Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
2b725f2a4f75adf262dc869abaff7b7b_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2b725f2a4f75adf262dc869abaff7b7b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2b725f2a4f75adf262dc869abaff7b7b_JaffaCakes118.html
-
Size
23KB
-
MD5
2b725f2a4f75adf262dc869abaff7b7b
-
SHA1
38a9d5870d4a253cd1936ae8ef4b665d889a8429
-
SHA256
22e2ef1f946cfec17c74c288fc3eca47dcb1f660a04201baaa950aedf08abb89
-
SHA512
1e27c72da45cb04b2367a0e39c7651141e22984b2d5eb2eeefaf4a3c4ac09baa659af75616d12f6c491d4660eacecfae3d4cc9223e420f122ccf428917f635a0
-
SSDEEP
192:R+coctjtb5ninQjLntQ/VnQieFnrnQOkrntPEnQTbnmnQbnnwJnQtoM7nFnQ7Xnp:gco4jhQ/3Bk
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A126F01-0E37-11EF-9F9F-D600F8F2BB08} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002a8a4b200ef9da4f0df23bd737471a38dcd59a669d2e0c18abb0546d4646d02b000000000e80000000020000200000001d9b444aaad9e3544d5317854f88ee677a710b8fda40e0eff7f1a8ca9e74eb7220000000c96075545cad30c58caeffe7456ea504207d7dbd334eb27020469518897ea40c4000000073fc7d212a1b86fe50c5665571baae24d275c3e70e0e7649cf6de352939a58ff59ebe061ec109c7d02376c2f13f74a1d537c945645e48b30e2aaa969773093ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f041bcfe43a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000add47466b9f229ea802aa636a31395864d5852a529597a59ed8e8ed2ed64b91a000000000e80000000020000200000005d3531dc779beec4c37daa6ddde0abf04312ef82f1a0b7465b7313030ebfc87a900000000f0c978183fbca13faca07b0639e29b1233eb6041863c1054d38b194f89db8c8ed3475b1541ea050a624128e58af7e8204170f06dd80c91953c009bea36b7a8da545192e5bd41c706d0f6eeaa848ed45cdab0f5e2f50682c24c712b0f295edcb6067b2c60ce6096c83c9231c484b3951f3d949dfe390620ebb9f8bffb8d112cfae9763387ea6fbe581cb0c88b8ee5b0740000000c006f345dc3391c92cb8d418f771aab28b17b778d312f8373807c60d1086b400cffa90933df0dde074089aa723ee51417eba0211e9fdfb419f174b9cf39b3c9a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421443424" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2424 iexplore.exe 2424 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2424 wrote to memory of 3056 2424 iexplore.exe 28 PID 2424 wrote to memory of 3056 2424 iexplore.exe 28 PID 2424 wrote to memory of 3056 2424 iexplore.exe 28 PID 2424 wrote to memory of 3056 2424 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b725f2a4f75adf262dc869abaff7b7b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5401629841c05eae65aed82bf2dab3a78
SHA15cb18bb147a957ea6caebf602926a8b173f72f64
SHA25637877c7e4b1ccffff99983f3b92e5426d5c35010396a9166bdb3d9908d6d883e
SHA512cccae6039c0a741552493be224285bdc8c45e08a2d0dab64a90f851ac0d66b37432f83fd4133d9f6cb71c5c31c66351709801038395cc21568c1d781fc882e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a3bb460cd2b23add37671c3d191bbbd
SHA104eadef43c2d1d9f9318188b831969af84de9252
SHA2566252e663ad65ba3e1fd485378b3512b9c98645a864d3b816dc895dcb16cf9783
