Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
24e6ba34420dce01c34dcd3066c2fa83_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
24e6ba34420dce01c34dcd3066c2fa83_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
24e6ba34420dce01c34dcd3066c2fa83_JaffaCakes118.html
-
Size
31KB
-
MD5
24e6ba34420dce01c34dcd3066c2fa83
-
SHA1
2e02d73226f23de96b34d927d3b7e3b24f2332c7
-
SHA256
8637b48587054b62aea75679c49bc7cc2333fadc737a9b3e501e193b6e8c521e
-
SHA512
bc9f5a994b1153f656ba484db6bf86d8b2942d916b455f85751cf42bf55440df70d5877f404cafe96bde73251eaeafccf886193a544d309f0ec2c7729cb62842
-
SSDEEP
192:uwzmb5nTQQgnQjxn5Q/3nQieuNnUnQOkEnttZnQTbnZnQmIExdilN1ckJbEWVLsS:oQ/hFxdetlLM9Fi
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fe4a40ea04e7b45967c0dffbf0e826900000000020000000000106600000001000020000000c022130cf69640a13b9171dcddb072e2f96538f2fe4eefd11986cd55a7b8d1e8000000000e8000000002000020000000398f25332f7174c82393559cdfdb098e8675399f5c6ae2cc1d6d0f69507d5e4c9000000093eecb676016e294f9a6035c42bac010ad626751ce1213385c7e3a6828821b6d29dc8b190a3b65f9a4bfce5066a6b201a72f987022d0c2bb194ac19f817064de61d3f631d927607f6ffb70d139d0f0fe62dbb760537b33690797a501508ad01011c96518b5efdcfd8f12b4420bb8192fb452a88e87d6c7244a41596f340f77d0698783923c8e5fcf4002f1fb0ac9ad444000000021c6438ccac4e67c08db9f3448626fb7eb053f6365b48dc51813d6056934e8ab7325bc4042bd24eac99dd8f65077e3b0576ff63be9de9b55ca6ae9be272a02a0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fe4a40ea04e7b45967c0dffbf0e826900000000020000000000106600000001000020000000180ddd32c022849fa2257cba4a18b5d11c42bab5c7a2910bcdaf4bc26b085105000000000e800000000200002000000043f8fa99e1444ee62a0f5ae321b034996751c6761eb0ee441a88554e0b9fa540200000000dea3d90f58a76ef5b0182806c2ac5f79cc8abc3bb7a0ab14fb89b2d0077532e40000000911c40acc84646e316779578590eacb298db2e818c49c6653f109a5fdae86bafa0cc9446127ac650e0182ced08e0ca659928bd61eea1bfc2c2921632a75f9ae5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2043a2e645a1da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421334290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11B7A641-0D39-11EF-8951-5E4183A8FC47} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 756 iexplore.exe 756 iexplore.exe 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 756 wrote to memory of 2192 756 iexplore.exe 28 PID 756 wrote to memory of 2192 756 iexplore.exe 28 PID 756 wrote to memory of 2192 756 iexplore.exe 28 PID 756 wrote to memory of 2192 756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24e6ba34420dce01c34dcd3066c2fa83_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b2ac98760b8bc7142a0375cf1d8f2b8f
SHA18254c9b42c92e2865aa57c31e3822c5a7c0ec562
SHA256aa34bce7b4251665d8e120a88f3adc3a7c898d00cbaf32334edf3f0b48954022
SHA512d4115208cd632df51435ee37ebb91ac13de6b93ed2f3b0b3ab39b44de6c1e6162c147c0e4d69d8489c733cd543b312f267e0c6398b8a80a89be989050003ca37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531cd276a78a4ef38a5589a406f405772
SHA17c3324a0a13a56b60369cfb48f0339b6d3a41498
SHA256225040dccdeab639f915dd3c4f06db21c8468ab45d43f2c57359fd37d9079347
SHA51235e6587613b497a6dd0a7996b19b5e5eadd72d0d89872e79e8f34146b7e9e1ad2bcedb06b61904af02b2c8cf3cf997651855272d92a913ff87e9cdbd2a8d5e76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b959050f7ac5ae50dcbbeec7b4600d59
