Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
106551ace17d00ddd8d4a9eaf0112c3a_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
106551ace17d00ddd8d4a9eaf0112c3a_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
106551ace17d00ddd8d4a9eaf0112c3a_JaffaCakes118.html
-
Size
189KB
-
MD5
106551ace17d00ddd8d4a9eaf0112c3a
-
SHA1
8d300526b12a7989d692d8e245d1dfc9abc4885d
-
SHA256
41507e3bf385ac61acad24bfc55f82f38d0f92f7aa47b8a007d77ad407784426
-
SHA512
81a0de0337ce7fd67f3b8fb754050c5c8add848fd274255fc04267caec3078330051804aa7682a65ee8aad5b59bfdf16673986163a5d583e635d673c989c2566
-
SSDEEP
1536:dEmNGZqnIYnyRZWS5ogpuz4fQpp1dVWHGZ4srV2ERZTxAHmLcZ3xt3VSmFgN:1FkyZ0KNvLcZ3xt3VSmFc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420897183" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{586D1461-093F-11EF-9AB8-560090747152} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000007afe3ca2364be126b8e701176f3880f8b8b1933f7471e5ea594114377efe66fe000000000e8000000002000020000000f69a29d92622f29ba7bcbbc0f499bf501c72fde5eb0aba0a56537f32578fff4220000000d9d39d6c8854c08f13556e7543b0b40857b889c802cf5fdeed2290e7a601f8da40000000103e4e07835dc2ed0cd436522cdc705eb2f1c939d6cffb9b6c8f0be956b48b12e5061cea092dcd2908d2999d94464de85049a5497a7713a9ab2d6b90494b6320 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000483626de39e1682a97a40facfcb0aa852f2fb6c5d93f08ab7469005457382b5f000000000e800000000200002000000096eceefd861b5b1949e254ac47a5c10c7b4cea615800f893c0ef5e79a4ef3d7990000000326205906fa680d59fd494b7a494bd3d04ecc6ffe9319df780af05792eb23477ea88ada94bc99825a9fa8c8991390324baa8a1fa1372484277881a0eec69257fe29ebaa7045bc9875ea9e5c27cf7b52142f4c5d0a4a71d8543daad96138ad385702eef052ab1f57a04ee67fa5f8353fbcf034b5e0446cadd88d63a5bfc2c102bae6463165e8a01e2aea70c67befff2b940000000b079d54970489f4bb1f55ddba78c2bf43bd3c1203f9dcfbfd6b69cae8af64517ce112d12f68503362ac9f06c69be17b395a31e015b189aef42a495e721390952 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805e505b4c9dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2832 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2832 iexplore.exe 2832 iexplore.exe 1504 IEXPLORE.EXE 1504 IEXPLORE.EXE 1504 IEXPLORE.EXE 1504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2832 wrote to memory of 1504 2832 iexplore.exe 28 PID 2832 wrote to memory of 1504 2832 iexplore.exe 28 PID 2832 wrote to memory of 1504 2832 iexplore.exe 28 PID 2832 wrote to memory of 1504 2832 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\106551ace17d00ddd8d4a9eaf0112c3a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b6bcfac0ed602d47f6e044f4bb226e91
SHA1f435f51bfe2932d19c2e4f47902b1bf9d88222a0
SHA256d6255331e95bc93e11c2619fcdbc69b8b65008e76de0f020a81650f04535bbf9
SHA512d80b5c82acd483ff23c0a506e1602f5eaa6f61a088d40684869d6df14c94f348cc5cd08f53f41b79c1d12ab21f8f28195d7d6f0c012dd7f2fa8ce9721835b47e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a1a1cb77a333c142fc1f2e1f0f37ee8
SHA111be33a470d8dab8ee4695a36ab1e8ff8e59e22f
SHA25638e442c280ac2ac321661a9049d9d683339da748902b12cf1ff6959d8bc6c4d2
SHA512c698af53b5699ce1d3093f81bcda1d49ccb2f1ecb678a78711df8e8b8151cff098cb29bbc65a7630b89438f1eef46f1f98afb2322591114d639ad912e6740286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eea36094e18f363da4aa39b194e2ee46
SHA1d8c19473e7625c5b498b09f7af9364da02901909
SHA25647e5bdc6789dd26c369552852c6998f070b4732b3f0a36c12c7037b077bfdbfd
