Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
159f2d254c6ce57ec6ffae6d7f78fffe_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
159f2d254c6ce57ec6ffae6d7f78fffe_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
159f2d254c6ce57ec6ffae6d7f78fffe_JaffaCakes118.html
-
Size
35KB
-
MD5
159f2d254c6ce57ec6ffae6d7f78fffe
-
SHA1
bcb1b04023b890699fea244d47211265719239a4
-
SHA256
40b317d40353eb547705dd8221132a134473cdbec272b40e4c0a6a51750916b0
-
SHA512
d7a7505e8d35bcc5c17df5785897dfa6f6259cd01b52734ded2f27d9ef4dd72f97f80421dde7a12ed592b645934745a477a22b9fdb3477db6a243f8796e847f3
-
SSDEEP
768:QSFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34aNi6t81DdRA4vEOjq6h8aRlRV:pFQW81D4RA+vEOjz6raAhIa4g81DdRAY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{726CAA31-0A8C-11EF-BC03-E626464F593A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e364d691ae2f42c63bf0c4d10a322939a65e31401afd5be522533a70e3cffa58000000000e8000000002000020000000796f4723779dc87b12205d5712c82b99b101e622ba71a17b04a595ba8a81bdfe200000002b3f6082304d1fb1d41404bf66483e38ce35ac720d9eb280929b34dd224aa2a340000000e9d24db304ddcc29e223d78038974839f6fcd2e68ccb5bbe4930a2118fb3b63ad1a0c0df774adb2e60bc258193b98b56468ba7c8f44fc204688304041f608cc8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000aab4979769ce042a987ba676a873e566848767a0ff0bff7dfff03b36dcc05445000000000e8000000002000020000000b011e7230b53c637b0db0e17530deb823c8abdb5858250f76d3276f92248e4bf9000000019ee4a3465f93dd689443cd3f9db47c126fcdddee95018c4f976b4433fe42a4fb0a4f8f91d2b2b9e082f908d39fba5be72b1f10c1326c36034f4c984e059b06ddd52542500638049f43d1df5f1b86c154f0771e813a1e90ffdb451ef2f8b9f2eecc67d91f54ad1eb509787ab90c46d8d0a37d1ac34f9a2e1ffb86f5c887699ca8448e8905ed28e8137c1e52257218c7640000000b873af3538fec348b7032fa1fd5bd38ed6b225c08b7ae1249539d3450b935582c82c7f94efd4f486487c30055029778f65885f69d20c7e2d82da7e19f46ea453 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50efc649999eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421040249" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1876 iexplore.exe 1876 iexplore.exe 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2924 1876 iexplore.exe 28 PID 1876 wrote to memory of 2924 1876 iexplore.exe 28 PID 1876 wrote to memory of 2924 1876 iexplore.exe 28 PID 1876 wrote to memory of 2924 1876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\159f2d254c6ce57ec6ffae6d7f78fffe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b75e751938b931ddbd229caf3166f1a1
SHA143a2faaa1d1e5cabe1d77a85cd162efd8262a552
SHA25616dbdf379fceb5de72589e9ffa32d588f5bcb16c26ac0915d95b5eb71017446e
SHA51213b96efb72323279de2b68b498b7cf126d8139584dddb8dbbdaa3505e08d662f55dd02e22beab27cdc94573f1988e4f86672671bb3f4882af4ef5d453bc0b343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea0830c542f2888ed778dc7a1cc9f8d7
SHA1ff67a57e2e32443918e390b34f67d38ef4ea6d54
SHA2560d73430c36fb76e69a9ff4a01a056565cc10c288b1df0e938b2f51809325a40f
SHA512ed22c91767ae48c52664bec5f0572e3179d572e8928f212fb3d43f03a9efbabbdcbbf6ecc9380cdf7f507828728c152ca59476c224735937f00cbce1c015164b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d873e721c176c089fd553ffa1625f61
SHA10843e7109d664fecacdc7501b8ae02f567ba4c72
SHA25632ea94e958ba64d431dcf7a1bdb890db462f0ed31c3c79fb531ac2334bf74785
SHA5124d44f9c9767a29bba848988c7e7d0eebe9dfd56ff45c94f11c07882aed5d931c6acd8e14eb4a0eb89610daf4007ac7b858cc1fd666f9b2e6e4b08b1e49d3f820
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502c08d997bdcac6cd2f5af0d9bf278be
SHA19f9fada4012be2730763cee5e62e0418b87cf9ed
SHA256f4b0ff46be4c087fc0cdd7baff567361ebe7bc089ee09f81dba7e9eecbfc3847
