Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
314d4ad0de714ec3d97ee75c53aebb74_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
314d4ad0de714ec3d97ee75c53aebb74_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
314d4ad0de714ec3d97ee75c53aebb74_JaffaCakes118.html
-
Size
2KB
-
MD5
314d4ad0de714ec3d97ee75c53aebb74
-
SHA1
2c5f1e4180f6e025b9d74a591f1b1d5981385f2f
-
SHA256
9d8292ea0df702fc5e641465e9295dc9f7b482925633966e2afa4f02f0665b88
-
SHA512
10a26f9ed725f01316d2d68425a55338efd3e26741f97e85539952c44fa74f3867a13f50eb926c2516fa5ad4747cf60d1d2b005c857e6a202995c58b0175b955
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c756d427a3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ffe64d1fbba646cb3574bcf65d2cf477c6cb846854471f25a2c1b3563bad3e0b000000000e8000000002000020000000c91ce21b875bb9b4e9f4054279be783ce66309f6b77b1b47b045b9e970557431200000003d4c88a20e479f07a590ce899d4866539458ba0b432f22f59e07f20207d6c6c9400000004f293789b4d925c83c70f6bd4cf8701765a18fe7c1942c6681154d7b4db86371d1941210d5f31aaa5a424c1f9e0173cf8b61417978b3c1bc75a9accfc2cd2821 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD384381-0F1A-11EF-AB01-4E87F544447C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421541277" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e2b66ef82be7727da4a355b490cead9466474d9a6068c2a41debaaef6841d0f2000000000e8000000002000020000000204661418b267ef49f0844923df1db0a77136b055ee1d69389e4a21e7ed1aeb590000000f69e3197de8c127aced53d504282ac3ddb29bf6238f8fb6a08bc0d586741004878b90f6af2acdbcb5e2f682d921773af9803ca1df65b004d7a80bb9f4dccffbc7fbebbb32210ee377a57b9f14302e742f8d869ac0fe21831f6cfbe0e0ef864fcb6f5f6faac8cc53c5ee580530dff434ed5556a7ce876a7a5f0bd46dd71caef56eff0124494f7a669c023e7b2754b43e3400000002787d0afbcb8ac4c94e43b5dfc56b8f590aa5a13190123444afd6ba206b3654c29e0157112647ae54d1f13cad80f48292a3679e418b640f3e1841a03b49b4711 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1532 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1532 iexplore.exe 1532 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1532 wrote to memory of 2648 1532 iexplore.exe 28 PID 1532 wrote to memory of 2648 1532 iexplore.exe 28 PID 1532 wrote to memory of 2648 1532 iexplore.exe 28 PID 1532 wrote to memory of 2648 1532 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\314d4ad0de714ec3d97ee75c53aebb74_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bec789a19fc28089ceee3f62f2d24e0b
SHA1793c851aaa0af04d76f977f51e7ad085a3cd61d7
SHA256ecf72e4d3738b767d3b6d54941473d01c5fdddfb22b2da78d4f5429b2e61c40d
SHA512b06c857d5128a73fa1757b5f6e8ad030133366b304a9b5c055e00f6f01f7ede4bf490adaf1d03860dd8472bfc51749e7db9ef92fe040c4e900c698124d51b167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58622c17ca2a939275d2c83962294f77c
SHA17f5bb0c91028445837a11ff1d7735c18c485c3b7
SHA256d8e42f0d9286df3dc483f820a49e416873669bfa6a9be4a1be65115a355ce527
SHA512fa1e687b7143deec3cf8aa954fafc596013cd834d3ac643ef1dbd157aec99d3248f8862b3c6247c4518d0a5d811c65c3cb926f0787dee49044b503b793124f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ce49abb4aed1fd2daefaf306d924f53
SHA1157cb64f662ef1f8d1d746bbb1f48eb16656397b
SHA256b7851a66667c8ee65f69c77be5a0d8d4e9b430fd02ebcfe0b9fbcc7764232fd7
