Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 14:16
Static task
static1
Behavioral task
behavioral1
Sample
13171f2654cf39947ede1141c3c8c9c9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
13171f2654cf39947ede1141c3c8c9c9_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
13171f2654cf39947ede1141c3c8c9c9_JaffaCakes118.html
-
Size
62KB
-
MD5
13171f2654cf39947ede1141c3c8c9c9
-
SHA1
b3a56baa5fda639c8827297ee08bb0ee9b9bf2cb
-
SHA256
1aea7194e425e34b83b0b45c7ed9a970ae4a89440df8170baf93e556db25e69b
-
SHA512
d71866fd3538afe2d655bd986ceb3d32633b27728b2581d75b532b33519277a30d47d75e49c401f983c8f8edcad9349e51f9d5fda9867be7345067ea90c6d116
-
SSDEEP
1536:JhwJ4Vz4VPLkLz4VcThpc0zbrga6vLNniK:J04Vz4VTk/4VcThI9TZr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f214bb2d9eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000603eb7b833f10d92fbf43df0cb516b4d77a05ab6aa14bd26998c32c446ae5005000000000e8000000002000020000000903e2233caab7ae798785df80eeace37e963f5c57e3cd3ed6380b4102c62cb0d90000000fb64f4e7802bc675b9aaa284eeffd94495953694110069d6e286c9f4f209625823ccc2446036be593727d726ce91791bf1ad63ba1f2cd6893f2658d883a11ae7b1216facfe8c09013397ab842570f72841c9deef05692d86ac1bc35a8c5f3549a4504135ef922f83ec8a4b11a9b7ff917ca825b1d07987e190ddb0c8456eaba491ec9a31248d28504a3eb202e9c1514340000000ae844f4b8278b49b9b5a7c17310cfc14ad60917903881764e54ea45f3f8754bc3ebcc79175bd4fc5ab539a06310e3b29e0c50ab242937cbdaa1e453b172868c8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420994057" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5BDB8B1-0A20-11EF-9F01-52C7B7C5B073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000df49b19007a36bb44051f7f49be652a68a30e5287f9e38a70c9ed79a8c1ddfbf000000000e80000000020000200000009feb091ecd88a82c49050bb4a6365f695436eaba881c4a083105e2a447f0f306200000002d41be3d55c61a0a043c2b5ee2061ac313a4307d92a5e273bb1c236f7bcf3d2f400000003a88548fdc27414b8c43e3fdb8afa527920863f4f8bf6a43f16eb6a34d6d8888160ae4fabc9771f52c0ceda51c5f4c1e2d7b247211ad19f9625431aa200b2fc6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2764 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2764 iexplore.exe 2764 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2896 2764 iexplore.exe 28 PID 2764 wrote to memory of 2896 2764 iexplore.exe 28 PID 2764 wrote to memory of 2896 2764 iexplore.exe 28 PID 2764 wrote to memory of 2896 2764 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13171f2654cf39947ede1141c3c8c9c9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a28cade07dc024bf446fd0c79033e39
SHA1dbc717e5073827f3fa06b4e39195608832f2fd9d
SHA25604e4adfec36d63778add4117bc56e51849e18c8bd0bfa3a59b7243fc5708841c
SHA5122b3cf812260164222558bbcc5ee6362a53691eea81c55ad8cbd1c619b83fd5d809429e6aca8f038d67d4b108e5749072abbc198206c7fb8a13402c23a25e3256
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d03f3f6ae3db31390f1fa607ee826206
SHA16a04ae6cd86a3378b1161a6f8f37ce01c3467499
SHA256243b5faaf8ee5323eaaa36e6a4f79b740f6d776a4de229ca647044cb1419bafd
SHA5127dd6b96bcb240190c5d35afeeec83064e2eb702741d45d9dcb3ee1a05c56d4bd6f05137faa8442e0c4f648ec55690fcc25bdb24a3415f04a7d5775ae9cb593f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5595bb6ca708aec373d650ab54c39d9d2
SHA123ac1a13b8c8f7b5ca44a55d14e646c76972cfb2
SHA256648063d9f452885c16202af24ebd70bd2f57a25a3b6f4deb721fe069ccd69260
SHA512c04837895a7ade59cfac54c0bfd49b512987ad0e40c83b25cf5198321d11b81b71afd1e1e1d7bda9da2057030a8bb4ba18aceb1337020d88987dd9086c59ebac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fc2208e20234504f2e85db0a4cbf4d9
SHA16194d23b8bf63b979f6b48b788577552dce5e08a
SHA2563e5df986770013e64979251002f9207dbbaeeec709d73b7b69bc830044b86ca9
SHA5124dd20350bb245d4d76adb5e45f63b79f01617ba646ec3aa78bd05789437bbe13e4cd5eb505106d009831c26c4c627c7d19d5d2f1025440d520fca1ebf93a3960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571d2e72568801dfc656dd9101621f51d
SHA19ebdfd779038b59fcbb2334a263bc82f977288d8
