Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
24cf5d360d12d5cf6f30f882fa9501ca_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
24cf5d360d12d5cf6f30f882fa9501ca_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
24cf5d360d12d5cf6f30f882fa9501ca_JaffaCakes118.html
-
Size
27KB
-
MD5
24cf5d360d12d5cf6f30f882fa9501ca
-
SHA1
86988a06545c4e394ff9adcd702e6c49991a422d
-
SHA256
794a32d575f291738903dfd6784af2d2f005b5f3f85faf8a8a39d8b092e22a92
-
SHA512
ee9c14b170fa7138b8ddd109b420b2576b265d13ee5c31b95806a7a2fd85a7ef7ccf04a85b8283515717b4ce37ff055a461ca0d1967291da12d8bfd25a708140
-
SSDEEP
192:uwm4QFGwOB9qb5npJYs0gtPWJzwZNunQjxn5Q/X+nQiebhNnzGPnQOkEntlI8JnY:qQ/wQnaTUSXQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e341e2bb9110fb391f3bc27bb63107796503f61389079f87f7bb6de13c632aca000000000e80000000020000200000006962d0c0928fe92de65a8cfc05bc77352ca5a41a44ce28267272d03a6856eef3900000002e64a1a25729e50deb1b36e246d0afd78423814f1ab660940114a8697f704f49890c1c3f44fe7f3e613600fb7e9074bf3b1efb518c8c26611ea426b38bcfa0521e9774400f9d10725b309337985bc7248acfee3dff660a6bbb70bf52f25a564649cb8059dfaa62b9214ee5e3979e5e1f5b413a357e9d0dbfaca5a26c3e62f045e07b976e5ac31186ea89cd817dd66250400000005ba1f308633829ce697bd4fc4a006f5f6a437b89312e5f0d433c67862d705cc5e4c3649c8727bcc2cd0cf1a17c6a1134b462afde709fa62935255c9bb933f14f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208ae43342a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F2EEF91-0D35-11EF-A304-E60682B688C9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b29c5017835cf0933a5484d1f0e89d62281ba967b0f1fa414dfaf0fc573b9939000000000e80000000020000200000008220194a55ce5c85d54c4da6746fa693ecda30001ac1566314065acc3d49ade020000000a0d075c9e4948bde5a53eb8b760af2fc06a217fa306b6a1ed5a98936beb4f28740000000c142c4b48df1c26619d05e1be54b9768209ce933e19254f57cc72da4611c6338663bf58463d6e862d3ff4adf26dc1fe60900832fe52b8c549edec2eac8eecb0a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421332703" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1700 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1812 iexplore.exe 1812 iexplore.exe 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1700 1812 iexplore.exe 28 PID 1812 wrote to memory of 1700 1812 iexplore.exe 28 PID 1812 wrote to memory of 1700 1812 iexplore.exe 28 PID 1812 wrote to memory of 1700 1812 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24cf5d360d12d5cf6f30f882fa9501ca_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50749d3b9bd55045d5d6bedec8a20219b
SHA1f29fe6667fdcd88ae913aac774e12312429aadc5
SHA256d09e8c326bd715153fff88d1c1d86a97e512dfa3c742f9a8c2665e5a5025dcc7
SHA512cf2eb34f9105de0288f19b5c61af4f7c70ee5039c7fc10d7ffb7824d13144ba3503b735e83fe976102cb77e36ee06155b72652fae84141a8ebdb203f8784a8b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b6ac5c0b61c5b13950ecb3db021923b
SHA1775b9667e67d0ccffcb1eaa2996b6d025b0001d3
SHA2568c75712654aaff1120db77bd7ea973db9cdc57ef6272d683ab161869a01b8bdf
SHA512196b6142060a9e8b144c1accba6151f1842ec28c9d3bddd9c46cbfbe5a98fbcf141cec3e796faa9d48862c4e59cb060fea776c1a3c0d5092802744dcf0adfe69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510175623ba479af227fba62cee677ffd
SHA105f16dc1f290a042bc1e9d349e54571f765d0ffb
SHA256db813de67575ff6940063154057929bac578c340836a66c61d2315049810f994
SHA5121db112c0b88c2fbfb4b1f53fd9e421e25838febcac6528718d1823368cde07370507c6571f0ddc37d2455156eb8961c32191a87d70a17d6ca9f7b404a974bc84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d5d2e2a9cc9c240f23938b7c60b64ed
SHA1d2f40ba3b1834db7685ef27aff92235418c3cc6a
SHA256abf0b19a265aba858744c0bce10a25df5d0bd56d21b9b7865c21d60499473a3b
SHA512becabf5a266b30a27ea80577b7deaf9900976e9eeb22073986e636046b8cb364d7220e20c50c329cd22e54c6f0503c35e98a14d3f141e500dfd0cc9ac3f4557b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544bd7f013acefe40f500fe2580e19f36
SHA1217100a1703d9ce3fe1e10d46115a5c26fb307e2