SHA5120c79a154fb5e37560463c3dde2c105142348114c17b241b0d410853c0214895cea6d5554f3c7c7a9a322233ef6aa510af8b70e8e444eda886b82d6f70a852f5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536f73762bae32029850eb62fb421259c
SHA1e28c11dbbd8e87758c33f32d90ad7d33ffa71154
SHA256331609f247467108404f06d799a5c515b6d3ce7620f72108f80ab6f2b2d25af1
SHA51238f7f6ccef4392cb8c51aabac4bd629e16de9afa8186400050feade3b18774fbd6f2a529227171f9137f0663be70c681d6b5a36057beaafc4981f563a412cd8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e03c79126a660a88f980570964cd5cf4
SHA1a36430614057ef793a75a0925f21ec789c73dc0b
SHA256193add5ea714372099db3fd20fd1ce496d7e8141262172e2fa5ea0501e52d740
SHA5121b8fa38cbeadf0d06d7fc9fbb017e9a4e4691ba91495bc65d3bc450907686908716d3c1259657f9d4fbbb848fddef4eb9f047b84966440d23bdc26d3307c52f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5331a63a41410cb8069769a4c1482583d
SHA1f4b169b020f92fddf64bd793479ce7e929798fa5
SHA25626d84a539a3cc2a4f969ddd4e5d317a9292e9b58d11886b46fe88e6ab28fdca2
SHA512bc32d267a763b87a0384194cec11823f84700bb6cbcd98642c2c66731a553aa2a8ac5d121bec8ddf3e5d29333188f363e5eb3f3b8d1f2c3f5001c39a772aa349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5462cf4c5486165940b2459a59b36fce2
SHA11633ce01bc03a5619fce14122ef08e9cb37b7684
SHA2563bfc441cb4fb4deb4ae7c2979b0c9040d419d23c6e08e320b7cbb5ec4302f0bd
SHA5121abf412d9593d48e09b208ba957294dd83f2622e35d94356feec9f9ed9e270079908d42d3a0eab91a9e7715b8655c81b9cbecc324737a511170815ac28ef9203
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f3f59a52c251dd56625c6ed8f92f559
SHA158c6812c8b8c962ba73aa52459dfd4421fa10f37
SHA256178005805fd83120187772f10d9a90994990dd380b52cf386a579b6193291769
SHA512622a1a36e1c91256c44d3308285d98f5945f617fe94518c31caa16c264376c1d9f23bb10fd1c9a6d47b1edb9a801ce7f6932d91aca72cc8bf99fe4147d9ef24d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f81ffeda82e226c427457b3d290bf2ad
SHA15faec3741a91c799d1d4ef51786587d9e5474e16
SHA2566392f21f6441fc35c2a81179cc2e66989688b58b45351787fa31713296e2cc91
SHA5129d51e36e8a78d57088a9dff35b1ac232ed3af63d70fd4a5ab688888398dc48158e48b267ef5fc7b2c5d29cccecacbd204c0ad426dc1590563eaa1643c8976abf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55652219d5d2c8a7dd575ec36c89750cf
SHA16e1cd469fb5b9342fe0a4c47bfc249664298cde9
SHA2560f57500b3ee8be0c87f3d3affb1f97d89637c8280807011eab3aa995bae31856
SHA5122f6542ca8eca5953b7dff66bc314eff743a1c984b9d39b480ccaa4b9fc1d442365765385fa65fee4a50aa6b3280ed9c0e862a9b05c069c5f06114148cb110ede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5376d83d320f062736457d88570a76491
SHA1e629e0e8677678e20ac6e5e539678f85f35b8164
SHA2568f3552211c536dabcc4c0209e66f872d279f08c9371886f423896b7eb4c0ae91
SHA512a53d9325a8f7ff415be4f80a58ab06aea215004f693700f8eab469275095d99dc907c6d649fa7c61e6cd95f12ade485bf23d08d96f955721e613f0a607f9282a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5724f152199671014778db63080bf8923
SHA15bc420321f0e698aa826822a7353f5165dcf0c7c
SHA2562bd66c4721fad335698d0a5ce4ba7b14e1f55c0c47ec3af209d91de7f68fc157
SHA512da29d3a563823a346a068773f9ce1b0e2b8832d157f52388a3ee23b874ffe3a2c0536e6063223a32f2a43c2906003c1e938c0419e25f93aedcc5d326daf2c7ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58d3ff7a4af7dbf7e305df7fe8356f83d
SHA12baa61168dbbe3e2ff921481d289e15b4c0a6e90
SHA256d508fab11c413c79adf0173f25ac0d1bbcd69bc0858a70c4199f4d716fdc7cf3
SHA51269e4d1678bb3567d6f4391d6f7414ef7e87e06e532ad2a9087817f57e86996bb450bdc34a9b7d78e05dba198a71d7922e78a61bd7f5c8e5f171029b670df3096
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a