Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
2dc5577ee55a58539e8313c42c8f0cac_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2dc5577ee55a58539e8313c42c8f0cac_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2dc5577ee55a58539e8313c42c8f0cac_JaffaCakes118.html
-
Size
3KB
-
MD5
2dc5577ee55a58539e8313c42c8f0cac
-
SHA1
498594e5f05303c90acab884a3f141af41da9d37
-
SHA256
391cf4b9f9e611a12e3ac3bff01775d71fa2e5b1d973c0d8002c584cb0c0125e
-
SHA512
0174303a3efeca94131153a0d033706e4d8402a538c5c5ce0eef323b83b3efe7a7f0658db623450cc9ec7088c8b45e05d038bd3f1f638eeb8b2b7c35c36ecc5f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98807C81-0E95-11EF-A2CF-6EE901CCE9B5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000007837d6e09bb9dece32f98dcb5e4eb9f98aa11fea782872d3534804cceb4e7d53000000000e8000000002000020000000133cb2a2af241d8c6063f38ebae4b2a6ba5408a3cbc891babf6ec1e7cec917e290000000ba1ad6ea40aed76a87437ffe7efc7a534f63b4fe0724d911a031a526aa3459fbfc2b3b4f49169d604da2bba55e6645f1d0e9a990b5c9ebcbc7e9a46611e230678ac9c58f7a07dabc78137135fffdd481ddad389ea30b0df7972f42eb820e572eafcadc9e34dc8789582390ae6adf680a5745101118dde46541d316ed46d7afcc84c138b5ce86d221af27ff40f05205f740000000a424580ef2b9f65f7d4d72c06d8b7627fcc81cb5f7b49b819a702827c246c374ef34b9a42e7f3e6dcf9563fdc86fad22f10a3eece6828b90fbe24b6cc067583b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421483981" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7078386da2a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000093f4abe874d11cb5c4210ec2a3315a3468db80cf06d77472576b70cf2d2586f1000000000e800000000200002000000007b4267da245bd9e0d85a817820448522218ac0dbb5c6a5f89d481bcfd4989f02000000040c81ee6582a0e0f8e6e869e892ce09254172d29b3128ca43b2ac5489e8b6df940000000d8b50845e6fc920bbd6ce19368c9188ac484f4bed97bb183d827331304e2538d9fa8223d60c99f5766a8bd7bfcdbc367a98195e7f55756e0744bf232a9667ca4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2692 2316 iexplore.exe 28 PID 2316 wrote to memory of 2692 2316 iexplore.exe 28 PID 2316 wrote to memory of 2692 2316 iexplore.exe 28 PID 2316 wrote to memory of 2692 2316 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dc5577ee55a58539e8313c42c8f0cac_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8f5d84af5b9b90fea2b4b4ad6c4adf8
SHA1144e59d8bc50f3b551b905036a043a622912ffe4
SHA256e625414270b02851b7ba07dfea664386fca37210ef73670d84b6d8fa40742866
SHA512c494da6d9b4634c19641e2f32ba5aa4269a65feb6f3e7383d1462c3763d7486ea32768c1e2383a78e43a1a72415b58439659f443eb34809cfc72f119ce689899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5746c83fa791b5da0a2c5710c4304e4
SHA1d6618ea8fa49b2f690cda1ae259e3da645b196ea
SHA256a43e537d33f34dc8513fab72ac76c0b135a2af871a892910d571e974228c13e3
SHA51299a880ad0b40bd0e973ed024d6f3d5a97e7f47935211818732093f91a36d44de15a7e8f3f818ed4c924efc41047a6066ff70a8edc29bb431cf402262a58d0888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52508a5496950fe05711a82e59645ea09
SHA11d6ec32e80068d61c6b01a2134e4d57fcf72cb7c
SHA256022ba4e0302edba3547dbbf04e2d42f5053c2b8aff9735ad7451d35682349c3a
SHA512ece1293c8c51e8d45a377c3d720a49d9a8220868b54b8593f6cfb8783427bc9d1d8ca347d0aee9e4ff1c4bf9c0d1ad00e29cb6bff5d69bf9575fb4908ae84617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7de0005db3287c5cf3cd23b2c7ed67e
SHA109902ae8c1da0a7253befdfadab29694a480796c
SHA2562699fa79ed45dded2d564be272629573950494eb98231edaa474fc3957cd3c44
SHA512a126a31f1ed4b743c8b59ba79354e5c832b4da66680e99beebb1467a072de2c85004d9b9bcbd8fc59e5e9044196006ccf269e9147045242a257a9ff1d4966118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f3caa7e49ad959366381ef63da9af4d
SHA1adce3ffbf056d4b0eb0cde7a5358830c1148d727
SHA256b14ec292567a95086832f1989e7be5556fb5500ca19f9b25142dfb2c3a6d61b3
SHA512b71d6badbb7b845fb2fe9ea0e7443ad35307451b16a438d1833c3438ba5b3c00af3c52dd9e8f8e40c8cfabc6ca6586fa2eb28dbf171f129d60c66272a1b2cff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587ee37cd86c2e44ad71dda1caf9fc155
