00da5c13ef4b5e5c9bb0f9fd51d92d81_JaffaCakes118.html
-
Size
916B
-
MD5
00da5c13ef4b5e5c9bb0f9fd51d92d81
-
SHA1
82ce396de6a3ddeb1e00e90503f1dfd9eece18d8
-
SHA256
bd599a9fbba887c49be862fc5157f1ed5598e2b91cb230e61054c4f84ddb071d
-
SHA512
f66832590401ab27e201e4b696d816a177060eb93d02dada37b9afa69e02ba48d6ba6037dcec4f6c2cf4aa2c926fc851d56790fcb6e0ef845b9f788a6018c206
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{450D2E21-03CF-11EF-A304-E60682B688C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b69119dc97da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420299290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000f077758297ea4f0e55374d748a3dea0b3c786bfbf827e25b53d9c0fd7fe1c530000000000e8000000002000020000000c136a423fdf15c82f0d2b70f6a2ffbd089fca28af0e0428f71ba053f502843b890000000a8ca18a20eab1cf3614551646712111230b8c5d1387ec6d2f890a6d321cf6f412a7ba80d4aecb9e32b9e83c1cd77983ded7185644a358f8583db98c54d0dd63cf85954ac007573fc2c339a6323f15853e9cd8f59ce9825a196e1064a5ceeba0b7a8442b213e829dd09b1d201cd437c242ba70be21149502c455699630a298e3b873c1fcb21595e4683af3801b3ae2f2640000000fa9d4b46b1bbdb9b4654051db64c2ee558a234d83495459da7128188fabc6355416f4e41679e396487ba0f3209300f6cec80236df4cbb43bca4d3466a12eea7a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000076ed4580618dfe90073981a99d4d2a108de76513127a1832bbfb20ab234632a4000000000e80000000020000200000003aabcd140e0776559ebdca0b41a61571e65d8bb61f003951f3d74916a0e1d28220000000375dc6b379bdd8ba62c32f28400612d8671e8270ea3fc4f816b1013ffe9c4f8c40000000c40b403a8b2f86e6d8492f3786810e7b4eebf938645864b5777697f70c99e54aaa169d452936a1c2c68edec9d0390ad796c3e76f52cce95d0bab3b8bb19f9160 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1796 iexplore.exe 1796 iexplore.exe 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1700 1796 iexplore.exe 28 PID 1796 wrote to memory of 1700 1796 iexplore.exe 28 PID 1796 wrote to memory of 1700 1796 iexplore.exe 28 PID 1796 wrote to memory of 1700 1796 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00da5c13ef4b5e5c9bb0f9fd51d92d81_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d2c6e0ec21a3b885ca0250e54c8cdd9
SHA1fb036fb31e23bc539f4c973e8cfb894efeef2a03
SHA256059f12d16977dd7978c101eefc28a942e1b4bce391504f6304d931d77bcf83ba
SHA5126f6674fc2db3320747e0329738143645c090391998b5b02b1e5c55eda7e2d0f7769a1e9f7195c012deee5eb6b41e8dd5703ce5c2a8b6e5d73ce93fb9201ecfc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f05c666df740d218dade78800a04bfa4
SHA1283c4cdfc46d909ab3f5b478f3ad59930a472356
SHA2564ca085d813a3500f46664b10c35361473b920a088032f7ac50cd66d06295a899
SHA5124e12b11e651428d6b32b1e45586887cf81c649d2d27f5dbd5111a394f8453805c94bb76d2d0c95439c151eb230ab41c18aaa267ae10e9b19add654cca265bb77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cde350bb417c69fb3ab63b3c4c7d7a38
SHA1a716506d90afd8c623d1e8506ded9acf0fe2b11b
SHA25697f3391b06fcf8662df40e1e4f827d6b4ef63b525b7340d32998c395381a772f
SHA512d52a6a827f9770b4c8df710b02ce4308d95b0aec01b906863c9b17b3b3131517169d2c61e48ac1c9044d1c521a0cc1955103a598a632c74bb407fec3c16e4d4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f86f32700b369afd71bc75da223ef217
SHA19e2fd19ca642d62335c5511230153febb614f8a6
SHA256b874d110dad661883e18c720f22ad8ca76fa954bca532c28a90b22123e4b46b2
SHA51223fc4fe2c63128a3dd4ac1219a293ad02a1cc128de58ff5a22bcf998cd8995e5cd540c9fb4a857a7744d6d1eec37315162cdc94d7c834e2ea9deea4b3c2e144e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e78c84404f0be137e184f7f43ccb248
SHA16d47ae108d21cb780e1df9fd9d9a0faaf88e5a5b
SHA2567687bb010076b1f95b73860dea097a08bdde7ba38d5679e369f5d63762412611
SHA51263ac6c5e39e7513690107f7e05855be7ed2a667b5c974b724599a207c9db1a5b72bee00baec426017cafae073a3bb431d4a778ee1c06d5746dd523cc37cb24a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59340e509ee1454140e89e2132b0f061b
SHA177cb5b119ab9c5063319eec99af1cd7e580fd2ae
SHA2567f8c1cdb9b4da9f7278aae29246cfa3b3539e63cd641834006ac44d5ee8427f4
SHA512d130b4c6ade4f372bcb711f003ef48c2b469fe52256443538d04b0c8e9f20c6fd387f1cead190399eb15475b65213f143d9c497a73d4a0d4087bfc5a2f743eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549ace947d56d599ace2713433103e5fb