SHA51295e0d5e447bfc2d25ec6528c1ae31c3b4857086b46adce3a9c99f25da8a8b8fe28ec45cf838ff737f662d9789a7031d8e1189536a2ef8e1bd566c6722b87fcf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5058841fc41b4da4bda74336bb70958ed
SHA1f830bd5bf11b94811c6654e7111bd79d90a0926c
SHA256d4cbb11ee55fb5b21581e616192a16ba0d46f7d513e7c4dcb56cf056c0d18a2f
SHA512074c315d64766a1e0a175d16ab932aeaabe89866cbafbe8be6e54900b50ccef45f50507e6cc718b627c3bb3e8bf91c4a9709a6cdf54fa1c839a611f196d0be14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57aafd078a3469e6100277e346d460a57
SHA1665801479a466ffbd3a2f3bbaf4f642fc57aef99
SHA256165a0195966636f42e18b6a662097fbc802e9ba6f0d1b9d197880c137ca8386a
SHA51281b93ba4a303113b8f947e6dc3e6c3725fe94b9201a9df34ec596c05845cbae1a9a7c22d0dc60c245ac20dabed0404c234e723c7cbe6f7c14b45236c68b9adda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5356ebf97cceb0ff5e8c548b1f6437ff0
SHA1cd5404613e2c4d25c40b2e347901f81ac0beb2dd
SHA256abefbc1b8516d42588be46cff3cba8d1dd002ffcd5e5e14274dbd81db50547f7
SHA5129942f95fb21a129a17e73be92b85e7ecf19bc27b545a06331ed5c81b27500f062e5db14d1a3a422cf7827f7d0d08612edf21fffd4a04ed745be1679b3eda1e96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54291e7e00aabd91e5c7087fce6c9d34a
SHA1961a249890356f9c4b2c03c2ea4bbb46ebc205be
SHA2569d682dcfdca141c617ce573d493b70218789f543acd6bc97269610d3dd591f53
SHA51231f02d0f7b04becf146dddc7a45752dee9cef9dc23cd702051f9db86060e7a94ce16b0d2463c2d02881bc9176836f50a8f48ff9e02568a049ef571a7d154dd2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb3933de2f74900350a374f510f207be
SHA167f242f04a71dab0b1d488bbe15e84a26dbe9425
SHA256cabe35ed4603544dd744439c626eb29f6127f610fc53c3379616dc07bf6e5e08
SHA51279c3d28d1005766b4af7f0f58f7181c2158d8cf9051471243c3f41796f4e8e03f85040f61877259b9077e8d3142b96374e8c62492fa7e86ccf6aff1b96d72caf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516e7a9fcf1b37db743309abf92cfae5a
SHA1d77ad3e22f03f2724c66b5875ad457ae825e322d
SHA256a79032ee13482aa11716c59336bebdd4016b3e6e47b650ffb54d41c842da64a6
SHA512e52449b9c89f05caa799f646479ce2eec654d954e3926f6c39672e98a7f0297c24d10362f923d06870a71c5c9758ae1a1b10ad393180c5745026d262583769d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7590bc1ceef7e45a6d402b1c0613b28
SHA1844bd40b8a1ea4fa5f6bed8842a7e66c7dfc1ab1
SHA2563629e0690c409522b7a917a2cfcb628a68c05b939625c4f5573cee72fa2e50d8
SHA5123eb1de2fd818c07bcabf9c5659cd916c8c1576345c80ac9d4df628663b05620fa35b9ea75f223763fbd1c729d0207741f2fcb9b03cda291050fc5ba2bb79c139
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5066a5d55655511da1db2abef457ff783
SHA1b23fa957e0a3f6b6bd7e2701af615070d8930611
SHA2566dcaa66ac48ae16c3c1341b9dcb63323bead822bfb56d0fa9f0f2f0face31b35
SHA512450d2750b1370f6f8a46907b52afaeaebc15f1c4e5ba91a1d9b7e9069d3a7ffb5e56e18287af4336e94a53b0a026f992eda71108593d27e0c9575b1f4eaf338e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccc723e4415abb896e3babd79cb31af8
SHA1375a64aa968fbc2d97d84cc06f546822827fe2c9
SHA2564cc9f8259184bbdd4fb1be17cf926f11d6fb5b7c9564cc93339e8a6eaec31600
SHA512a620d02d8867fdfa8b404690850ae2f3c38a95a95c125279f9e488810ea4e3c44791c97be28a36b906a6aca02df3dc14f063a2dc1eafa5f1fee3ead8ada6b132
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a