Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 05:45
Static task
static1
Behavioral task
behavioral1
Sample
0da997c0b35569ba0ccdaf30ab3d907a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0da997c0b35569ba0ccdaf30ab3d907a_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0da997c0b35569ba0ccdaf30ab3d907a_JaffaCakes118.html
-
Size
959B
-
MD5
0da997c0b35569ba0ccdaf30ab3d907a
-
SHA1
10cac5238b1847cabb4005f1ed4af7a0dc8d452a
-
SHA256
8f0179d10cd22b827036d914df573a3f26beb9423938c577ee9d929ef276589d
-
SHA512
a649bf942368d2de3d9e883698ae6aa1295e4644c4da28184db1cf160e8d406f83a6606b94dbb9ea8955317e96037d23695c195aba986e8fa07e6bf612d03221
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f780fc539cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38F84671-0847-11EF-B2C4-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000faff27aba39d82e4ec08b6b187034d4cf01ba9af080db5b3c0545125555c18ee000000000e8000000002000020000000cbf41c0a41e714b1a5423a1043ba54100ab6856110dbd660b2b8ee16b142cf272000000062b66e0cacd8ec72ca2ec901272f80ee89ec01bb1d4ebf475df8b7e80eb2bb76400000007772461292748eaa1b1c5b8434a819c51a5b680095194c8c06483496719c535a6cad59f564b23347c2de11b899b13328cffa0d5ceb82c0c7a8805ebc914033e0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420790614" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b44ed16f409b3696f50a3bdfa92b60f34c37cfb0824b7d92257d22be043c3fc5000000000e8000000002000020000000cced3bdc03c3fb47398a593f8bf8af0942853c34cd8421d723aa380ac4ca822890000000745f0368297189c72d564d0ec0799d05efd64eef9402b99496f62d014482e91476d2988f305d4b902ff99b638ea3d02e530c7c2c23a32beb8d09d0bc09c7274c2c72dca5e01192395ef838b6fd3d8467cdd3ce4f24ea065e7b6c6984376135a663d8cdf79c5af1b62bc9ed0282c752798d5ac25fd58fe89418d90109dbca4e635247966843870b1f2d2fe98a0b2b4cc6400000002ab5c477c2763e70e9c2ffb185174986431474278d74dbcb3606c40dcbd4fd349b1b0a8facf302ccd5b98d18984f3239ddfe21ae746671af87627632b64f8876 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3000 2208 iexplore.exe 28 PID 2208 wrote to memory of 3000 2208 iexplore.exe 28 PID 2208 wrote to memory of 3000 2208 iexplore.exe 28 PID 2208 wrote to memory of 3000 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0da997c0b35569ba0ccdaf30ab3d907a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5277e0e91c907381f2dfd59fe9234ed80
SHA19341fdcbce63fce6e4e606f5c1fef39fd252f5ab
SHA2566d51d385e3c266475a5ed5acf265a2256de0237673d8999360df3a2c30376a03
SHA512993a7fd70695b87524571643be41712fcc669c476772537224c3d359f00377577eac018ea1e3f67e56a0be9d1d3ba61fdef442c7b44224a7b80291011a400328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f208938b1c66cf6941d660ae3bb4c5f
SHA129afa8ad1feb7c2f6e2a26e2325f15d0469f185a
SHA256e353c03411e1f9f6a7ce34a6dfb37cd091aec8d1e57dd394a7b5fd1058964bb2
SHA512290b6b6f412a110912eb453b4ce399ffb560b124e832ec8bd5c7f500cd97ffb99a8585027166417e7d0ed6da1123d2e6098a83b5882181831f1b3433a1defd1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52db73216ccb985a25456b35161ccf68d
SHA1e7ceec3c7c946d77a829f21eb6b99eb32f0a03a2
SHA2566bdba2d96398700340091d6ba72c745deda6e9e22f506990faa6552bf54cfe94
SHA512884a0fb85b98d378e40c7e19fb71cbd010155996872fb77f2e73e2a5fbf9a9023a00899fa063de29c02ec6d6d5368b2c99d8809d11f5d8f00647ac0548e5e27a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559d084638b69b989f09f78f3287fe86f
SHA164431c9c670e208af60f224b9cbefe09f135c5ca
SHA25678beadb3723e632979aba9a47aca053e48fb3ef2104cb6061e9153e1a0c237c2
SHA512313c36c11a2ab919652604cb71e357e64138fe4f9ff68b7a91e77e1193a8421f62b3a8ec69dcf80fabdf2180a1766d2d4311259d05c38746ed4ecbb8cd8fa02d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d90c3b1b30b42d2049ba6f00d092e580
SHA1e21ffc92f4edbbc5c8487cd35ac0c05ce788d10f
SHA256ff3c38db515ac614daef93bc60da1159bb8b2cbe4fa0d3880325aad4b3e43ced
SHA5122d4e0ced4b1d996363d5a9559ef4ea2b2b1c5ad79dd24151d87c9e42ee69bff0e6ab68f4c7d0e412332ee415684858473594d12d9c980048a3e23b7be87bfab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae7e90e1f5c65b6e6425000bbe4fc721
SHA1d7a5d93a625f2593d5f06e4ea1b9d23f477e018e
SHA256900fd991dfb8312733e433625a0d54c2bf7e8098c0a8e7da09558765a8b781ea
