Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
2da6f35e741809bc13bfff802671c5a0_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2da6f35e741809bc13bfff802671c5a0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2da6f35e741809bc13bfff802671c5a0_JaffaCakes118.html
-
Size
213KB
-
MD5
2da6f35e741809bc13bfff802671c5a0
-
SHA1
f22c480d252ad501353776434fd9415c9a0f3130
-
SHA256
a30b48600b835291c9b4361d4309268a72f2efaa5f6abd8d2f89b7cbaa2d5024
-
SHA512
8e88d048f69554fbe4182f064a1e94f5d91b2238db6a4cb2eb638d9a4a88eff7c1dc4f4f6dbe412f5710beaab88623cbd32830b7393431bea0c5906ce7e9c8d5
-
SSDEEP
3072:St8x6yyaLXNyfkMY+BES09JXAnyrZalI+YQ:St+HYsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421482067" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{231B57C1-0E91-11EF-A4A3-CE86F81DDAFE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1844 iexplore.exe 1844 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2688 1844 iexplore.exe 28 PID 1844 wrote to memory of 2688 1844 iexplore.exe 28 PID 1844 wrote to memory of 2688 1844 iexplore.exe 28 PID 1844 wrote to memory of 2688 1844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2da6f35e741809bc13bfff802671c5a0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5597f6a10be10255e24589ebfc4a12381
SHA114ef4db0969201bb2f6ddfcd57ad3960d7c3feda
SHA256f0f43796f0d001ba35055f215f9162a0eb818aa0946d7f1efaa2b5618dd63106
SHA51250b1174b547f0f12b2f2c035c6727841f41832fcbc93deb73b6aa2e1a8b6febf500a91d8895733c6903771a1e0c92475a7db32726b41ab6dccb638345fe8bd9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55659b749d4370bbb7149b264412790b3
SHA1bd6572550e41f69f2afb5e069678d24a45bbfe6a
SHA2561cd3bcbf1566027f0b1a8ddc0a44a93170ee6df1eb31e83a20d6ca981f11816f
SHA5125ae4f123d54e14c8a88fdf3557997de7aea9d5e3f9a54d94ad5d1c4a4458450de2c39aba644b3d559254d1ec9a707238c57adf5193112a2be16e4bc89f0308a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52249ec31786a312521a6ecddc61f5901
SHA18355c554ae99d48553893c8db3474a5caa102af0
SHA2565645a82000c6c129c2135b10c553677ecdc0815369770d7d3d87498d23f1e16d
SHA5125869fe48cad88c1f652945fc70172664b5df8dfd6629a3c20c84b1be97e0e209b081f5ba88bd088eae82094fe16824dbb625756e7382293f9074dd46aef8ce58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54433da4a9683c958ae242ffbf8d2aff1
SHA101f734333851be9f96b51a95ad413bf6e3a02166
SHA25665a18ad0aa579e698c6a627bd1f41ab428c3df5c31f770218ff4aebaaca30166
SHA512b9c818ea9e029e5305afe2d811a8d5acb062994d2bff29205cfdd3018f49d596c3c8d2cf414d7ac81f8295317194216c61200f2a5500ff244e9934ae3c01b611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f88a1b36164453b1b6b6f7f8084461
SHA142d77280c394a311661b86750cb79575126517c2
SHA256e831beac28f06ba92e08570cdf93346a22fe98ac0c7435b8ab0887d735d1d6d4
SHA512873e93f4443040f4f726126eb0eb35ed36ff0d695d3b646e299bf8180f23a3ee2f916a25d29b2d65eb90d010883866ab3c91bcc65613752424af84fdea3f73a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594deee0e5650fa62768f010278668072
SHA1eb8dedbfecdb6f9e2724c7c71595e7b357b08809
SHA2567e1273597cc0cd54f7ee8d72e074da04710b4cb1d7ff8973ab0fe44e8bbbdc7e
SHA512f5311818e84cb471591a886789ef8deb7a60880f1bd4385b5dc543bc145a795ca203175e0d1cbea3d3c718303a0bf71ca6d31a56aae043cf375b45885dc96ec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b02e5196cca7f923b52d45cb1fb73c44
SHA19e063bb374dbb024c167c632e00bd3351cbdcc93
SHA2562cfb8024317c53e56f60dd39d4b86c0c3e4e4db244864e3849e1dc3338d27408
SHA512b4e63449243ab54ccd399be117252cfea3aa9c451eceff5868d64c0a8ad04d94b24e91c247caebc31d4b989be370e21c1186c468f67a4fd5aa5474418c18205c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6c79ee2f8da92db2a9d7cf2a5c8571d