SHA512f6b1b9cca6a4fc68a2d4ba21edd0d341801931c0491d30a4eb5f84cc0246877d03feb7a8a71e180ded77596f0df72decf1d5012e587a3f45fe2d0805cef5c7d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0cdc2ee27200bc6187ad7c0aae5e256
SHA169f3182c198a41a74b612e5ac17114d4cbe423c5
SHA2569fea199902d8fc3fa22a3692c0c5e559a63a3ec0fb3daf4914744e569a6c092a
SHA5124cfc4b53fd50f5caed45420a10807ad1f61003685f8e28c40088c2bef969b035ffc5c6730672d9e09e52b4cecbf03ec8a8e25a40004a916d1ed9507057d53039
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5154c41935ce6fc0b9a594c369e7a640b
SHA18ca3c8390b33ca37a78cf2e0f541c52380b1dd99
SHA256af913c4218fc1d89807385744138cd7f97613364b4e0d209c0ad9aca96dda44a
SHA5127961f97321733720bfb298d4b64a9a862cfcb63b855e120eb32226aaad9de8e003139474cb095f7a83aa2dc5fbcd047dd60e70576f11b583f6977691c432d0bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567f40c508c446de96545590b3c58e862
SHA1ecd3095071dc6d7d1372289d2a3bec2f4931c73f
SHA25640be869a39a2f3e15c3ad427eeeaf313b72bd39e96535024488db0238742c7b7
SHA512e87f0668cae686f0d4032bfc691559aae381c85807abbfdf699028309d99d16b5465f40e54e46688b09b47f00b1859ba14f3a764cbcc977987f81b539086a691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51db1ca15ecade514b032ae62bde97b5b
SHA1e5b03413e9975ce2777a77e6ee791bac1959f9cb
SHA2561467a23e8aa588fee01dac20f9600e7916664e83fb8b2c83a5243f3fa1d4356c
SHA51263e2b2495ae9f165e1d29ab289e4e22e4e785cb5c191e9ff17230d46221675691a08ae11ac9c4effe41a4dba95cbeac3251148c9edac4c905e5667cb76f9626f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53792799f2df8b1fd69e8b994a726c8c4
SHA1fbeb9ee513554be583371fa614598d0fc5b734ec
SHA256ed5bf969f5e5e0e96d194750b9d69849e84e645c9ceb52a3a91c4f1347131fd6
SHA512bd0a48d086a91076da267b10a3d6378e3c19594dd4310b2cfbdbb3907f186e43c844524e5242d9bc779e4296c6cdc4f45ece7223738a6e5f9da587ae4e526bea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb718cbba23b3e6c1f9ac2e5ecb9a2b9
SHA1f2e165132214f50e5b9a63e93675c05d651342c2
SHA256ab3530f770f9ad8907bbece5257689b183c4337ff50129b8cb744b19bd813dbe
SHA5127a185dab2de1bfbaa7c09ff0b5f5926057f59d1e6a2bfa029e43fc81ccd936f0779cf77a500f10d756a5f3843ce82315854a01199b44f60d0d14c6b6008e5b15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7244baaf5b0aad406a3995fc47eb26f
SHA11ede739652eb4d2c656e645479cbdedf4b83577a
SHA2564dfb59e5a467b5c0108d19d3ab28687ba25ced3219f82b2ab06ad451980d9841
SHA5128eb22b0788acb211c6852b872b1f8417637a69892b1edd7c6144ba7198c7fa150e27a6d1975e3503d08ba469228462a980a258834d61e7c59db34347e5e1526a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518821d5dacf19df081c72f945d9984a9
SHA178e65212462e2904b0eb31c51a547176bc3613ca
SHA2561d152197d0c4639ae40389fe340bcafbe08d2fa3dc610ebbbe69ec7705e19104
SHA51211d620a6eef7a2700dfefb26eb810ab78dcbe34c59c20a56da087c4776ed0ad28ecdf59176c55d47a2bc96da88c62bb8f3d2f5410601a349261843b64c93faa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD55f9d75ecc41b189e7a61ed3012f6a7e6
SHA1f0d352136a755c5409b403f10894de6d10eca4fd
SHA2562fcdbb5de6248906eb23f2e8a169201c71a8d2a6d8129cc54b501ed295fe2c1c
SHA5120fac8eb3e6339e4e3a7def432b4429f99ef4e6dc4c828b91e0a75002de6648724ef280c43b4c25b25a5ea7151400cab959bab13b38902bb004e841b48f9752ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a96d4e5c089ce2a3494e3e2c2760c1a4
SHA129f808028ee5b2d0bfcd84feffef8ee4fe21d882
SHA256d94e84039f0303836dd01e750b25f8d6d5b10f5335c3bccafc4d28226f31d2eb
SHA512e6d61630c913d804b7b77a9695396e58e851673e957705fa4f4a442b4a0312adf855991f4433363795d3d694d52902ab7594ed360911d535d8cd15e3f53e5b71
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a