Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
249242dc9ddb80b13a93f5f47aded7a0_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
249242dc9ddb80b13a93f5f47aded7a0_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
249242dc9ddb80b13a93f5f47aded7a0_JaffaCakes118.html
-
Size
128KB
-
MD5
249242dc9ddb80b13a93f5f47aded7a0
-
SHA1
f5db46ca317fac8a4a24638a8f2f18c62da7bd69
-
SHA256
562cf25358ce0127f12e31ab83b998f345d4b9dfd2f75fdbe6820047f217be39
-
SHA512
67e74a1dedff24cfe13af92c26f98f68b7f68fc4889aa365c33162cf7a2b180c3074530fc0c7f40b11024a761657780917af640e7860a7c1f23d9f846bf855f0
-
SSDEEP
1536:NLqa7UyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:NLqa7UyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4882F701-0D2B-11EF-9A0E-5A3343F4B92A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421328370" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000733bacdb247694da7ba490baae12458aa4269b8e0c420615ff5505d8409b4c00000000000e8000000002000020000000c1d395c9e844a561a486c2b31663659a9868d31a636d40b6fdc49d9dcaaf5c5620000000a09418f5424efd2dea141ed2f4e4c14e1a84e0cec1bbb05122ecc53d082247ef40000000d2cee57078e53c0c5b74d02b0dfdbd922d277d780d4629fa08a96cf629877d73808ac931b649eba3d7ee909de7c5763d20dbcb993a0a75b9e6afa0b384185f6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606b161d38a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000035f0bd22981d6bc10068d15ed4c8e90632eb6121313efc8b561a444ccdabdb70000000000e800000000200002000000011156119193259ac77a2cdca5dcd68a04bfb1fc8b2eba95ec39292a27a456f0b900000003673ec6d12ff3e008488f186b80bba253c9e922064eee6dbfb6a7c1f28173709783dc1796311ea3b03f6994ba5f1463077144adf934118f7901398d9c7cee5a66fad8e1d5ff08d1099acd437c95dd014b00d4a609425b535a3ce185d2b60bbb7b3ad681f5ca33b4eff9e3ae6b7f8024e29c0f3d35fb97b4f9e9383cb35968bcf00716306f5c48541f2febf065523b90f400000000fb620dbc08e964f5ea82c8a868d2d55b8f54735942368f5a3cbeffa37425928398bb2c6bb5aa8a3c4a46bf3fc5df61f7dd3d128a8d1adf52fc0a4fde5dadec8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2456 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2456 iexplore.exe 2456 iexplore.exe 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2852 2456 iexplore.exe 28 PID 2456 wrote to memory of 2852 2456 iexplore.exe 28 PID 2456 wrote to memory of 2852 2456 iexplore.exe 28 PID 2456 wrote to memory of 2852 2456 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\249242dc9ddb80b13a93f5f47aded7a0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e7e821e7b545b6159f65dc94ebc689
SHA158e93e4d481d8c08fc700fd84c63eb03a850208e
SHA256fa4922e6e63943fccd93e003ecfcb863e757474e7429c98a5e4f253db04f224b
SHA512e412c8ba36d1e4fa0e4f10b70d4b81d9ca7a50792c4d5545f38b458f55233005ac21be36b6a27055738c7ac8c3dc3899dddcb56b969b98455b93191821a4abae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522248e01513474f87ae36644e55faab2
SHA1f502685a264c4db50471959dea5f52102c55d6d3
SHA256d47d40c6bdd410071e736dac88bd85be8e09fe779a031da5c3e6ef820d515c17
SHA5121ce27794600cedc0ae617b375003f782ad86f8471e6b60e7e7813a2a3d374548060223365c872d6514b4a29eacfb8534d861d9e3aeacd0e8fbdca404b670dcc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7d43606f641dc7b54dd03597f20a35a
SHA1b15dbb1b1e7d015c461f26030625f46eedba5849
SHA25648b974a5a443834e203d6394d0fb41f3bac408a3b7a537752c6df14d32bcd176
SHA51259dc7ef2e7a500659313fcd766c247fc3581a0d0486d96d6e24df8c1088748601c0e9da00969f3d7dbe6b2a7b93aa5841663d57ceeccdd9e72d4d8a05f1f85a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5301cb29906b243002399df2d65ede996
SHA1b10e88d605ef6d4faf45d4e6ec4a5d807e08e5ae
SHA25683678a288301f4d022539e0684564f1689eec629cef8b2be3e68b21b797db7bc
SHA5120aebad318880447c10e1f8301151f8dc1bebb395c13e595860dd4a50333311ce862e5fc1053bcac7cca4368e92d94f13162ef63bd7f52511838de434ac972132
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d409b6e0a0ad1c7884abc06b82d4f60e
SHA1b7dc45f4ce9db8c71d86179d531824b2ac3fb08d
SHA2568ed673b0b3f548cdc224f074ded1213c01ece812b40f8f8c3be1b414515af8a8
SHA512a6b6c0e9b960d29f737865f8b161513e402f619e2418a7225b7605eea9c880a900efec5b6e8cefa415f29c062148fe946670ed4950e9a5163cf347c920de7e72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5691a8c00258f320d094269a2a18827fa