SHA5126e22b4a3d433343962d93a18111071d72c7c5e774df9f6811e4368cd29ee8e7c55b834c4ca72a74a0c98c847164366488ebf949dd6f14213a6cb0d940a470a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579d09c836184c9c04b88cd30b4b38e54
SHA1c3dcaaa655d0cbe75bde6881583891e2747ac560
SHA256c08bd7f6537be0559f2791711a1a59a3604029a50d46f3063b75b56a943810b8
SHA512c4a653c93283f421dbdd1ab5b920860647d476d3d745f3836699b4bb076c45bba623351398aa3346124b34f459ca24e24dc2c10033675a14e1cbcfd3d8146c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceaa200e01aeae0f19ee2cc9ebfbd5d1
SHA16f872a8eafa1138a2f7178e8b8c8e32f1be2ed6e
SHA256006f5f06efb5157c819115620df58385984bf67e3822247961e09c8b0c7e740d
SHA512d2c0a0f242617ce42a066fb50828517014beee5b42eb7f28c312c8fb4b7eeffbf3ba9ae805d40724df6c2c3cb2772732f4e876bf02e7ad781d9a548a716b18b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53901c9493fe634671918e987abe9e264
SHA1d8c354e730c3a9558e69d91a979c7f6f6370576e
SHA256528dc27ef9f557a69892cfd91bd276bce70a1b6bc9b597630ce6b7758303a55f
SHA512bb1e0677df47985e15040686fd2738e71b1535046a055a8402c8ffc556c1488a4793b2e878b6ef5bd906ca48c1ba8dcb8163477fca3ac4ecbf59794be5195d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbfb172d2b2f319205a960b230870556
SHA131d06db0313469777afc9a2cbc35ac8379642e49
SHA256e43ad44a5bf989c6e077730c6549485078f38e5929bf53feeb17169b8a136049
SHA512472b8b630064cc941ee385f78fcfee39b832ae8057004126c390bdb20a6c2b1bd2c06d3eaf6b742446ef80e1f1f749a35028bead4e34eb4b91d75d9f130cf90b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587b678b9876abd070e38b301724a5130
SHA1d1fa70c9e81df926ecbefabdd90d950fa9fdf06a
SHA256b7b98103c3a317d05cbbd25bad900a0e9e834fc56b36bd7b73d2860e06b4c538
SHA5122e66eb065e6ab611345791e41fb587619e65bec70260c6996e5fe63678bf2aeafea852c834cc6192ac3d750f77cb68689aff3b9de590eb855189f25a38ea8529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eba27048c93d6ac952b0305ca15898fd
SHA1c5cd3a117aee7ec70f1c5a7b3044bd10fe84ae44
SHA25602f468fc32a3e2e13ec7c4b6628b4af8ce686122359ab446a16525eb35aaa65d
SHA5125d80d235072b94c32e154f26724ed6fc9875fc3ac23aaeecda344b691bcd916c8486b2ed8b09dc546d7b93c7763e0b20e562d427b1292fa0997290981a77864a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa8d51efbf47310b397d79193291b582
SHA19c632a4342535366f4aa3998adeeb6f3c234f748
SHA25634319e937a4576ac71d1085e917070a822d1ccf89cf8ce90a44b37972360684e
SHA512e482818ce4d3872b51daea8be095cbda51fbd9fd6406701f9f1e2852c9baf8eeb21ef10eaa17ca7d092970fad2bb7f75e881dbd6f58d2bbb5116437e5bc8bec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d2d3074e102a017bd17b863505034d0
SHA19b183b6ee4c0baae202cc1c0232c8ed522eb91ea
SHA25659f5d8154e98b796b85d53218e64589bb239e8c9b73f689d331d94dbcdfa1a15
SHA5126f4f17311131289ff9982ea489985a104528561878fefc507862c04b5d2e5e994e9611fdc6e0203a181821365c4e1a9a91e553abc6dedfaf5ad664396d707a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55061d281e385dfae7a20ab3f0a88c789
SHA15045cf4cc78eca19812e4e926c9301e08eab19dc
