Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
2a8b08ed96f3624e2e267c8d571e19d1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a8b08ed96f3624e2e267c8d571e19d1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2a8b08ed96f3624e2e267c8d571e19d1_JaffaCakes118.html
-
Size
23KB
-
MD5
2a8b08ed96f3624e2e267c8d571e19d1
-
SHA1
a697da6ad7972ccb4af30ed68ee8acc5338e6f59
-
SHA256
7d5ed49310536d27b811c3e2351f9de9db2eac888f4c37ef8c0eefb39345d805
-
SHA512
12f6527a533a2431d1f8392549e84365bde9756f41b0c03b8ed9c4c13252706b94b66de250835a2d522a95b9d4ccdef266995b4396151fc95a4413c6be1bd680
-
SSDEEP
192:uWvQb5nT+nQjxn5Q/inQieRNn2vwnQOkEnt6QnQTbnJnQLCnQtFwMBxqnYnQ7tno:OQ/YvSbT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20adb9af22a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421429118" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000f27f54c01194a9e621619a64d5163f716c522df40659523db062028ab7a0f6ff000000000e800000000200002000000084e83fa1e875315596ae530ae07a534f02d62dc8362010c668ce096809a097fe20000000f0b8c03f545350116053fd443a412fc5fceedde03ddb355358830e4a800fd11b40000000ddb77aa262c7b5dedfa6f7a669c1104619d99021b0a8e593d467cd2c43ec92826cef63632e161f0c6273b9878b6a6f251fc5bdb2614db24c874b791d173abc81 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB0CDC91-0E15-11EF-873B-52ADCDCA366E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003cb64fb9ef7c46c3d8ae637b0e1e8e044d78cdfc3fed82326440f5a0a7f22045000000000e8000000002000020000000c853e31b3e7216c2eca2229e5226fae63f0266931d2db1c3888ceb7060bc5230900000009dc4133a9365718e76178001bf32f1be1b52587435d4faee35d4d666be3ba71e494db82e9aa32757fb981931eed053906f82cbb37af8cdbe1308b004cde49b6937351710e3d9a928827e178514ad5ddcec041299ef2e6e3362cc43fadcb04e018d4a9dec83adf66232d1bc8e57f447e79de3bc8615d0ec2ef883c710a8c0d724739fd16a7f49cbff2987d4535fcd1a6b40000000c8376f2cb2a16ae98a3523600fe233b126ef375985295c35c7b117dd8a7d6e68582e3fe016378afc467381d97ebaf193cc695142c02edeaa4265cb2853d9f786 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1984 3048 iexplore.exe 28 PID 3048 wrote to memory of 1984 3048 iexplore.exe 28 PID 3048 wrote to memory of 1984 3048 iexplore.exe 28 PID 3048 wrote to memory of 1984 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a8b08ed96f3624e2e267c8d571e19d1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcb03c17103c34c7e49ece9d55f53bd5
SHA136790878a3716f299be98889b2d8500df2f1ff21
SHA256c995f062ee4d8592f41c7c77673d862666b77253c209551246f38c51bc17f74c
SHA5128a06ee3953f7ad1835c01de5ae251a2c4362eec6125f6e59a33122e066a50e704b7b87ed34bde23c447254391696ac5617388c39ec42371890a105bc4d87691b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf93a24ed92545bb9d50c088c2402cc5
SHA1422ffd4bbc75b8a20d539cd95811fcce49b13a6d
SHA256fcd08e8718e356a34336249eff40839d2e65bd53d6f4bd7d5fdc0535c1c9fd22
SHA51220d8dc0b434b76d113271eb70fe05eea63350e332538ba2a11a3c42ef611999089b67b58e76b47ec375efd2aa6210474536951db8ab5a1a7bf8d6f839583610a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59894123108543ac55ad3a046f66b4ac2
SHA16afda20bb8688dd82fe85945683f2d66d9d49028
SHA256d6c4164a7f9fab55f4f2b3e9afbea32acd2e5a628625f3322f77c52c31f2323e
SHA512351f2d5c63c76484485f9c5fd6e6830daaa5f2cf263fded54ade31b0f6588dd8a262dd7238b6d3ab6b45c170d463d801bb304d9340a6fcb34cfb061e1a4b4d62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1cd11c226c817c3fec747f5dac4ae27
SHA1112ec6ccdd53f014f4ebc3c9724c5cc0391b348f
SHA25663165ef5f488f171a72c1746cd2f32b5785ce4d919e45b73324ddf74fa42e08c
SHA512a8de565aeeaa88f844477509544422fbc1339a4ef5db3a58c810d70d7ea983611ecc01517eaa6e055c2f549f5ae4a4b50e6bdebdf336d07f86c740ac4c9f2110
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbbc6d88b023c84c5323c7e4a6839270
SHA182b40d4399c48ad8a5e7fe5ee126b88af51337a8
SHA256f97b606b1bf8d937f9b6450eb8f672b5fbe035864926a9d7ca7d4ea508464675