SHA51251ab6d491b761aea0749226c7821456fd3b83bd8ee723e9126644d156a0848de3c3615fa723b78ea778a57d3d72807eb62ca92c66cfe20140c4795c6e150b047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb083272bdf081b70da4e0bf4552c59d
SHA10d882902d8149221fbbde7850b40335abc497b0b
SHA2560da57a40dbab6e311989b7041667b5e22b429a90128f8a6677734ef74813d52f
SHA51208ec0c440a96b75c7384d8f607b3d352425d4d894af30b154780cd20ad2871925580f854a8a7569730e4692020f6149833b802ca05dc5cd3e52c826d9aa9abe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a700e6901e89b40e80b818dba6d09d98
SHA18dfbbf6d945ceee011984ca6f3f5b45b34d6dd63
SHA256d3d285113f7e973947a90cf5cfa9a15d35b1f1ce7fa2cd62032d4f18018d842e
SHA51271489dde00799f555100bcee7410034ea0771d6ed4dbb3e875baccb3431763a11587c9b25e0ecc501800ffcdb8705f2638798ab020c1382c9918ed25fadb630b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c31a3e9e03f93d1ade118033ff8cf43
SHA1edd178e6a5dea2b50bb235884e8630ab6a8562df
SHA256eecb8110335152d91f46fc7d55062067c2a54c4d171482090afa4a253ee8f2d7
SHA5121f721e249ae1b1221102270727fe4946b573852ef95c0d1307dfcafa2a4da44611e698742f4fb3d4c6a813f36cdaf7f9dd77031ad42bb9cd5bbae1daefabaecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5170e3121ab604e81f3c0fdd222de7ce7
SHA163d83eb099ef63f0c9272394b5f0c8b470c46f60
SHA25655bef051b24b079b434ef4845a4a0158d2e608df243ba315cde6cca27f61036f
SHA512ba8e8dce15fa6b9cf7ae7e3f97db56e6a138b6f5291c6b04a413801a6f3535845233b76e36deec355a948746436e76374c54b76996a21d7d307293aba1004f98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524de1908e5bac81e8b54f76ff1085ea5
SHA12e955964dd01f5c34428334f2ed512509f618a6b
SHA2560e9c8badce55e79ed9f9f188ed8b821422eb464feec87c4df8f503527778616c
SHA5122b86094709234e9e0642dfa4a450ba90832273b07266449a8f14ca29cc18fee7f18380ce03c8c18d38f0757ba251035903fd83e7ccd3a529251abbe6fc0cfb98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3d9f90dea81d91f9889de23e2a55e47
SHA101706e465d996f0a0f646e0b57322c79e6003a7a
SHA256aa3156850a05f7f0116dc3c308a0d21a3804897dd0dc3de8aa21b40300875a3a
SHA51245bea383171055a7650b201ba3dfe944bb3ed487c222dad254dbcf1a5885829f9f1f30ec83d66e3ab70475a8f9ac98575116c5e482925b05046c9147e2eecb87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c676255e71410703702ec4a0150a1e9e
SHA1c42bd2db206765097a222b8fd4340450e1208b6d
SHA256590adb6317fab520b3e107e3d83ed0d69a37c59310e4e5a2010d3ab70c693c3d
SHA512f972bae9d87655e74c7a1206019eff245df2578cfb7f1b154db8bf589b0da3bc01e0763379f9a3c1a5fd9dad577465fefaa0417576ffdd2bec46819d896b834b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e5bd5415d48abaa0a2bd64dca4dd8b3
SHA1b226dd040c84a8a296e2ec0f59602e08ec679a0e
SHA256e084ec401b560a2d00db4beff751a10467d893ef9f658b6a63708ec8170c7f78
SHA51232305bed53a5e3e787f8e4cd58462db66d558f883839aa6cfaf8a331dec246e2cafac81a9955396527f6aae867fa90c3ea02f849bdbac29e4eed4c5cef5f25bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffe429f7c3f959672b060828e602e6c8
SHA185e8b8228ffced9dc634df27188fbbfdf53d59ae
SHA256d6325075e4cc1a5792b3f2d4d8a5429534b379e85bc2a5ad34fc5afdd39fad3e
SHA512f38f798196e5494bc56fa737669f3c5dbe48bf9b8b0141af97445cf8ac310284f845473bc733c2bd5fe528bfe05788d8bd3938183447fa1cdd2e688fb62ebc1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55be189d3b25958d6ced0b2148e27269f
SHA1575a683c2d96f2d90de2fef451cd4086e47420e0
SHA256974b18aedc20e49aafde1009e7fcf8567fa170dc17fbebc719738e7b290a1a59
SHA512c0e43d9d02dde018722e4b8f002008fc93d3e9528642d286a1095fee6028a3f52c34e1c253bc070d44a25a89caade2e16fb829270b2bf1c8ff28a09313c890ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5107fc401268233a80a909c413c21d3e8
SHA13d9f5794a98af627d4ccbfb90efa2f903e554ba4
SHA256983b7008f45fdc928630e4fb10301f9e61246e2cbef9856b1151b403cfb34c9f
SHA512240517c43fd1232d0ec292acb3274561731d2e157a99f99b8a289209e5ce7263a82ea2f0566456ecdef6ee18d9ab6b97197f01f68ec4f0e21c24f52d608aad2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543e539e52e315fdfb59de8311f070606
SHA1a46ac9a3a16658fb3ab5718107fe9d6304565618
SHA2565f0f327448fd5b5932bfb989fe159128e06542124438fd96ce348ac0acaf3317
SHA51243029640148ecead54131581ed7829e38e90407108759a1965b78694fb1fe04d35a0234b35c064f8f4b21b65f0110e571d45958698c3ed4a18d3b59db28a3313
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a