SHA256636c15bf757167d65a13421de13a2bb6796feb9b92cd348b9a7ea1d5c52119c4
SHA512c2edee1a57a237ec16eec33c3f82b6621e162fd8d5c458397be0b356482b5d9e0f97961578e37fa16209beced6d809fb34cb6377105262031ec6bcf18a28888d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57728a3180cacb8ebc489210033edccb5
SHA171871cc5beb5d000535621bad72d565ff030669f
SHA256d3a241ddead34c62124a88ba386663d772756fcba72794c0d06e8b5ed825508a
SHA5124a553cad8fd003af570d85e95273c742e30842b420b23a556e5440a36c34c26fde649c6ae93fbd73d92d892f85c13e5c532abebd2d7625fdad1506ebc8215eb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cffb8ba3a936112a6da552b4356c7be9
SHA10445744185872edf1e3390c55d51215b185f596b
SHA2568d582a85c1f2204ba40c277cdf2722277d27817ac53c2af4924fc60ff9d4f7f5
SHA512853f891e96fd65ff98c49bc466e1f62cca57d4b3c7a750711e865dc012b57c12f2c9f00a60ce75c1cbdb69d3a0c838006685ba9aeeb9302c152a7a15b53dcda4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52352c12ec8658dc76cb5b99c694eabd1
SHA1588e8da858a8d13c405a06b5527238acd78b1301
SHA256e4883938aa9751bc1e12ea85d5e4c392906a1f6fbcb43bb2fa096c0aab7d24d9
SHA512863bef76dc7579a0916f1d1e3eb10b24745a0211fe0382b9cb2cff7171edf75c1de45894968258d2f568d1e8bc15f5efc5362e4df88e4fcb80e5a2f39bd39e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d39cfb45f29e71addec8f4b4967c92e2
SHA1e17f8ba6ab412ba0a2830fe067bd9f51a41022bb
SHA2569f695ab093a48c0722e7c575ed021124811f97c9721f846937c3335a0fe2611f
SHA5126f1386d320a757a6faaad3c36454721e38e074131aaea4f58cf9a163dd3926cc3f5abaf57f6a152c901e763d9f11b549845960098ecd69d63bd792333f9fc2c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9b243ad7d72b7c191cd5b281b7cee6f
SHA1235bd3ecd977fce4e955b17bcc5ca2a834a9ea60
SHA25651c37426b065a41cd03cda9bf702d162bdf8d18e8a3568a4ec18baa6d80121fb
SHA512e7cba04563793c47098f40223ce4554763e1c972c33b6c4d863a2f90b01824d49013c3b0c5bb18742a99c0a67922e9cec6fbd043ff192108dbbc74dfbf74b3b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e37a106506f641550e354eb4fd880b9
SHA10246e6b33d03b48793cea0743b91de529edc77d3
SHA256a333a703413dc537aa37ddbf721526922dc65d64a5a1026ff89c4764f5ccc7fb
SHA512394d7bd070f8fd2eac0b17c0270632339630b74147cd6347e75c3575b5e6c065c2e33942a461bf346674e771cff52398f80e2d77529ae160d1297f69c7da1f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5903c5fde8c06ca1723db8034cefba325
SHA111cec8cf83ce90b28befc72a15b53011210758ff
SHA256375079bd8d11e7a2d86d3a75182933f8a6d4bbf503d578e12bdb771f341e7618
SHA512575a5b7975422e37c2b8f81bdb0791a54f9ebe39301abb30a4dcab1f0d84b37e06cff1d0a8cba01a1da90ea9c620324f29644c29748ee93e9e1ce33c2a8c947c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4e95468b8e05a69170d409053832af0
SHA12b63a163dea14922135f49246643031a8c69cffe
SHA256e9941a9410bff0763ad35c6588bc30bb161a4ea97253d1bce4da5334dc24269c
SHA512b9d463144637d2678ecc45c9fccb07943b0c51f0e36dbce62d30370db869146f30765e349a85199577ad5442ca7d10ddc42ad00f9d9fdb071dc3ab5f230b42c4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a