Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 09:11
Static task
static1
Behavioral task
behavioral1
Sample
16f8a79f0dc61cedacf6e04b77d93308_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16f8a79f0dc61cedacf6e04b77d93308_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
16f8a79f0dc61cedacf6e04b77d93308_JaffaCakes118.html
-
Size
70KB
-
MD5
16f8a79f0dc61cedacf6e04b77d93308
-
SHA1
a8f3157fe4e4392752666ab61eb211938446d0e2
-
SHA256
a9a94dbc99d9fb5ba462135084a43cb337a1c5598b209cd4552becd89aab8fa9
-
SHA512
a0f0f50c7cb931fd72c9b36c900e3ae3b13636cc82cddb60a59e2af1b8057cb0d8beaa22134f8f6dc054b540732fde9c59e21d2893c75fb44b3ef8974fbb2682
-
SSDEEP
768:Ji88gcMiR3sI2PDDnX0g6sE6VHFYoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JdHrTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000032819678429820f1e72ebc881a15f05e1c2b91de9182c293cc0c3e2efb31cbb1000000000e8000000002000020000000e9061775fd5d7dbe1cb37efb2afa2aadb03610355a9aba6e10eeb52b3800c5a2200000008011730bf925701ff1b849153f57148e1f83d12a00cc06f1ebb5d6a625a47c75400000001c53c679ba7521f501115848a7f75fdb072c7b2ad3ac1fc654069ca34ec262aee6df36187cb57ff1f95dbb5931b308a4c5b912acd00e1b5f95f480fad85f5c5d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000079ceaa1cf933a41bb89802b6822a0ef1629da32fdd29ffb629ee5c61cb7ddd2a000000000e80000000020000200000003b4fac9baa8d7f13c948eaa54a2e50dd1d36c8d235209a2f2d7c745692dcdb46900000000374f138e6fe6f168a041b21e0438a0c8e965441bf1e347249739980791dfd500510667406e05e72e87d99d56c8cd18f34d3952b915b4989f72a946112b7646018f632ba9cecc1cacdee7213691a3ecc7141f45d5ff7f313057dbae399b86db43f7288de29776cbba5d828abca8a5a40d5cf1bfe2ed7dbc119853210ae77ace0d03b9f6e2546a9992380bb4cc36fc52e40000000680d58d73e06d569d31feb8085e89b0e53abed46ecbf5ab02d585d7f1010f62e328033d0baa15a767ae4aa84f4acfd3a1f91d9f06ab61343d53a8419afe19d3e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90de0148cc9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421062154" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73703721-0ABF-11EF-B826-EA483E0BCDAF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2132 2956 iexplore.exe 28 PID 2956 wrote to memory of 2132 2956 iexplore.exe 28 PID 2956 wrote to memory of 2132 2956 iexplore.exe 28 PID 2956 wrote to memory of 2132 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16f8a79f0dc61cedacf6e04b77d93308_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58381d6a2bf07b8f1941e9bffad05f407
SHA10fd07eb0602ac22a6a5fb61d8eb57139dc11636f
SHA256447571623186ab161ccb9b2fcc572c7f0445d4f267911377ad003b7fea8ba2c5
SHA51289680266182b9f9fa8d657f2c6e04f86b28f9fef26336c63db88cbf9c5bceaa35d85b3b85cbf7ea7760ed0c6640f7689c653c734a1bb35f7ed2dbb23668c96ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed49dcc9782e874fbfa041cb8020d3a6
SHA1b064795867632aa0b1adb75c1b38d035790c3b05
SHA256164e4d58e5ab728172ca276afe5a4d420328c6461d2f94ab47ef02c9b1247f74
SHA512651c8c3c505dcb7fd9c36d96e12e535526720b03194fe0e9d0eac252d09fda716441505d9508aa436a1212c4800e26ed59d868b9daffc2f454cb7a7b8123b854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aaad04cb8e7610e8ab377b01792b1bb
SHA1d8c00d3788464a5e580758b6c8742c1cb14e704e
SHA256675e74bbcf17c6d479d64553147bd3438d7c02bd4f6d2573e3df73fae7280168
SHA5123da28951c0ed5afab32c9f603cc7f454ab2ea964d7f8764270a90e21899670c2503a0a55f7f2603589346dc64696f54ff502a19a0e6d83f62b2aaa67b548346a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e67e7c454289353016dc5f0e212a1cd
SHA1fc69b9ae75f6dd5d18301fee782cfa60cec1a9b0
SHA25690ef9392d6fa89ffd3fc644f76af4b3b3f367f1461573e3ca12403a9147b9509
SHA512331e411921b64718a228d6538e77c2298312de579c579e265208004baab0f005a2f133c9a94282f7baaf3e08e6190bc5b86fa5f7817c16e6f5fe378a60510ed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5321c972a215209baedae2e267133c33d
SHA1463569600d5ffc6de614a237c0fb2fb63f2d9752
SHA256fbb7bf6654af06b7fa8096415290b9525abeb7cb24cb3e19dd994b89b5cb6876
SHA51286a9b26614dbd231d0a0641cb18963e4b2cd93fbee68884390df184d94102eee69304642ecc0b0076c628e30b5de59bda182c7fe39dceeb75d7daff09f096e0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb3a5aa6fa28c13743d7abe5bd12a74c