SHA2568304b307366b957d3b50436f40d5d652344d3f4899954e7cba739f4b8bc19bd1
SHA5122f782a9ca0679fca498b506bfc97b213d9d33c852640471331ad8bec47f5813372d9f30159e817a91e875cc3e6e01a0275084bb9cf75c45b53ad7e4fa4ae4790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589ac1db16af56cbfcb036660bf9c8104
SHA1ecd506fbf228eb532156a74bc6ab26285586d3d0
SHA2568805558c79a063fbea504264b9a795e87c7b941c25faff0b702a552035eb8f76
SHA512bb3b3b33b9da1805900ee788ccbe6fc51f54f6dc5474f2847fccf079f7a6d34df8bfd86d342a8437e2beb6ed5d7c7559fb3872b8fb1b6e0c33b6ab4d96dbfba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3e1e9b7d5d221a74ab628f6d401baee
SHA11d342dded114826d6aa18dd9a3fef7e68067ece2
SHA25692699e5f069be0a65d4554f21b93ddcadbf9f731f72a39c2b981304e8ebc39b1
SHA512dcdaa6a7a59049a16786d423cc5cbdb50bab58c6458c5b52bb075702306ce333517285e1f9878c1cea262edfc4554f5cebbdfbd8f7c5110f25ec78046cc641cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eed53ef5b37e0d105aa2896217662257
SHA193976dfa920b91e1b51c286196c6e1e6bda04d5e
SHA2560bca677c0b6a9827f0ff4a94fec0a1e5ff274ffa1d5361e2ca6b9c468f2c640e
SHA51226827868f2ead54aad5cb1ed010274e3dd2b96b7fde349cc842e1dbd328eab7dd4f2fa46f20d5ef1e9b515d211d03841e894969fdabd36db156f6149fb368055
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1bca17d7f5bc1cc68336f79666d495a
SHA1b42e318e7e70bc9660095e21ec9654f88b8ff0b0
SHA2561ce2e6e77d0d88d1a177c380339adcdb937d701cadd89f6d687051bfb5337bce
SHA512a5d809654a637126c1e009b0e2185a71620e84b4cb753da7d970e9258133ced9d618c84b1c15b90da9d4e59fcde01a2ead8bf9da999d08dea1a3e55f00efb8d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd1b020b5dd823fec6b2e72463569305
SHA13e136c06c97ad2deb71d2a56555ee6feb22bc802
SHA2560a68bf6987b8fc0cb1ad8b4f70aa38491d2e983982559ffcf7147b86466f077c
SHA5121b9ddd4df5d7d14d7670e30aa8c3a5ee4b4ba974668f14d536c53944356ca28f7a8a1abe8adbb74de72a0cd1003b930b301ad8e072f0156377e5eb600db3d258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0b3a4fae7847d6f11804895be037dfd
SHA11cf3e3200bdde21460572dc25b2c692b3cb469a2
SHA2564a055189d7f0c08140f3bc76bbfe22f87ed1d9fefe14273cf3998483fe4db774
SHA512871705b1cc3cb28ffe253f6db66a26f3a4c9254c1f2aebcd35b44f1a38ea4bd7203f13c3b3ef0d54af012e9458b0d13fbfbd86b8fb9750e0c5ce71cfd4ad9d46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d5dd0f52f1ec794c407a3809d88efbf
SHA1ed2423da9137d2006121a7a1b519ab85737120ac
SHA256e2ad5f4dbb72332f91b515497eeabe8b54cdde2e91c04cdd9248b508ff95a3c6
SHA512d4728d79ed87c58aea39e42440c5b483f0a5f007677878d57f154a6a9ae19922eb655129e484b2e325cf0d1c23bc36e1371f5c39a572f809f60ef72b90e357f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5509eaa64ebc505daf4a2172387b9cd61
SHA180b88d7d6241ccb84ec894821154cfa5cb558677
SHA2567ff71efd1c14cc41c6386c5c8a87b2ceb30fa631fbc04536fc35fe84f4c386dc
SHA5125e8ef315c273ae54f8ba6669d32894a3d4adcd9c21e81f9dc66f9c62c855d14b48874c3d10aadb191a198715b6552e8d0ba126300060d49e3bc6d6af0c72254e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c364947d11599b6375d9a522ce39667
SHA12be528ed3a26218c9f39ce6b76d08d2ed04a5981
SHA256dc7693ea36256e0cfab514c4c7fd38b7c463cc19a54cd5425253f95f0633cfaa
SHA5128051f9842ef0870ae793dc24b12d093f7355f9b7c28fea3ea1cd8b4f5f95c037dcc34045efeee0e2a3bb51b757d7bf9903bab84fdd0452473043b28ca2f6d0f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebbdae5e741e69b4639d3cb6acf4bb15
SHA1e663a16117a23af1553a7f662b644ec97942fcdc
SHA256a0fddb32cded9a106c8c8428ab85135275401c8d61b61eba20d0fdcab2b7cb62
SHA51261c98a6617b0cedf5a8827bc87ce212e634540e5e0343adc434eeb25204cb4c6e3fd943a8be41ef229a387eaa8e0e8eb2968a7536ef1b17764c99f19cc6b666c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b807c12dae8bfd5cd11d451040fece7d
SHA19417c5099ecb94ddf65e496df6dcaa58fc72d7f2
SHA256ff00a88f0bf92dac6c1a346929f29f2e82933706ec4de7798a322ac881861990
SHA5122a885c0fd923b676d6d462d00560bcfa7964b02a6cec585ae73b647f7244246d50fc10d49f583f1b94e02b929c77d8ea1770b2e1ddf78fc2a78ff66a09e15a9c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a