Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
20bf762b6b362aa4271e6e7a2db10666_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20bf762b6b362aa4271e6e7a2db10666_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
20bf762b6b362aa4271e6e7a2db10666_JaffaCakes118.html
-
Size
37KB
-
MD5
20bf762b6b362aa4271e6e7a2db10666
-
SHA1
207ebc93a90b611405f63d49345457fa365bfe5e
-
SHA256
94f5a0777160ec5ed6b8a41474629e20724bb3dcc361d62d09c1ec363930f835
-
SHA512
27fa7a595d84caa3fe94657b12f10751d74c4be1115825d074acb90faf9d5d0d4ed52e93ad82bca782ebc01ce0031fee55f774134f8403d9bf361b552c7fb595
-
SSDEEP
768:RiPXq45R3M4pPBeJHfPccEdGeNQErQ4QQw:RiPXq45R3M4pPBeJHfPccEdGeNQErQ4i
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08ab39386a0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000005675265b6c82e0d4bc80d67930a634588ee53f4174f08ccd8f224d2cedc174e8000000000e8000000002000020000000e87e1494e81e3b1629ba45713867a16b3dfe10ff82ea1aed7e28193dc609293e20000000fdb215e8033ad512ca87858d8893dba26a8d13d24afaa06ac28435680d9710204000000021648b9fddaed5f3fb299714228d05c4d2b7e0a3580947c8cb826828ed8cb8f7937de9930c44afb60233bed27e06163b1b283ee4f2ab9471c8e55bf1c3f7662d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421252118" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BECB2071-0C79-11EF-BC57-569FD5A164C1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001602f3ca11008b4606006dd183f6d11ceec7a6101429a2b3510f54bb091778b2000000000e800000000200002000000017e6df12897cfcc93a38c1d961dd2d8ac990dd216c362861e5cb952deecc8390900000008c675d4bae8fc45ef042d7d575ddef2d1badb1e7f1f2f28807d4376216edeb420a687916a419f28a7c07d763c0c1adbe47351c4f8a6bd4432430292236370cacbe1f688072a0d509a2a5c6566ba5a22dcd7e6cc5d9866be9cb1e5687ab829ece5d4273c460ffcc7fe3b10a5788fc40dc8ac6d32879471cc300c6afbbd96cd68c36fe23f2f9bcfc3c9e10d573da66c1f2400000003f561c692db0a676fb4d2e7d02afe435a9349ade85c75d8c1a7d4b24567ae62f8a29dd37d5991a2d90ae1f9c488ae1b4e6cb86f0bdf07dbd4dbce0edf26fee7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE 3052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 3052 2104 iexplore.exe 28 PID 2104 wrote to memory of 3052 2104 iexplore.exe 28 PID 2104 wrote to memory of 3052 2104 iexplore.exe 28 PID 2104 wrote to memory of 3052 2104 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\20bf762b6b362aa4271e6e7a2db10666_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e30eb388c607c8ec27142f52cdf012b1
SHA1be20917caca0e19893eb6785d268798a06ca86f8
SHA256eae838d515a3b039efe763bfa78d7886249c9706c731828371c6a4f159f59248
SHA5126f549f93cb62ce0d0515879f48a59a3b3157d9395360f95a3e949b3b23ac91271f35d6096797e84547d2393e51d45cfa4e9b3a2bc7fbf057f87774486b3177b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521958a9dcc0a0825092c7c40fd975491
SHA1d16dd4170213f64e49b3720260a3b00726fa9e81
SHA256a7d7f035a2bd61deb2393a1da85edc9710539bd82202163f703881fb253c1816
SHA512a0712c602d536908ed1e7c24e4434aa87773e3279f90a7e2075acd34a05b5bacba23ddc6ffe666caead6c520c6744471453ea3e3b2a709a316c83670a02133d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a088d570d8e23da50fafa55803f2111f
