Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 04:40
Static task
static1
Behavioral task
behavioral1
Sample
0fb068bf27467ddc8762b99993177e61_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0fb068bf27467ddc8762b99993177e61_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
0fb068bf27467ddc8762b99993177e61_JaffaCakes118.html
-
Size
631KB
-
MD5
0fb068bf27467ddc8762b99993177e61
-
SHA1
5b62079df4c6d371bd4e0b88c5a406be2bdfbac2
-
SHA256
5f941abd4abb139cbe3829715a7cb7a3b5f609704822ae38f4e7d9c4c307f5b9
-
SHA512
242eb90cc67d0710ea4229730351222ed4fd34fe196995a5d6317a01ebb84f2521115bba7dfa51d03a30669c7d67d1dd4b2784f7ade6d72268719c4dadfa95f4
-
SSDEEP
6144:S8lmsMYod+X3oI+YVsMYod+X3oI+YjaL8sMYod+X3oI+YjaL8sMYod+X3oI+Yjaf:JlE5d+X3r5d+X3eq5d+X3eq5d+X3eL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401d220c149dda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000003bad7574e78f273c8727bb631ce157a21d49ab604cca5c5a3570152f463f46d000000000e80000000020000200000005a7ca14a6bb2f6ff9ae8363b9e612d82154df8e66e5a7d7a28a4cf1658941f8d900000009cc360703b194edb59065924eaa6b9dacf67d1ffab814386f5606ffd15d40fbdf4072ae2ab0ffd17f17231ed3376534e432b18fc2bd005693bc07e056c7a56163fe67a96497cd20146bfaf1b2211a362af4bf2e9c082ea64da82f5b15464bcb683d01183258e323e9fb2b8c52e18f565fec00d6f6751f62397c556d7183c9dc5762073069d2416a5724a7ae448e2512040000000f1d23fc2c9e965940c3f145e3386e48c852dbaa0a6356b68b26d810630f194763d0efbe16155852334b392d81b2552d3bc7aee7f2044ba843dbe82d99fba3e9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{378755E1-0907-11EF-8840-6600925E2846} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420873075" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005ebf4e374b6194ce39b92568dc06721ac9ee2e4c25468bb77e585780aec00c28000000000e8000000002000020000000bbd2ce0b3ac24d597244e451c8263e71ab20cdb0eb7381b07453c4af05b91a61200000002f511456dbd3c81b8d8a1a74ff9f97fbda5481a6ac2529b73566d4412caf42144000000057b7eead1756c652e3c7ac0c6f88adc18ea1fa4f4be6626d49a00dd18a840dbba65236e9300a78ef5ea356df2f9628b237f3c445af025dabfbceb6e42b07cc89 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1668 2268 iexplore.exe 28 PID 2268 wrote to memory of 1668 2268 iexplore.exe 28 PID 2268 wrote to memory of 1668 2268 iexplore.exe 28 PID 2268 wrote to memory of 1668 2268 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fb068bf27467ddc8762b99993177e61_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4c6707cfe5b1795b91cc487683e7bb5
SHA1476b1ce3fcb90a35063158f0ba3396fabb213b67
SHA25615a2be21ba57f6d62495af80f1c1252b0346f6b81a46d08950d405fcc0f0966d
SHA512086a96ff35124a368595635f903361902d6a0c2fe30779075fd014729d210d69f9ed3fa600d2d6932469dd4a30d66a9dacb320de4b2fbda551b15af030bebdfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50862536dfea8909fd4f805cf60943994
SHA198980bcf3368d063d9a8861914bbe8e30e83b582
SHA256229c866fabc56d3e04aa955a043f1cc212016330ec9f1d92f040acb12455143d
SHA5123048ac5d2d68971f325359a1f0eaa98ba0b2ec19deedd638d6f6077b78d000937d006fa9a6a8674766f3ba54811371fd021162e673c27273091ac0bd387609d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5591fdad90ab2a616f1c27bd08e5fd52f
SHA15ee0ec57d3d3fd53853b1eec8733c267aa683d2b
SHA256d1ef697030e749c73403d794091a2ebadbfbac7d03d98201a78cb67e557a2331
SHA512d6c1252bd31f5df7643a3a724e4ad905433d28874f397d83b7e7ef8d33f5da48f2ef1a9d67a23e1516fd0921c6e8237a980693ce2e3831ab722201a5c3ca0460
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d3459abd59a359bf8a89ce19cc7277d
SHA13149e217b5236815927a9370145ced454de106e9
SHA256453b3fd7c0e4ed2a4279d437a9bd04f4d5052679ef288c625374299f3ef5a8ac
SHA5120e54ddd8d3f25d8c6d722f80bc9db788f2fd446b5cbe4071c60c0a041b5d95abee8c115a2bc6612666c117a65f1315b27f80f5d2258bf422e8d8c44eceade146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e170a0cacda21e021bd01d6407b1602
SHA1e5d71fa0a89f6f055dc1b8ee4fa1b4552839eaa2
SHA25628fdd78243e684ab0370cd7d503a31af99bc6cc4b57420fc8a69b70c530ac30f
SHA512bf1758e8d8107356d91dd56a48ec549012fdde63e0b4f352dbf86d263f93fa25a44f4c9e4c16ebe6f39c612aaa9505c24999903f3452d37423d580ccc7d037a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5037699dfbc42f660247fb42993b394c5
SHA12eded11dccec100dade6d90e13105033ab443432
SHA2566c1514d2dba7a7d7a991a8cde295f3781d777d05d53dd4f10a0e964453ac0449
