Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 21:20
Static task
static1
Behavioral task
behavioral1
Sample
2bc111ec24556f0880ab784e67278a2f_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2bc111ec24556f0880ab784e67278a2f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2bc111ec24556f0880ab784e67278a2f_JaffaCakes118.html
-
Size
8KB
-
MD5
2bc111ec24556f0880ab784e67278a2f
-
SHA1
3bd09188b0e2409c48e5f1e323a5a1a1230ac249
-
SHA256
c8489aa66dadf345f71fe90f342c5c280a30210a8ca0bc17828723cb10a4c86e
-
SHA512
077ca7f220271c3564cd752e7f1d1c018b93102e72d75b9ad59e22f7e95625ea0cf22c60d584c86699e70ad740c109c66e663d3051a69906d6954e1e402684e6
-
SSDEEP
192:rDS872pNo9g8i8ueKs+3J+Dv+0GAuMDKc0g6ohwmx6ROpPS8uQOEwi:p7WOz
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000b5b8a07afaa3cb1255ac2467b05b54ac4673a7deb97dc9e808a548fef621c761000000000e800000000200002000000064d7ee0c6744257c8d0280d23ff464918991048fafcb7a53e5b79598442147ed2000000001a065e341f7efc8187b1230600943c627102a64966b49f4525aac0d6b8b2d1240000000bb50074b527e6563e0eb7a3bd3f358b376f60cea7a35e8b9158ad01f017bd4e7b74ddf27d74648ff90e22b4a1f5531d908d27459522298743ff30413faa3f8e9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f758bbe2df91f21d5efc3d20c41b3b526e4f59f8fd9d840098f5d05ac28a9fdc000000000e800000000200002000000051522717c00db965caf55d4a24d9730042e21748cb14e92053cc58b4c58fcb63900000004eaadb1816ae3f1228e581b633e799c91aafdbee0596a5c62597b5932573678887033ff1025497f58c629483249c538ae7b1a842ed176bd7764f42feb9b06707a8c46e85f62eb10f4ade3c0c4b77292ae3db666b3c1d592a20d2004a083fbc3639d5a5a2fb122a275d33f26066f68471d6b12260d185945ff9cdd62751c2c842524456dbcf71e5af523e78e28c8351b04000000056444271b3eb7e2293e20cbdc97c1769294bc7949e02914e3714491eabd96ea1f39b5886c90ef33541ca18fdd0c8bdeef3310db8b890ec635229433aa1ccf5a8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421451490" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1C769D1-0E49-11EF-9BF3-52E878ACFAD8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201985df56a2da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1044 iexplore.exe 1044 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2832 1044 iexplore.exe 28 PID 1044 wrote to memory of 2832 1044 iexplore.exe 28 PID 1044 wrote to memory of 2832 1044 iexplore.exe 28 PID 1044 wrote to memory of 2832 1044 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bc111ec24556f0880ab784e67278a2f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58627149acee9a7339bdd81dbfbcaf459
SHA1fc04e466fdd1bdc9207f7cb2245801ae8f34d4b9
SHA2564d860c58d757f59938dc2fe19f8724a0e723302d16c160f95294e119fd170c6f
SHA512d016ea77b8bd72d7b38c3b3bb4e887ed150435fc83232548eeb8c3623fd2d253fc5df269d58a8185b83e4fd5940ac6b48911234ed4379f0dd5dc77a7d5ee0373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b347ee68e3975f0b2e098310593a4449
SHA16c7f42c0387d46ffe856ab2445262adc3df66903
SHA256a289b2fced78ecf042bb9444d851063234f8020f9b4fa7d2ec9b5b3814571040
SHA512b0bba345bdca1e726387048d67c26167d30aecf0f5d904a26dc927c9a4047d93fedcb32c72e2338614020acfdb07722443026e0f99a973e10e70bbce4ba65d80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f74bb6bae052db99b1c36309c6991223
SHA1d0ecb6db4d0ebfec5d00f8bc86cf3979ac3db096
SHA256443f068f34eba2fdb7606c1600c1942f2b1bcb1da878fe31ef845f0a62a88c3a
SHA512dafee47d31411644bb396fe121eb4346576b3edb1d46e92ba8dca63d1a02db074ea719638ab2be25ece7c69ae9673d154305f91595b0caba114aec6cadb731ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2db32fa70fb641a01ccb7d2b7672be0
SHA18e2040fc95871296aef1deff60bcc162e9510200
SHA2567952d33a2e22a3f20a97954e31b3d2cad73dd26eb723744ea105bdf9104dd79d
SHA5128e21276a18ac3125d1f8dceeccf71c5df3cbe80aa2fa5ab621352ea7e6f9619eaa7b259cce42eafe02c7e78ead67ecb93690a0fc99b2ec60ff8baa423f2550e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505ccb11d5debe7e790cd229424246755
SHA186b580d2caa5978d81ee57f1aaa4e02b8559c958
SHA2562ecef8b9c263aad5399cdf78d67d2104a0fcd9e6faaa134314390f079ee015a4
SHA512c2922bc113a40dabd2dbd13b4d54dce450e635fd7ce44f45bb040daf1b934cbf27717c73fb075363ab2e11fb6c22bfbbcde7cd3956d852b9192ad741e596a0ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5314f0d6a5232eda6a23fa03e4fa3d931