SHA2568bc94e29a87f4f00aa8f3564d45812f4319064c9cb99668eb9cd5fe8e08d0170
SHA512cd09140fe1f7a2798b742e4a956b8b39ed13255c35f4a4ad408cbd8bc5a665a129ffb8582132fb618112e12d6ea7c0b4ea0179d609f9590d8c94c2ed19770b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b8e319a4721f9c0e98e051cc124a8ae
SHA1007cae87f82805ec5fd0fdc236ad779df5e34a4d
SHA2567bb4aaf6586cf0321213ee3ccb737ab205498719c019764273a5d93efdb252c6
SHA512f05bd11410d9d0232011e2795bd0fa62fc5894df8f1508d5c2a7379c146c51d10a0154353b1aed938c1b3e32009c1be439c9b17b9fde91845efe30f03f7eec57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524d6ea129b091bd46e716e85bcc3458a
SHA1749b61bf0dcaeba1168960a9f24edbdb3cda915c
SHA2563345608f159adc64570ecdf04de55a5d04d4aee3cc7be5d275c5e33ecb2063ae
SHA512286f94e6b950e2746ca493d8157b1b70bf639bd32ba3b1ce5f5f6cfa2134a30260b9d510ed331895e2d8f9c8d11d2ed02ab1f823f0d7089cdb79151bd4baf98b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5bd4fd671515c52108b61d504a00ac3
SHA1c5f7bd28dbee07869f8221a34d0103de632aab41
SHA25603e3c3cb67393709c4a069f25207334e35716f540461c9793f0f808c64c59248
SHA5123102fe4481e9561c04c556359ac83c1e7275ede3df80396b00cfd2dda6f3a3ab71dd9a432c5714c0b899aee847778cf49b5c6b5486ad1c87d27d68d40e12f632
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5569fdf055d94977c16f7012022ac7fb1
SHA146ee8c6c23ff3f1d9d5c2d2ebd54f7987840724e
SHA2567e1b78f73964c01c5ff815a1f63b30649e012cb66102afe126411aa006dd41db
SHA5120a6bc93bff42b008b6060e4a0d2bdd2b8b80460c21b71bfb7ed963e9ba4601d01eccd061544d1c8652ab8608656646b6e29b48e25a04f61f8566883dc50a0769
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2c3fd413e671ca957aa173e1780c4af
SHA1f2576b82804e60b14d7fadb42b98c5091c0d0de9
SHA256a74c08799a5e29c6bcb5ee7c790e844b33cbce53e8a233b261fdb121daf77392
SHA512b59643e3f78539fbfcb7e3993a70c1e8b36da2b5cf7ef04b4cd0ce4f26d1d8943f6d582eb783cb45274a040e25459a3336b51342caf6271614bfca2a8c80063a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4152a27f8654afddbc88bedd10c3af2
SHA15ba446d962d5a3db9cb5362914f809940fffc754
SHA256f29d6e6150724c0d75747e5d1cdc18f82f7c25ebb304af51f3438a2ba144e825
SHA512f6ca306f78b84fbf661ffd88e51623d4509d0c03f56821524e3a3c4145c205f81539e9b0271815a3b68c82dffe7aeba7a5e31e698caaab2043a0b658fb1064c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f3ee4035124ee18842a8addb5f79605
SHA1678b11e326b8a1459633e932a70ff25e26695974
SHA25695bc83c77ab1f3396dce6b22cf3d638408d10c3e2f6643509b25bb723d8d6a5f
SHA512dc60f858d6b453ef91a0c6ed33d41808ef975b89834fbc41977b183895e744fa7c5a5558684adfe00459f3ddea012ed33ec4cc6694ee1284e0b51c5ed19ffde4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cea017cb3676ee2171b8e46141116cc8
SHA1449a2904aa9138abc5bc1ab4dcbec36d89c33ec1
SHA256819be61a7351453a0ba6c3b74afa302a161d0366ae9a782bd8be09d4016b1486
SHA51234cc91acb63c23e300f72300be445140955f037475e3b1fb3a3145485b567576175c62ab95cf73a0529bc86ead5bc4056465919fc4f4b876e31774983e1e5742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5215585f78cbc8275b7aa75e469244874
SHA1dee538cd2c05b0954f9c165091e6f7e615025108
SHA2567e0ab325a43e12c8e969ff8d29ed8ee37fd6616be7e87e313f986d37782075d3
SHA512c97fd541a37801b568bae158bd5a2d988f4cf0f43686725e0ad6cd4e1e23f6ae84ac26b367c67f531f91947966c65b7c6f89865a00c6481518c9f5f46318962f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518a4162c33a8de2d1a749f948991aa96
SHA1d1892ab251475fa7797b7fd8bf203efec442a482
SHA2560c98ec00e17bf62dc3605b36ff18154da51333574f1a7dc5e1fc0adde9fc4d6d
SHA512e68a292a012f98b04a2dacd47d51a4e31d18cb7563face2e78204e960191b49ac94bf684dd4e290da4457779189e0799a35f84d1f4fe0d4e0a8df2249d1d827e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53091cc4030f5f4c24eeb78676d15dfb3
SHA10fed1c9bae922ba1b8bdff1630d458caa2d7ecb2
SHA256244b1ac850c97d2d407a0f649ad3adf0b964310e90006cd61ecbc1ba8c33a1a7
SHA5129cff0399bece340da8ece8be0d8b81b64756b82a5f5be105ddffff344ca7ec3dcb496a152f1219200ffde259b79cf765e5e816e9a9bbd0008a75a1f0e5ffdb81
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a