SHA5123a1dcaa4101270cf2459be533c23b4f54c7ba9356e09a6c77a4d5509888401f30395275a46a5741e09f4f13517fd43b653ca3c93b8202d48472aacd9c10c9dc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d06fd09be661e05d2213a5428c94e4e
SHA1fede18c8bc5892e8baf9a646c50a9881f945165b
SHA256a5becc78886d780113e5ad6cfedb6e14cd214b6dce7fb87c6bece0fe3691ddde
SHA5124abb5a7e3460ba8d5793c816296c66ff0ad1d2dac16cb08e6915f6b7e3a84d52b9e7a4235a0fc9fbca8d0bd7af0501322ce9ffbc7b65c6b0a3f22206e8dc2ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53235701c6c58da311a05950bb528b836
SHA15869735103c048c632ad8e9f605361e87a0964cd
SHA25666768f9ff8404e5490d31bceec100bb8aeb44de9a254d61d6599c570e489d4f6
SHA512d6eed9d5840bc5f5b6b3a7cc79b2674fe241db78f3fe646f3a720fb5cf961885f3e3a37b410ca7c5626b57f699725a0d23f9c5f25f1eb50045312796a48a92c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4f8fa4e3fad7349cbed063788c49446
SHA1c2c9c09413e9708654a2b0247773f5d8d747b146
SHA25660f21b120d61829e50bac573b07c3bfe81c066a3654580bb5b520b9201bf16b6
SHA512cdfdd245f4eb2eb20b886aad41d3ddf7cd61252e3fb91bf93bdb1e8a94359cc54dd10c8570b8cfe08625a1ea4d9ccc50027cd5122efc6c46391a32a76f9b3c98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540a6cfce8027d76725b3c71f23d61c58
SHA16080a73c23b56de3567b40a7d4265c982fc33311
SHA2565d56cdf43006308bdf0400dc34b23a6f77a81dabd3405e3e4aea0bbaa6650652
SHA51255f01aed546a2d194fd37429f785f2efb78dec7a9441178d7d4655e98ba78e81a13682d597cde931477c654a261842320e728634b8b61f863465fcdff05ca0d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a123995d7caad6c6a8b2dffa4972388d
SHA193b6b2fd3fec2a9c76f8067bc2cc085d684da2c0
SHA256e7dcb46d8a9222915c1bf9df91157b79f4406c7eec01e53059d551df71a672dc
SHA512c835e22bf5683a8a8380c6d840b6ea3a0c946334381d5428abc04f8021de40143005e3494eb4ec42dadfcdfdc8e6e28bde34bedfd86334bace0b471ce54ed7ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51022b1d01b480d80cf0ad204e3a4ce68
SHA1e8530b74c1489cc6e8f814bd526dd113dd2ae039
SHA2562fbca158f04dcaee5408d4a016de79075adbb731e442d1e0ef265619119b5c18
SHA51236d2c7812285a26fd0ed50c029015acabe941c906dcf50dc97f55ed3e2dd2057a8a00e2be52018adefeb2b6b2c00fed0c900d4b4b8f670a1a49d77e0fb624ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f169ebd963f5c2a41bb9211f5926e90f
SHA118233c1931b03d876e915df441244122ef76e3b6
SHA25609498ac8413c5e559994d41da3a1ea4878b23df8443e7ca427d0a79bcc97105a
SHA512529d3aefbbee2d8e021049a26da8b5eaecb604f895b170ffa3e5273d91a29e4f69e3722e76b14d7cb7986e95dc52b36854391abce15f0b55895ec3c4450bf904
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e61e5e7d47069586bce59f9cad1664a
SHA1b4cf6c339935299d66df1abfc8ef0563af0e1a5b
SHA256350429ecdc9da1b326513729a438f3f848f76de50cdedf5c0c4c141bf8c33459
SHA512f05de3516964c6a75489a96b7dd4b1a45dc3d6aa05a1f4831bede73b98f9fa32abc925a063440221686e58ecfb1860afdd7a485f195073c3d5dc9f467dc4aa8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51254216bfdb556b2fef79cd856846ef9
SHA16bf51ebe9f3a1fb8e0be1cd21bbac12e7e30de09
SHA2568440ae58a1ef05af17ad1e3e01a4ca74ce6e56f2c6cdc2f7e798d3d049679d35
SHA512761df6c1d4d0d4c5c7615c6b266fb3af90b5581e88be3e6fdcd01558499ce2f54a6ad1a008429a3af4fea67e7520636407e700b38ff9cd26a2552e351927f0a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3bdc2f56ff17ef5694f15f6c0385ad8
SHA179b71e720ac9862fe69c4daf3181a553ee1bccd9
SHA2567417a51780443bb97c8523e5093a82e806e5dfa2c53dfbdd5c5674873e8ebddb
SHA51256c88ebaa5b40551f12a5d97b36cb60bd2376be634ab4b89856c1cb79ce3c253fef222771aa5e0186e536cae5f16d4826bb777a5d0eccb6e775a701650703135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b126ecb429b1d424f6ee3e883a48bda
SHA1ff85e4080eafcf926ed0c3a8ef22907415ce5585
SHA25626dd7ae625610d44ebbe289f7f8ca16b9c9cba9a084cf491fa12501e55fc7b5c
SHA512803d1d1802abf03b9084cc2b81595657fadc5c6d26f3c1a983e5456ee7265c9d8f1980f536fad02aa2e8c2123db21d4393d2731de30019e9aed346b924e146d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5ba9b3aebad65a3fa26cd724b63a39d
SHA1a5f8c7566a51df9c699817b35a28008022331da1
SHA256d2ebece650814dca25df08d083f6a6985723df23338c028bee521087a8e70327
SHA51282d3c9792475cf28a80b240afe4784354e3de046c0a63ac6c7a19f80fab72d56c118c2d6c40b0d195b95ce86251b16acd12b46315c8dd373b5af0ba9e21e0ff5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a