SHA5123a1771c2cb41eea95134d13d13a9a39eab2f6c33b1b6ae6bc75ec3e021b6865bd712fa3a35e3027cff836f6477aaec43472fec1d3591d24c6e48a610c8730f45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539b4d80ea669af140783259cd5343962
SHA138328389d64de0d6f2e897f71b935bb2f643583f
SHA256433b8be352c1b689f380b8780c255db26f16ffdb99561d63edc0ca396fc3fac1
SHA512a4cb7cf3f1f61b48a2250e40c877dbd172f4398c7134915b51a1ec52abafbbe7e761053a0c3a3656cf3873aaff2876fa32440d5a1b55bda4b6a667203e269981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9bd91b5fab4e788aa5d8544115d152f
SHA1fde890d925aa68405a8284433b3edf55b3c6bfb3
SHA25640b561cda42151ec17b8a22e54973c93050037c24ea4cb9822698d2ac8d147a5
SHA512d7761cd98e48f67bfac67b41e449c638fb80dfa5139cf2b41e1506b74e959cda05bdabe683430ebdc151c4acee2f33a50aaf33baaf0b54af31afd8cb9cf19c1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d4be695b5de332769e4525e8dfd6ec9
SHA178687cf37c1011c568ce42a677cadbc5b2846380
SHA256468d7bdbf57a94ede7bf2128d5bcfebf34068b3dadd09759edf517523538fd94
SHA512d278e293107a3e161c071f6635b5b1ab22d8c7c84ab94f69e5fa3699361159065c1709ccb5455f89d989668121278fecdd1af32c41da3c49a25b80568068d7e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d85e7c3f41e1f1056f57d6dde657871
SHA1c7bc6754f0ae5399ea3d1897f0e7d02c4f4d9a2a
SHA2567339dfc95059791a6a7e0bc19e7b683a7d3b3ea4b3af7144510fb790fbfc31fb
SHA51244427d3d65e5fe8803763fa15023c998127df862867ecaf1e18c5ce0650bff897916cefce454fb5aad7124c635b1125ff71b24d6d99a4ed29010ff9ea8e128bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d081b094a0c98d382ce447299caca7f
SHA15046c7550101537e0148856d67492677cb5ab58d
SHA2561398903c8d7a46b8dea3fa9dccd17e7e7f7f6985c47d101d8a3bee2361b86a3e
SHA51218f921b612f6df89eff01505d0471814cea8001629da66f1ada86c10d632bb68ef70ae15c67cd277e6ce231feffaed9b44e66c170fddb7f009b2490d4ece91d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c501a9f4e282a54a4075bc27c7c0019
SHA1784bb47835e752f1901a13df6c5739eea734d8c9
SHA256924418485305995bf55657bb5d5ad2ed60799de1c17257a2ccc73689075c3c3d
SHA5126a479bb21e92a335ac8d11b9e5ea6a26392dc9488536c7f0d4fedbc1abf24c42b0dcf21b9ee282b8bfa356117728c7dfd7619e9e415da2401c2a258884b17ab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb84c614aaccfcd6a74f08042566c6d7
SHA113334ce53d0fd4694ee87cc8da71e104178e3c4c
SHA256f8cb10fe4451c87401034d96fab81056463504dec8b9bf5bd6b7134d20fa6163
SHA51247e35d38ef17ce12b84aac9711bf5530b8baccfc47fcf250547bdd7b876793fbbb76858d0526c17bbc63aeba526689915330f50223667f21cf8a05123c963f19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3bfe80bdae6f75450169cf236543026
SHA14ec0ca314d280f566b9aea76768b1a1911d081f6
SHA25686d708919d4d682abbd582cc5d1eb41e6a703828fb99e3a5b2be2460c0336c8b
SHA5124c932a1466945dc41439dbf0025387f6aa0d28abd13996670435e587c6c4c3331caea0060e4840b4b81da63fe9aa4a5dc9176aed8ce7cd8c4de0f90f0e0b3dde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8947390ed17192fe1edf827ee769da4
SHA169c3fcc084ec66d465e2ce48a7a568d3cca290e2
SHA256f9a0f236a5847fae01d3f7ac1b0e7a234f6ed83681789ac379ebff56282aa347
SHA512be44cd6f7fae1bfaf934879bc6a47f30a1f427d5e03da8c60d926490955a6d0298a88e438c0bdf688d769c814891859e99e68d0607b9f451f86ea371460633ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521704cbcb8a602e736ca43166727e78c
SHA1f9b9ac2a542214809f2207560831084f2953695c
SHA2561939bf3ab8fa45a70d5dfefadc882e5cb09a69bd7c2b25d728157685abfec2bb
SHA5127f195a2df65cf051642bab3de21d1fa062ac7e182286441057e4743645d88a47ea7e753c9ed6cc0912ecc7144d693a99556fc43a1e8325b49a36a4e8701375c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ff25ee5db7043233c0eedf5106fcf24
SHA1deb8ef2c5a347e1c3f5a6c43ba70cdc83df27fcf
SHA256279ad3e5075861be5bf3617792a71e10d6c3f4271f19fbcaf4d6506270d974eb
SHA5126c6e9655c56baa5b38380e51123a98e9c03c6f135762be37a9878b304939abf0acab8f01970733761ea41a4bedad94948ecaa9063cdfe78031cb5a92ed20aa0f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a