Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
2d5b0ed638e9dead11bcb07fe8dd642b_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2d5b0ed638e9dead11bcb07fe8dd642b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2d5b0ed638e9dead11bcb07fe8dd642b_JaffaCakes118.html
-
Size
23KB
-
MD5
2d5b0ed638e9dead11bcb07fe8dd642b
-
SHA1
f9ca23258f23e09a67ead18e9eeeb3e07dba2385
-
SHA256
2bf02211528c8bcf68dd9293b9dd36ccf4697722104914a014635fe84aca7b8d
-
SHA512
087486956233c77e83821733e5b075ae609715955a6b519bf5076af2b54e1f7ac4244ab8874a232d979b07766b35c2ca9851d1ab9d4ee8f61f7a9dfcf89b3494
-
SSDEEP
192:uWLsb5n1qnQjxn5Q/knQie/NnLnQOkEntEWnQTbndnQNCnQtnwMBfqnYnQ7tn4Y9:AQ/V10D
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421477388" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000009cee32843a356275bdf34f1cea08fbe9647009e08510e3fa1af894e99c7d922000000000e8000000002000020000000f86de2191587be891b2e63e48a4700cf2d6f4789b95557f946ec051ee0d4d1de90000000e994b4833c0d913f4dfa31a06fc66b58262a4fa9bca946dc3fca1359df864809e03ef4c684ee41119c86e9f876602474b55697d7f65e9fbacf53c9a83c0e69e25f1c21445d1b08d73ceb32fc5dc185b229825cdb62d059e8c13c7538dbdcaadc554698fa9718d4fc44941bb7769105d4c38a7447d21044a7595648d5e4e51d9274cfa651266493278e4a87af4453d8c5400000003c4ed276d6b0bb39ecd0232e8d5530b94d43fcd62511070a6c48bd6a10f0fcc7bb3db79c965ab36dc83f823c22b3693ec343bf6bf2b58c2f1adfeaf093998399 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EBF8C91-0E86-11EF-97A3-C6E8F1D2B27D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002db59c627e2ebfe9c9da2391f5cdec2cd1f85e14ad60ffeb7f506aa9a8780cb2000000000e8000000002000020000000b60907fea179cad0eddaad1e8cdd7296388c16eaf7b0593589a1b9781f2c80b2200000003a02a1ef68d6e2ea1e92e6fdd18d8333ec8a1a9b454dba1f1d69620b64b8bf9f40000000cd2655450ef2ada351d697ac7d89e686a0ed6957f1799d022d9d9140be31be5c9094ca4a441ad645334e460cdbe612d7a71dc2505cb7da9725820c65443451db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105f7a1393a2da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2428 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2428 iexplore.exe 2428 iexplore.exe 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d5b0ed638e9dead11bcb07fe8dd642b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcadd69a3e9f18eab5e4a5763b4a5785
SHA1b6bee2f0a0a2964951bf187201008f083263b0f5
SHA256c6eac801ee6a0f5845b0323d5ea8fa3fe73dca5b279f8732f2451b6987d4fdaf
SHA512e7ba6f04650655e669a6b8e97726cb45ec68b30ad1c91d006ffb6a51dcde1e9abc783277b7e1554515cc865c04f5170f8cac1409d7e57be506936d5582502c6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fe6c208139a5f8a7ffa49d47cc8cb0e
SHA15ee1a087901672e8ae6ba1bac2e632acd8f153a5
SHA25697b1252232bda01ed54bd4f113e1798915cde428af8b8cb2b13939fcff793306
SHA512defc681db7d488e78697c023b5e61cd2aa13b23e65260e9add7eff15be56030a15b40f2bba00a09fb7ebe9e6c7e5a127e9d7063126a21e8293d1b386cf7b91b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c517d22a5e27f562a535f78f8eea340
SHA156a538d970c14015c0c9ff38c60a3a6d62c45007
SHA256c4567eb86a6d0c25875605e6db361ae811e3fcffda12fb582c3d7a0fdc0d63b1
SHA512ca52e1d6c023563433999e6cf81f8a29c509b024143b37119409b86584f973bde31086719b77a79216f0ff1a9bae88766c972d62137944f8055b1867344211a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5380938ebee8da3228f8de79a1ffd71c8
SHA16f390da37e7fde56433169d5393e5c276aa237c5
SHA25692acb8548feb0adb2db114e83462e32a4758ddb1ab9e6d940f82d7e9b690bfa2
SHA51204dcfcb7a837b8dcd83da4ca279b1c02354d18db649465ddb42e014a04d6ee82536d193f8f7b51d6a0e556f5e6280bf5c52f4e4b76b40db7b1921e229d4e52e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c8ac025ea004a0ece763322f19e9939
SHA1d912c0559ef4de6a36cfdd9acba424a3751bbbd9
SHA256b7cb4a8758e521666a127d64d9d93747563cbad62d361f3787294085cf7f0bc5
SHA512b592114121bc74a831552ca06df0fcee803436306537ae341ac50dccfa00dc8f2fb8282d30c66345be3803e1f587507eaf9654f5131b48d3e79d70a3b7da7f5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539aecf047fc764e5a21480c6edb33975