SHA1df9af3cbda2f10c1dddb0ce18fdc2984572ae900
SHA256650e9f02b65053a3343b589e970511be9fdd523d1e3bfd106c8197d964e96277
SHA512a07c62f92dc13a29df092c42a3e4b9b632c89beed2efdda2a33ea71cd73867b5d6480d7432c095d0e8ec12a359eda3c5ff6ee45a9c25381d2f2f104c6483787e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d67ee3768ef31d537930bb5bcaf1b71d
SHA1e634af2ccdda593c6a36073dbf897bd13f5cb5d4
SHA256b07a22f84f68a5b050d1dafdef498e5864cf18dc7db4ddb2b7610333f9a57882
SHA512c693ff388a8bebd853c1811e6ba44bf9b4b33d6def68f388d0f8f53c82fca0344d4073716a008e241adab7c68efbaa43cfb189956bd680084840396f03da12a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee089a564efcd5ab1a80ccccb2f5e239
SHA1701f49bd5388e751b7b36ef3bc918854e26c8380
SHA256f000eab6b33723c26f182b9dc2544d4d04bf5dcdf3cc7f1712eb47bc2e5c6b4e
SHA5124eb20c1eed8e4227cbd2b531ab02f7f9571d10766a804675fd4f7731c781d53c9f1c43bd978057c5d5d48716a2ab8c9ea63f6d918f74886ed6f610fe9621067f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559fe816c51d1ee0539d35e092a2be4d3
SHA17d170dcc15d23e49551b29865c3a9cd550eea825
SHA2568c66075e72b9989a9119cd1d998cf8cb2bc584bab14e99f62eef4158a1372fea
SHA512dac2aa761c40b5ea0e107eb789428d0cf1db4b565fe44c04033b81c66bbe44afa76ac0ee66fa14beaa4a6ae8a8f10d30026666ad0af703a433043ce3ff9a74f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5648c557132818ea0f10208e2281d54e0
SHA15b1c50673f576bc9fa93985fa92ae9db10a5e698
SHA256e14f62185e81f1fc26e4700dbc0adf7ca13b8296f07ddb72ecfcb158a25c7147
SHA5122147d7e18ff0cb3c8d89ca0c6601f2971e41a4027647f0a76b7bf6e10ab645f271bd1a8ecd53e37b12636e988285534bf119b8f88e8e59015fdd14e730264e3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c95b0d41229e77c406e5e036dca010a6
SHA1c57b46e72a1f501b5caa1d0527bdbea562deed80
SHA2567f4cb9410cb9d01134c3715fa27224a098ef747c9c91715dc71073efa5ec8fd5
SHA512d2a1d24013e9c78f8f05c4a5f53a48ba3093b13eafd18965017a3814e05a081268419e8e2b3f994dcd4e463adc170d286bdf2cf64889dc21245e59dc5685f11a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53746924c0290e66ee6735e0443629321
SHA1a13446c40f738b23065db904ef071c3dd64fb077
SHA2564f70b072ffb61fae9eb71968f5ee4b11df938d8dfff5c18b50b4ced8f205c6a8
SHA5129599d71f0fa69a5e98ad827896323c82f3233cbb23e1059c2e118c4123cdd43a973745c65319dd712361ecb32b8346b7cf289ab8bdd5821797581a6a0b597b3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fad75b88179265aeb1ae0526d49f7c51
SHA13138f4f9906255da4fcca371e81cd44e779b6c23
SHA256f3c5429d3b38c0cde6938bb9299dc02d360e9b4d12be753d3f485380d8cb314e
SHA5120202a79bfbec36fa667c1ad5d5b55e13062e78e4200a9454fff34a51e795c5909cdaa1b1bf317295796b1e63976a4346fa03341f21a758efc4352edcc4f4c63d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513a7134b0aa1fdae909d68d5d8b48c99
SHA1b02470bf0f1a2ccbe6e4dacb1ab7eb875d82e34d
SHA25629878554e7e277e5763ff03ef377d659bb94d8372796e4d0e8110d4437013611
SHA5122cded2ee12bbf1486aef473bf25b7d03d5bbbd3a0b993c7a5fc64e6030d31e01b4f8ca1be8dfd76bad98c03765eee0ff78580588b66d79dcb24a2ca1164b165c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57801bce62b0553bced07bf36cde30378
SHA1f48d372b92f71eb1ce1ffcf8a792d9381c0fc432
SHA256102bb3815559afb0335f27adba08e0178378e401eac070dd7bab57e33da9e6cb
SHA5126f1620a18334c739de9c45a814f7de089094738b9be747482998c3527e189c5015f72f7952c37a8d0690ebb09382f2c23332cb44dfb457665d5fdd19b2f4181a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535e602761602d9aeb2fe9bd158855645
SHA1b2d526116e866597d131bc8b01c26bca05f25644
SHA25602179ef98bd3fabbcb658a8c0dc110b96549a7a02dfe39ec9816f5b0f3f4385c
SHA512301382b2d01367d413bcb7da4f62ab156bc99301f4a606b23eaa99843d4fc283229c99122063247ec5277ca557c23e4036cdb868a2bb090bca7aa3048bf88fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5528c5898f6ce51e7d96f5da092abf2a2
SHA10fbb59950005a2be709f727ec19b81c2368b4037
SHA256450c5a96f4470b127932312aa6bb8f5a75ccf6f27ab8a90121f7bfa0fb36e74b
SHA512c07f93b5fa9b5e21b6df729b38b6fa512bebf0e170a21bea83db2fde2318fdd9490918301c0f603d9d0fc22b9a1d6d8e93c63fdf856e796f4a1d2fc56fc6ff83
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a