SHA18b8c846a6dd74d4e9f70d59768b68d8bafab9c59
SHA25602264b587cc1fbfda07265be9a54c9ac537014949f037966b4ce32044ca03cbb
SHA5120f1102d9d3350cba577bb0747edfc11b2bb020b268d514de6666cc93025de838324561e083563cafcaa3119d140ab0397362f3e0d7293f58cd4dac022f91ca41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571351176377df7a0fbd19c75ef2b1784
SHA146083ce1fc536b01ecadb87a1531c6e30c7114c2
SHA2567771e52c25335d0929834cf6a8aeb5d1a6e84d4dfa7db6c6dfebdb7f537831a4
SHA5129893031d7307dfbf82fe49a6729e0342bf4aa9ca2e471ac949918569265165ea952bcc7c896c41c7e480f40ab249b99784493106d0b423f9146879e3aea4f2d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a20ce5b3cdb7ede31e126f6177726f2e
SHA12dd6555f1f2c96bb60cc3656b2a6643298a8fdeb
SHA256e6243b0bb5e08d7d68863c0b3fca1034042a8f685dc6637b89bb5f424e16cbeb
SHA512497ad5cf07730c4b43ec194efece871a1925524ee80da193908a6b95773f5663f16c27b0670b9af7766a48cd7a54ac3b8522f3c2fe1533ee123732d15fabdd90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512565bd34223a9371f024ee6f99d409f
SHA16437d0e20ad51f075b42c25c22eefbc4fe282a41
SHA256b188bcecf5bafd241e74687ac0138cd925b94e5cdd480eb46444c368c5831b1a
SHA512505ca59a0bfd4b30af2f96e01c0b494feaf59c2cb25c6fdc256f1b74f65d7d2088c9da4095b8e02e2805bdf2d1b71f8587f11b83a06999b287c70b921d93fefa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c95a645987507c1c1f60b95dd4ec5161
SHA1d142afdf9b46cf56490456998b8756004a58edad
SHA256a4a044b20b990e442d4675e8883439bc6ea83ce84c3e21c9dec35b4b3f070efd
SHA512dfed17c53345f5a5e07f0dc18541c7354df00d9c06b85119f18c82cdd7d96ea4d79f36464a41ce185db6ce48e58aace49b953cfeaf6744410ead304c49eaa0f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5755ef982c13f6324c1537bd41e1666c8
SHA12236c045e6e35c8e15a76783bede9387627da3ae
SHA256a5c2420748aedbfb88281be0cb5eae3bd65bd78864156274ca74f0a708b7dfe1
SHA512e0cac9613f442e36c21a0d73f07a6f3ceb7ffae96547973d2e8529ed4794eb33b86616ce4f19e7b4e664a784cf157b826f1c8e4594491f6846e4e6cd5d9caa07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f7d8388f55ac21fd3b9c44b2d29d51
SHA151aecb3305e3da9f9820a620cad5d163cc99ee57
SHA256bece042d7b11cda98dfaa40491256ba4e62942be35e28726e89f3bc9437fce13
SHA5126312335e744cccb0131f47bcad84f146f855fcc4e8bd295c1c3822f1d7d8a8700d74b9e6b0347dff7e4e9a372f7908cfa6c88e4212e8125a62b19b5178fad974
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5137166abccf4a42fd370e314244aacd9
SHA15879962b09bb21a216845aef71b5931334643484
SHA25612a3b6d749fce7391582dcce4a48c26579305177ba5ba0e87be63d7c18ffe516
SHA512f26510f717f0ccf18abc7acd6ffcf6e190e7553defb3e15722dcd504486bf62f43f7d7de52abf6230d347ee8f9e42885ed7966d7a452b653377d4810684eeb42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529fbc632ccbd1c7f03b0b54311c3ad0a
SHA1792b1f8d6eef8e22433654e736cab66af12423c9
SHA256b8a23f006c84f7fb2fedf85555a92c4a974044bd4d9fd8b532ffa6bd85f4bba3
SHA512bdd62db9557ebeec845a01b38fbe974abf42a73f5c0c25cdf12368df3565c38096658c4274911df257c5856054b5266f4c7c0dbb98113d8db04939cc0b7ab5ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5bbc89c0054241a544a38ffd3c6209b25
SHA18a6e71fe47f263254dcd3d30954cd0e82c8217af
SHA256293b3465bf45166dec1c16ab7820a90d61c743fc999790bf81eac8e39fdfc0b9
SHA51244d35f443f7d370327d4838b1745c1abdcaef2543a280ab5a378a1602f63d6769b8bbf913c9831a985ccb1d4068a1ca4362055770faa7baf5a90af9378518dfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a