SHA1cda981658aa02358ab7404327e636a6defc406d2
SHA2566c249c731b56d435a1088f20fce4816bba3adebcd838f435aa0d3c6f1e366114
SHA512b4b2e869b2cd9fee12c108590b79b6f635dd1b0d69193f23963599d03dc7c38873ee308e899e276b3db83f30a935a3cb826d73b52e90dc35e1627c4b59f530b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d1beb7151b6b6d59a37be057b69424f
SHA1b0f0b3be4515804776651d91fb243d962158ec80
SHA256f59fe07633f57dba96e8f7421ef37c18571d56f78706c4bedd56a6c295604087
SHA512c12fa28dbb67e07c718cee42712bba45ad72df2df23ae664a7b43336856d032e6c4b7e5108da9a97b43e1e47729ff370597cb94e26f455ed4327370b5f9534eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d77ab4597661b85d4d1640c2fcb53d1
SHA1f3de95d5c1ae9be824073de0a3be1adf3bffe1a2
SHA256bcbc79bfb10b9c1b0334c9922641abfbad83f63a8ad1f954dc434e77c5b343c3
SHA512fb5db3bc08c86f356060b047eed20ebf9712fb3bbc74fda8e6764f909a5ea0e46c4ebe973c6b908aecb4d04dc01c404319cfe814e65b361dd3de72ed6e0815ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a54f18901d63ca1d1a0c1d55c55107b
SHA12b3e22b20fa10c35be77860fb448cca879b190d7
SHA256949dd621f04b04d9f6cca90f4cc79167d28864e13927b9902e7179dbd03579db
SHA512ec658680050692ff005558d3efcd2e55531b08e53ad8c58370f15b1122a302368e6ccd10fe38a4607b091e6a7c4be6fe9c367d633486b588c6d4e416fde33c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb3ddfe9fbf57b1290f92c7fc3f98b00
SHA183be7460a5282d9480bbf4e6aaa9c8d94e4e8d16
SHA2565769ac88092f0dd1bd31c059cf932b6ad982cd8debddcac7787dbade32ba5e82
SHA5127515bd589ec836a42b1df4ee7c3a40f6b1ea3fd588af89684b7086eff8f285aee5d3f82bd664baad5413aa0f06d5ef286fe806c33a07733a98690469b63c6e1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54af01c22dbc47e102aa53fea5200b934
SHA1e70ddb59567a983beae60fcb304e8ac3fc0c544c
SHA256e524e9f7d23ef20c14ce1a7fcb6822352bb6b891eac1cfc683a53c7d12ff628f
SHA512f86f3e42949c86571170e3a43098f2937e495cc27397416639042ee3f760ba51ae8e018541a1a1f5f0441d4c4e3b151513db3b236d39b7836874a74083bcb533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfcda57bbf1c208a5dcd3d97de19c753
SHA103e7e6e2ab382b48c084e679889dbc38b02c5b21
SHA2560596d1e3ff032c593ee3444f60bad80eda588a71ee6872a4c7a5b35ed3f3c309
SHA512f54f0b3415cf88f760b1e471e6b94279dfb79449c50f392c9922de7a1509a60db8538edd2166b27826c3c03c933463f295f42565596d5fdc3a03282f167f8c6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb6429c764391437867c5f42e86ced08
SHA1f6b22a36fbad5890a24ef565596cfc0467da0fcf
SHA256e06a2986446fac128dd9182d3f4e17af464e15ec2b7c0d5f30ca318426ea0be5
SHA512ee45af3ad32f7bfc557bc050ebcb6d2fb11788decc76161212c4a6b5f19f23da0d1c16ec9b7ec5b1193cdcfddc79ab8765e7c3e7b08d268f2d0e344d9aefe08c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54542a7223e1db317aa387708afa7d9e7
SHA178bc67dcda8b221b06bee94b89f9de82922b6077
SHA25694a0e501e8819faac7c07023ed2ba2e1f6cd8ae1641e65bb10ccd09c22cab151
SHA512c6bc03e47e5b67a998b5e5ba196f8c6e3125e6020647a9b1d0d800dd09ed26f180f5f342411f519c3d128d4c9f74d6baf644f000f1e5b9ea0f7413d1ce100ba6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d858221fba1cd723dd6a1eaa84d2360
SHA1b934c1ce7405eea3ad7a82f4d48f22c2e6ad3bc4
SHA256fbd4c9fc6f26695e52cfd40447aff8dc81fb26817d0eb7b774bbe220828c1f47
SHA512130adfd83d274de0e811297f34617b9d4a1a1aad0697dd903b590cdd5bc3d2590488b788c18904c0936fe2677ac63131e045461b02488e5f6eec178224a67253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af481c0913187ed005436dfdd2b69ad3
SHA1a0aed5855d4519d121c976570d61a9b755b0d7cf
SHA2567055d3f08c200625638fdcb494f952b988f5301c67f284f59a07c84d1dc3eb07
SHA512a780e970d58ba956b8db92429a816e89f478dbb809451ad1ad8b3dcf432932652f036a0e4765548b710948b980ce1c45dcaeb8c717d577772b6944a36f60bda8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b308c0389a28974d34dbe040766831e
SHA1f67fc147049aeecde6bec658acd5ceb2c1822805
SHA2564e06a07623ae495aa4dbd784ff806764a05dcae3aa6f80b482a7a6f3f049efcc
SHA512732e27bfb0eac622c284b24dd1b18f0c9fc4d90d0bdf6641a3196884bb4e1d43f289b2ff7e38006b77669cc1ccdc1ac22a73e1657a9e619c761ddf7eb99c328a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a