SHA18bb9400c2180bd5a19576fb323a7f098fdde4dd2
SHA256be597f5bb417358fda016896a0767bd7f0d2e32476dc993320a3d17466d0928e
SHA512f550b2b9e8314407b5358a4a2a646e6d16b277036f7712e9d8e32493a63ae0c7a92df3cf63f2ee81371cdc8a4db1e8a50946011ce1713c23859c97d72771adc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3961299501180cd8bcfccbbb935b353
SHA17e5be3157047a91ad23c5e07c7756768cf4d0ef9
SHA256e259b5f62f4d3ce08beb318cbc87c1a7512a786f3c55d8ebd1a9b62249fa33c8
SHA51266be4d58f5ec1087f8c0f5852c79bf2072fb58bbd3a23a0c0d97eec373b863b4576cb87493e03931aca283418a0405e1fa2cbd4d8097b5fe921d91c98ba2e479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5031fac58580a1c9c602a88d111f19fe3
SHA15607c5f1826fe8d8b0d8349275c69f50e720f168
SHA256bd03cdb7a24a75e195833d5a8a1ae46284374ebd41e652a0ec7fd67442585665
SHA5123442b4129540bd51535616f2cd2bb51fff96956460d719f661ac51feed3e28ef0da4b85e0ebe0e129c332743680de146eecc59e761f7be6e08ae3ac5810f8c22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5200f4c8700b9711ea3d04410719fd8f2
SHA19126a7eff8160e594986408345f21c7ca9fb71c2
SHA256c38e6daaba92df6fe6fd10bf708015dac296634cc40a24dec25bbbadbe03a00e
SHA51221089823f2020984c72f0ec668d4e88e0c4744416ee2ec20cb9caffe4dd4b170ba7cbeec253d615a6fa595cb4de4b42fc75caa1e04e82d6c5c79c94aa0cb9064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596a7a219dded13b6abeb06438f6cf85b
SHA1588dd8e4b73a6591748e89f9a64abef29b96f128
SHA256f092da5b2316e44bf8d73d2b4a334a3331c1d6e9ec83e8ad858aaf3d7e88863c
SHA512c0e46d3a6758999d4818a5ce00ec56388cfc21b3d695b7f7703cdf9bc5bc6200a6823ee7bc55cb7a34111ba4ee539ae9d7e40cbad514ebdd3bb02a52436be656
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511f23d79ed6f8b58c7c6aa8e03ffed75
SHA1fc878af46d5e9cfcef0ef0aa9f38f178bf2aeac3
SHA25628c82decba03690a150b651e0ad8c9187b35d96e86a3002c932051af32287e1b
SHA51262ee5ed232d55891d6e2d6efdb24b843e7c4cd00ce996bd6b140b14216976ce658e06fdc40459a21802ca423c71b0ae839d2af6efe053903e98144f4cab84e40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab4170786a96a639700d016fde99eae9
SHA1f27337597935c514998a4d6dcf4dff6b8fd414ef
SHA25663978000198ee75b6564f03ff96fa169b108259bcf9aec554333b941fade503c
SHA512346ae7f066fd17fad68ae3071d8ad883877ef8f3e09cad7c7c8450fa2902172b68e586e3c3b8daa50f7ccf2e5b296d5098c81ecf4e79fec709ffe28d7c1ae318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599e4e797724a047a315efe8971be1b54
SHA17a0fc5c32dd69779d20809a498644ff1a1ece20a
SHA25604a9e1f8bd7f13dd845fe5b80f35ee9e1d4cf6c01fd95e84b378b2e4eaf711ae
SHA51289a7f01ea37a745523347d9115f7089f3000f6cfe74941806842716670feba358453fd53a80c33f53d95709efea70c45d70c0e4b857b02a1922603e81d5288c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b655551d7bf12d0f2b56e8fac3eae549
SHA11b7f5650b95ba0af50a282b3c402db4e881179ff
SHA2564a1ebb211935d39389829124c6cc9619fdbeafe216b7a544dd8d081f961f52af
SHA5122e03ec38bd06c38cfd02f83556557def29e8963316a20efcf1bf377aef3802f9477f94af28a0370d56a44b72f55f67614fe28af4c0c839fe49247687f26b1183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3517edcf9f1404153915aeb4347c604
SHA16fedb780a6825559a90ac9fcc34be7e7f80d8ce0
SHA256468bc435d37f8a06b9cb5b5755098342c2d497e90037f72e664f73923eb9dd73
SHA512d8bf0bc94e2917287f72b31b29c0121dc97117a491bde0411e529865da25ad5e10fe0593bdbab4e75422722ae911931216b962707bf2ec35c65ba95ea6f3d275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d4a2b085145bf573fa435ec0e4ab8a5
SHA1010f118091a68a5e7ef82a9d76ff25f2a8ce5652
SHA25621a0f9d8a82ef5d8b8afd1b4e3974a6857104d195971c68ec40089b81e1c1a85
SHA512501dd9d0c76b2bcff4d424c610e240f91c97b1eeda708ab40e2f4dfb3db00aa0cf9ffc0fc7aeed4f5fa7090828c0d4ba8bc628b81180980d2d0e098a301309f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d22588b38195b749c55303ff0448ea6
SHA1de9f50f7fb6f9d01f2182ada63debb9d25072f1f
SHA256668e2d251ad1a407d841e8eaad72f49b1b896966708c5a3589b7884a35a93bbb
SHA5129737e80cb7ef88e092c4ea528d05bbdd9aebe0b79cfa564743ff0097748353558e7e7463dbc7ae37f68339f405587ce45ac7d147448fb76ce4e92e6e91eb6a87
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a