SHA16e82bf2bb19246af90e64711ab571febf8667fa4
SHA2564e3a836e420a7f8182b025e380eb6b73e8f17c30067ac8b90615a9dcb241a176
SHA51290a8d685365038640c655b4e17e6d68d66779bbdcd6342b948cd50749c6de807b4cc56b36aa837f6d091aeb26827e5d98f13747c132bc6ba500afb1891871ee0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588c964495db0191739298fb572004c45
SHA15e8613bfb67ae843d840b93bf6fad379e637e17b
SHA25640aa837622927fb3985a5bb06e6ac1cf38efeb7827e8cad83212dac7c2a01dd2
SHA5121057993eca464083979b06a39d28d63e8c3b6924dff98db3b7259b3d6d97aec5669782b3c6813070a6042855f2d6e3918bc1e05783fd8a46a2c0d22172d3a6c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ac9b124fa4ed28d967dce353beaa75
SHA1760d074328dfc63573f26b38b005242e14a795c2
SHA256b1fb24ca8759e26243b6fbd6addfc25941126deb5c0612e30c3d61305ad3e1ec
SHA5126ec0346db43b8db9c54fda80ff48a6329f5af4ad3b5ce6fc16342e5f7832f519e22c92a29b46344db8c4989d43e2f76d2c96c3763e43121a41c471bcd6264592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc953dc4cfa35802f3af965e6f7c18bb
SHA1dc01d063b8003e0c0f9a974b22daad3aa237aa8b
SHA256c3be50c1ed6b2483105f2425016f14465cf4905b85dcac3da52ae6f42ddf0d34
SHA512e0ce7d8255b8bcd423e90c8b854846625a60e78c98268edc6c28c7b8df3b811de8e13ea86ae15ffd2dc6b1eab3305e1541d56cd0f4311c80f6dad490b1ff2934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec90530240a9e53e96ab3bf224dc5785
SHA10eb33c727e888a6177357988b3429c619ff4378e
SHA256acb1b42c60f71090b7cec544f817fb1eda5016c28769c029736a4cd80f6ffa86
SHA5125d26e3f61283f9a43b1821f9d8da876fe7d1650df7ede2fcc9c8409a728cb2a902f5eef69855d3b41504f22588e38be0b8b857e9cca4e84adf286c63268b475b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ca3cf901cfc5aa386b40dde86e0614b
SHA1a0409be4e6935c0e44acfc81d9738f20733c8390
SHA2560e813ef998ae1c74087ba4525eeb33da6f0921f5870eb38b6a9efc8f40e231dc
SHA5124cc15500ca35e9de64dc5148c962524da795ee438daaa8517d5b4ab22f32db6f1ecd4e8be09870e1b51eed18530269f98cf8849bec77d180dac0b5f61e8d5052
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7cc13aaa9b229d5ab0c678327d507f5
SHA169dfc1e3d1d2fed1e97416d0caeb7d31198e47ca
SHA256c6766c25a219146d06bd18b5f40f0ec4672c619e0dd56d6de8fe0584e2797ea0
SHA5125d4445da5b3552c8a91858b93bc788866329ecc0d95a41d3a9dc7cd00b1f0f021906403a1b921b8c21b8cf4fdb72131833317a891b8ba63df6709af8fe0f99aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53804ad230a91f425e0d9d98e5e56a51c
SHA1b0cf78923929fed3afb0d79a39b54eac173e17c2
SHA256496a42d550967ed61e79cab06ce3fe0870b82335afa1b4c85f8ee7bb76679e18
SHA51264fd486bf78f11366e8aea6758d9d9c743fbe6b70465e72d5ea2ec70d3755d2458ac111e6aaf89c272053be5d83749312227b03279e4e748d79f533bf701fb4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547e82a07e4b650feefaeb93155621625
SHA14595723daf6fbb55f45e36f4ce274c2334b086d4
SHA256d34be5115d485a3a7c73919ad98a265d7f6d81c9c3fadd5a8057fe9d93f22946
SHA51264c08fb29c1f6c930d5caed1c988811ed6475c04c2fbe1550c8302f5b9315b7a27ce3604163d7c498ed92ea2b7e844395a61de12efc62af623bfb3b86f342461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567e22fca73dc4e7aa92761100df95713
SHA18912f502273c886df63ae0df3db6cfb8b2ddae03
SHA256f588150ea2526f03373bc094bffd8e0a9e77fc9fc3ef23c1d9cf31f05a03a40a
SHA512b71b109c79448cd5450b434594af301921e4de0c9be9f26230960d28f73058e84fc3f682845eaf990401eda4ab3414191abf318371025a293f26560b790e2423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a4bbf1e26d6f695361093e23d2adb6d
SHA175114e7dbefcb3dc22f1e6803f98bfe72bb443e5
SHA2566cb8d94a84edf5e20d59904d6a0b07e4cb2520295c7813508229b0c83b1e6be7
SHA512f4d5e09811ac3470bba682c97b850edcf42c1d27aadae6c12230c754e5867508b617d66fd3943584b33dfe7b45080f075cee97e7d1448da4abc2044fc665e8e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ebf36c715688aae2883e94474e0c855
SHA16c712d80bc39a112a2883f03f23076bf6294ceb7
SHA25650bd4a3cbd8d6d48f20f93461a0a6ce871bf6b07ac03606f08de0811dcd4d18c
SHA5126e4f155cef5386f902c1fc6f174fadbbf1099615bc364010e7c4406c5b28aa619bbe82f86f17fd90abcc3c8720ecf2270c7558fe9782b5d236dd253bfb41d841
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a