SHA11ce29e2cd0c7580dcbdef8429d1cbe19200972a7
SHA25687b906818f9c0c5335f830b6b3fe2fe81e16a5be5e065c7dbbe0c48eb01923c6
SHA5122b4285fd9d64f60b064b3e01d3507f0db1d784dcd757c44f3b0f32188742345fa45636a4b00265203fea8448512bfe0d3aa72a25a5910b001622f1256b5a6fa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56655be5680ec7e9a0fc67f76ebe9f16b
SHA1c46e58fdc720dbb0936e6263882f98659f02c393
SHA2565f42b474c6ae8c6752f60bb7f999cc6dc63e8d1bdd0dce770e1bec4eb7662a75
SHA512cfd40e58790c71b90c3b4fd2cf451b554a9c437521d681088682ad043baba9cabe42cba6e5932d4248e0ce310b582cbac049f5e5fc692a1862146fff63ddc0ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5147f7c37889b8401c1662a457772abd8
SHA131cd009d5a9ea19a957b088c9840738348824f2d
SHA2561eb644632e565c2937cd893f011cb6dfbbb88547e4004f258cc172e3b0db5d9e
SHA5129e438472877e296ab918582d924649a0347c576ec068e4c0ff5192d7413230ea82843a937dd30b410f3c55b307b51ac492e958e808b1d23f335d6bbed0c2d264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dd0bc181059a0bff92c8840e0bae677
SHA1a83ebfacb45282fc8c3bdf8c8af34cdef76244c9
SHA25611085ca9805cbaa809f176832a6cb6c35b247fe338fc700a69f04ba152cd45e8
SHA512736e2fac4e702e7c6fa872961ce7d34625fb93d513bb37fa969f361c454e4960ababfd3c195659342411e16817f634e720440a24a68bae4a945b19b89d207885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566136614bfbf0d3a7dc7b660c3973cb0
SHA1501ac9f49e0545c0ea7eab7463b3bd088f4349d9
SHA2567de376ac823712ee006819d061e751367cd51c2c89fda3c7f5f4f269f05b71fa
SHA5128f016c769640f2eb51bf3ca03558236afbd0eeaab1820c62d75ef65550865611c33c647db9f9d9441708dc7ed34d0bf4bba42f5f1b695c310ed2aa63d1f560b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b5aa190599be29097b931d20c0a3374
SHA1aa8de126d1dff5f7b8c907543730186a2ddf3813
SHA256fd19c6b3a031cb395f095593013f03af1d943d1d5c17411c484019df7cd8a330
SHA512b076c9de2561013ccecbf363ee6fa2ba040ecb5100b430c52562b430475025a730c20bd66006d647fce6914557418007e452aa6859f3ed9a01a63ae8a2e10af0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bea599b553116f26631c923abcc7c1f6
SHA1fb00e1c3bb8aa388c60dcdc765e27b0e1f33b3c0
SHA2567ef300f3ec3cd8999453fd9f19a40eac997be5e624a3929449ffa7c33ac8b62b
SHA512d449060c35535d936f3fbb47d012cebd262c059dfdefcf45224641af7033990074e7995bcc934e4cfc90bdba4b80575292f103293e57e2148c1d1eded2ece8fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be76ea9b7e52a2fb0181e5cef949fe28
SHA1cd5e1709c0da868c190394e6d158d7dd79a7600f
SHA256dec23b33532676c74de211d43d634644f31bb2828d119bf98b5cea96e5334b2c
SHA512b01376d18a4f52600e10f5745a39cb71e7c75ee2f98b20e4a34d5572e6be0230733e9a58e8db5eed12b245b4ed3f518a0c88e3f58d6dfc7af1d146bd4df9e543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f2b173c9eae7c7598edf687621fdfce
SHA1df0b97dd3943bb76516cc0ab95f50c58c829dff2
SHA256025b660dc8c10d7123364da575b10c3cbb555f18b327efa317542588c6270b47
SHA512d2765af6c6bc125c163bb2de106693553f7d75e4ecbcf08e7fd2d95e6c23c71102666660ae48ff2dce82112dd948ca76b3cdb06a96cee0a6878338dc2320f5c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554e9c15da4af047df1b0a4194b25676f
SHA12a89c3142385367cf86d01b4e8aa6fe0ae247e2b
SHA256437aa875fb9ce588bc49efc78c8110683103a161d708d05001495e7853e07719
SHA51240ad8ead8dabfe977d98ddadcc8b79f56ea6063c1c7913d76abffe2c3b6709c978893b07942d63c0a77040a587863d07364a4b0e16dfb7ae8d9dde327f7e1aed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55953e081f2273e791f7ceb3afb932237
SHA1898eafc845529b666681771cbe2f1fd6356ce2db
SHA2568d156784226b25cf9d321cba58d8161ecc00d17b66a43fff005b216b5392dde9
SHA51256370644c8f6214df83bc8b0ae06d3ca1e4ffa59c8b7297f68950d6968e73ec87431755815c16ad28b8f951d1bf8926809bae51be39c5d15128d5295512fdc1c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a