SHA10547b93f6da18b1d15095d2a0923a4c99577a82b
SHA25669ad7b9891aba1f12d1fda67c6b52e3193fff0b6eb2a67b4948feed0db1b02e9
SHA512e8587dcbe387f93bd86dad2aed6bc6f71eda67d32495fee4aaf44b8472dff9ea80f56c1a0230762def9a767d0e39dd6a401dce3b8d37f7fe1ab737853af69d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5862a61d1f30ffb859e0798a49b7f25a3
SHA146d9ade5e65626c747e9ee80f742acbe6c853f08
SHA2563080263e056cb243498a878d064f373397c0be6013ad45835508d7e7b3e642e7
SHA5125b9bf5a1441a9c216cefcf1c9675d372f04eb3cea456f8f60ab410df0fb8c352cc49773f89097499150cde47e186a65d68448956241e664e6c7eedaf193b6928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a068391b69491aed0ae95294162541fb
SHA1cb48739ab0e6922ea345f678265b27ede3c8b716
SHA25673dbe90491fd28df1772bf8435be4f8e265c255d6edf13f0d02c0f328dd891ff
SHA512e4417c9263286f17688614a8ab2c0443cfc14c46b18bb7a85da042620afb24c7ac7cbe88572d1158419c04320896cfeb84599d7bc2699ad49ea9ee5dae1c6f05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a307075008cccfc92f73c2b67ab0b8ac
SHA1ef56a9bab17ce58306059f24abd09e7b7f29ffeb
SHA2564ea4b0adec518770187c636bfb24c4e2300d1f0e8177c24a0307eb84416d35cb
SHA5126cd521e5ae9624caca882264f888ed607154802c321475320107e4153706cba77d2e28683f1cf55cabb64f9348e599f9588e2cc1f5fa7ec02d45fadd0547c74d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f0689adbd09d0418ea2a088f4ae8b07
SHA1587e414c6f9b6098cefd6be8d050df4c448df3c8
SHA256e87c7ebcadf8dec3a0571b87a9532a7c2789a77e20eab09224a11576152eb335
SHA512d4ae3bb26e760f122842c67b3e416c55b789da8566b98373d9a6a241a04947fc7c863382b25f6c6b87204a25eab08531d67d974c732e11ca2a735849c7fe9ae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc5d8a7b2f1fbe699ed3768152c6dc8c
SHA1a1b2199677db89dc9d5ebe2a9364fe20a4f87c3b
SHA2561017adbb6473c3f930d95b3b374cd3c43da8b6a852e994c9e5194ecb5dd9b94f
SHA5126cc5c64f45915cde34a093350eebcf5a16ca19b8ba0c89811ff2ea0d82c87bef509231f640f108285debe6da37e58ba8f5a935a019b5d1ae883b7581021e4495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55970e9b79d3da742d18d63900137515e
SHA172f0055210e508cde839f176de99d64b5c34a923
SHA2564437fc2a8cc326c488274d5dcf352061f1540030d025b8fadf2aadc1b96f2080
SHA512dfc3eeb8d9c207d5a65724fb0f3322a725f9e5b5b4495f0c4f5e57cdbfc0ecfb195fa7f1310432fb956ec958a311b7d6e5c5a0f42acbcb97ec5cd33400d05c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d27d4567552d3b82092603c24e461da7
SHA188f9346cbafcff2145696ed870cc46452a45b96c
SHA2563b167728447dbe553a84311a76c94a9a6b54d7d53e860353153db416cc184660
SHA51229aa8b7f923b199694cb2c84aa28d934f2042f3a5fdfd9fc181a240655a05bedb2975b49c022f4548eb447362a193291177a6ee63fe475a95d5c97621ff23666
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d4ef0262af32cf41b253326b21e2d80
SHA1cf0b8f51a8cbcd7226d35fea6d642a8635cdb742
SHA25682f7c3e61299cfcdb9da8c9215b436c9bb7716fba505489d2342423712c7bf11
SHA5125d5d65b587d8beca89a8b5bc1dcbb390c1d384384f9bc1e5c0aa7f752c5dc0d539d120a5e11af8f7ef2b57496dc119a285c71b65136ce11aa558f1d5bb6f38d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5577b87365de120741a527eb458f72039
SHA1605c676befdf160581c7312d027d011064f8a678
SHA2567ef0893c01e38c3be15db72d4448dbb186ebd40e2dc7fed6ac415dfadea5efc4
SHA512bae8c2e2b30290d3c85bd3d3ee99f095e5bb46672700513ff5b88b8cf36f78dc3725f7e28de3558bc88d3883d61b16a58c4bad2b62d798cf4814db9e22189f99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501f1b15a434ee3e32148fd8dd9cca223
SHA1ed2cc132e0d7562ca41fb08f793f4d09774f04be
SHA2568c28aedbe49ed2f04d8a50e6039e6049f4aff98fa58faa7d32e1d9fd2f8054ad
SHA51273fbfe7a2983bb4c3aae2af84256da569e23808fb47ce323cfbbb14527b3906b2c676bd7cd89101afe72be2fe88f1402733ef865e29c9a829980d9d0b5c60019
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53eb1fac70ad61243c2e689f50ace7ffe
SHA1f551d3de0c5834073e12e9ab1def0fc49a89f3d4
SHA25602fb411fb42a67b87804ac3f0cc3b39ea10462df0dbe2b63452fc83b9dccbc7b
SHA512dc5ff727827f3d4b50922b455838f670ffbff80339ab7bfd8c944104fdbfa633aad91859efb3631f9a4aaeb97fe9f44e05d3accaa08cb65d735d3049b9396458
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a