SHA19a9d8db2211a2248dbda8b508d48128b277a7d72
SHA2569e53644b3c9f3913616f7a68bf713409097363652e274d6559d547f50444bbdf
SHA512f7dbfa10265790a0d385e2be15827905ec3b6fb38a33036ebe028cc7f28ee2d0719a967542758c0e9845a49794704096d90a24e07163af38ce711cef74e544ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf39d8d8daa1800571132fbe4ee9995f
SHA18ef67f386bfc7ca7e7f34f11d2e3bed17319ced3
SHA2560d4d0f44dddd653ad47695e4ea54168a78570fcf89baf5924bfed4a43458d319
SHA5125f7cbccdfcdee64312dfcc6fcc6ed3189624eb3f2f0eb7e5b84f91665582496d4922203e90e70b447ee09e35d9c36c0006311c231017876da8acb0ea4ff439eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed8fd5d4fd3be257abaee9f1e943d69d
SHA1c6b733d870c123384378297445ba3a97f21da334
SHA256b1f9741cf607faffccb9ce54b176f64905c8e436bd4bb282a3caea387be2d6d2
SHA51274594a3267b5d587ca517b4b1ad3de841ede19b4f9f0752642a3f7cbe1889545681b36d0b15c3b3813f281147f587d34145020f7da98d5a4b43c5b2572c84bf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59db03d237b3abcedee856efaf65109fc
SHA11d2e330b247a79a5d0a71a837e38d3ec825a9326
SHA2569e7b673708ef389a6d7719e57e3e9f8b4646cd039c408e3e7d9f78c2eab10548
SHA5124a20890b3da2ca5d67b52663c9a2b59454fbaa3e23a60eb027ca6d172f5316758b6c4e69329cd1bf572f39fd273a3fb31b674bf99ea457ab093839f31c2fd068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ec6e3989a326a826a95f60511fabb5c
SHA1c0ed33b8e60dcf8c34f747a867b9eaeec7fc7653
SHA2565cc1ff533fed42ff5448104b547003164bb010ec764735a7a6a25a76f97ba902
SHA5122e030135dbab4588adfd6a8f851b1e1beddedbcf91f4e32cbf0a6648e4a83dc714677762318d2927d6ed7b3ee61e655bdea80b20b46a2f439f055ddfdca1321b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4cb2df5f97395e5cd9aeba9dd6f8587
SHA1523f60c236ec5a07b86eb935b409c31e4064896d
SHA256ab2db7b55d68aaf22540ca3e9a76fc09a877f0da3ae1bf28a917073cbfb78e65
SHA512eaa0cf7c70287e47ce3e3e539d717fec6001cf0c6d8012da96cb5afbb7ab55095161c044ea928d98796a4d810fadc15720857969f8dfa726def6c6176d11fc1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c67599550e6088cb1e72b841624158fa
SHA12c67d8fb3e2bd4ae9518667fa2463b81f61a3554
SHA2566d56a86bff53aca14bfa9c50bfbf2b64d2d51d1e4e43981a0146c32900d06bb8
SHA5126d94a6d8f70a6c46123c2a2a19aa9a7496ae6244ad5dc743fc8830a383f14d81a93b9296214ce264ef6640de6034767098ed3f46a27b38b1048bedad20f455af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5696566b1eb8b238f8ec7abc6e70d8c
SHA1221a4bdad00eceffcbc9c1d7962919785bf27dbf
SHA25684895c6771158ad65e891fd3fd51a641e0a3c8a8bd86107f0e393b61ccea0e3f
SHA5120fceb53be96c9f0b4cd78c7a03265117ce22d4cd90f509a1140f240c70a1941b35087b88e74089d7fec982fad4b6fdd6ae5e73359fe028b01faaf1f5be487df3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554a32f6f043aaaf48268e3cd2bc04a01
SHA17f1cdc94677b234ec48f61911443bce9af4425d8
SHA2567d0689d28df18e2fcfc18d242ac8a9e088fe711f2c64c26272fb17e772ffcf52
SHA512ea5d6585764958dbf6f25c1af319baf6987354b2c1986ad8ee12c828b004973ea9c344247d6ebe31d56fa1b23f110f517df38cadd5331847d70a72e7286ad592
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a