SHA16bd373f3851240565a397f71bb35a505eb303861
SHA256b3ce10e7a4e7e055b2a8e166ab39912e31f6e4ea605602e33e4fcf2efc57d392
SHA512b7b3634203cdf2b15c9d00adaabaaf2858c224bde1f87d056781831103a50eb18220e1fc92d7f4d843e6043548d2c1a7284586a3c9b9d71f26527ea749e42fdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffc135cd6654d08bec87452aeb0053c6
SHA13319f0d844b1046750f21463aab4bfab56d774cc
SHA2562e493b3c3bbbfd3f821d0bbb01a9605e29234f5e5fb52581ab0e2bc0d3f3c357
SHA5128d53c3a6234c5fb3af7c2c7791de11249543eb4a2b82d9e26a4bf8072fdbc027180465f8939e7f92837537fd0732cb59e37c4c4e3ad9e95324f9e61e77512e3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0d4c2d8cd218baf6f5a15e73a51ae92
SHA1b21cf09c9a64557c1851558027d04ed165bfaca7
SHA256c91df11dbe5fa5c82265decdc3cec6a5c4a1c1d402526a9b5d7d81acc30359d0
SHA512051bc20c46b6b2b2770a579742d1fd27b46918103f6964a3ae94340ebee3c0179c377e79107e97615ba4ce6dd1459cf45dae3a24fd9624d98138fc0af06abe01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e192ff35d2a83c157dfd7b54e21f7bf
SHA10243ea26f21d4f724cd137242267a60091e04350
SHA256da021fa5035766d990cfb4dc90db02961378bc934ff6abff57f6d17889ca82ae
SHA512276a9658b1828ca969ec67e59edd3b119bd32ece7db805ef06504130deb1ce3cd7a3cd9f51f088efa08d025adf29ee0a6c969c610f94ea6c37d8069ff5ce05c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5210539b4678cea72e7ed150e9994d844
SHA1dc113f9db7d96ccdca10fd1120abeb167ed11705
SHA256a7ab476144d5256c383608281f4a610804f8314cd837f42e0e2b9e92e00fcac1
SHA512a26500fe2791373e4ea851346774bc8d39f05d656659be52e1a717965e86e2add974688b616dde888d5599a31c6d68a445fce5b54de9b253364aa4e289b75cf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5862bba79cb5e85ff2f1ce34d50aa5671
SHA134fe0a5f8d5852fc1bcf3578d6abf59c6c624fab
SHA256db817b381fe34cda1c9b0cd3848ccea655c96295da3926b7cf3870f06c0ffcc5
SHA5129ea277d770d676cac3bbf2552755aa8e67b82ff07c8c9b4dd34deb8dde902c7ba63639d4ef5a3d1a6a680e733f50268effb5664e341876ab1a14821463c9251d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ff60165dc5634fd79c5e60c71a2a4f7
SHA1a363f65fa0f086d10d9b1e080f7a5bead8dcff72
SHA2568ed07aaadd3347584d4cb3362e572a071feb16d872efdc3dd47612e8971fcfe4
SHA512d2148a37b266a286a9748cd4d3f92ae7dfb8b127b3565b887bcacafd27f14af786f8f22008fe9c01f8f0a0c7fabd462b8e75ca9cbb96ae0e45a02eeba6398de6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d7d30c36ca696ca524709e12326c541
SHA131dca1d69f4772b6b30b7491e13984ae8ffaa532
SHA256ebc5c23de51efac408a197900e47868c219687a3d91189a156ff4cf070438665
SHA512eccb62987a22065b0cdb867a5e8242ce1ea5a9f30f7cbdeefba66e94d9b2c0e055cad1895e6eb33dc10c3e1b69ba27582f3c3441623cc717b05fe1cded674dd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d8c5188c3e58baa62c59ece574d3a2d
SHA1d067b05b4766e79d57577994e7b7b16f4e1555da
SHA2563492b4ec1a0db8913493ea5c5e536da01311cddee80f736dc6d891a436ae47a3
SHA512a745fa2af720ad46438b5fbea2ac4e73ca4b3a8b82ae73b6f30784be713f88d72a39b398915d8c8382a171a4ec22244ada8e0462012bbcba95a3aa82a781122f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561ff425e3b8b956a327097a9466c2668
SHA1cdd283328ae3b7c1fd504b23094a0ddc121eeec0
SHA256c317adba4bad3ac4ee1b3ed2a9ae2dc2499af73a727d10a4794db55570ec11c8
SHA51214a653f8b55c2c04609766227d92c15fb3cba6756bbea4e9a96dd607b2a41fc5e1701468d5c907f4774f429ef28afa77daeef47a3d42da982323a7333564c71d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5015fb2b0771d721a3cfeb18d84afa3de
SHA12f654b921c07228ed63adbe3702c8d38f4522179
SHA25622f6c35c7e452d521219804625c3837e610f355ae294ffe22fde0a621680e012
SHA51201261d1ae1e697a7a3842a7304febc9fd875dc020a7912360025b8de341f3ab410ee82736cec62ad7f22d3f872f6ee9ac203445c329839702c02c134517d87c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536eb53dc6d409a47b616efabfff9aa23
SHA147f2c988a8affa105c53897c3cc90c6c756c5d2d
SHA2564880d291797cd2eeb92efb6c9b56b602e135845b5fdee7d9389204ec40a1ef5e
SHA512ee944a30c4bfe7c2113476576f06656edeba0a20ed449e4800a8410b65f14d0f1c69e97165c539b4d5a5f9a4fa1b410be919d4ff2c2f3d7779bd6e641b85c6bf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a