Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
2ff070a51eb2ea7b643877640aa3ca40_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ff070a51eb2ea7b643877640aa3ca40_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2ff070a51eb2ea7b643877640aa3ca40_JaffaCakes118.html
-
Size
461KB
-
MD5
2ff070a51eb2ea7b643877640aa3ca40
-
SHA1
f57b31f94967103b85b267ffdfde6582153a97f7
-
SHA256
1f65640d772c8962d40075e87105b8cd5dc604573e3fe79963382758d2e74c77
-
SHA512
139d4785acfb1906dd1f3f08772a38ba95bd7ac072042322d2bb18a2dac57d9224bab4fe8371c217089cefd9d0f2feb0cc40b03df243703d938d2f4bfcc4aa6d
-
SSDEEP
6144:SpsMYod+X3oI+Y1QYsMYod+X3oI+YQsMYod+X3oI+YLsMYod+X3oI+YQ:O5d+X3b5d+X3M5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b091cb33f4a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B41F451-0EE7-11EF-B012-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009f2f904aeeb77bd6a43f3e8dac8bdd73d534606bf57d966d6a250158e29c63df000000000e80000000020000200000007e7a9844fac5bfee32508a4dff2a3b1cc65becd3db99b9ae239cc1f8d9c93fd220000000c2989da02d516794df787c559a23ee9255d9047beee1307b84a5e3b258f4bc9c40000000db8ea7df898395c4eaefc47a7923742313059c2d11a3983d1629bc095a656d9393a498bda5bbb7fc1d13a1a0e29a43cfead76c1fa1fc305f1b8859e68dc42b8c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421519097" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000b2329a97641bf89a925f3bb4bdde3f4f62ef3ec3b583820943d35bc5d65ca633000000000e800000000200002000000065d3c3e059592c0c4af7096ee99ec1ad6d7af1153770eb6d6fd24a132826aff890000000903cf5431f235ae5a4bf2138291b3a22d4484dad2e6b11b46fcdd980e7f4513ffcb570e3a26a6e8e7fd4f1837d0cb8a8043e2846167892b5930eee1aefdcb48d4252d41b1ac1f168f64b5396559c76a080578aa559877795e6633260bf477816de83a3266eea2dd6a085afd89c1e182cc4ad64f2b9e11af22b66f687aa96f018fe1c79d068844a0dbde9591ad934d56740000000e4cb728d4cbbdb9b825b4b2e43a918b51b6548223aa0c3a458da8de21966cca20ea1f05cde8be8210712de7417a70c75dc8bf1fa2053e76cfab1cdf0e073fee9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1288 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1288 iexplore.exe 1288 iexplore.exe 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1688 1288 iexplore.exe 28 PID 1288 wrote to memory of 1688 1288 iexplore.exe 28 PID 1288 wrote to memory of 1688 1288 iexplore.exe 28 PID 1288 wrote to memory of 1688 1288 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ff070a51eb2ea7b643877640aa3ca40_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9a3b538091561a86aefa44bce7cd41b
SHA145e16329540cf7e35e92031114417c91a6f02b0f
SHA25629d930132b7a78007cf784e07b50a7d55181d80995c31e3ce93cc0f3887de5c3
SHA512b261bd1590f614bd51edd62244f88dd83152372ffebe7a563bdcfa3a1433990ea2986133597fd703a9bb0788c75fd62a6b0e85cf5cfa9e75aea20ed14828f24b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f40cb476bbd9141b612da815ef18908
SHA12ad28ab891600befe0e20cf8298424b6a1f6019e
SHA256189f7dfbfb789d6bc79fc4ff4f890e242955b0de0b04a82bd920df31beafeaac
SHA512d978b7f00f21e2b9575d143d1f5108185fd08c7705379b5ac0206c2d5ab0d6199c4b84d237c3470dc8795538112ac6678fe6edb310196c485ccf6f2c2196a972
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5737e1924351955ecb82d918516707362
SHA179c176ebbc7b552735a7376c7e772152dbde0a4a
SHA256674e933a36869f7ebd7eb7ca407336114c307aa1ddc00cba77fda6c8c8663122
SHA512a2e993ac587badf44264a3cb189ccda00b8e451d6f17356a022df27aad923b442a0cd0bc5aebd72aa3f1149dd58a7c872050eddbf622e0bfc4b6b79eeb02b205
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598417063d49ce3aea60d59d95ceada8e
SHA1e56f350ea06e20abf4aefbb29c0c34ba8981c9f6
SHA256184f747f5ea4c05690a399567cce89b4688902fde6e228554cd1dea1be91b538
SHA51295c9d4ef790d75a5c8b19e6fd51a4f59d452575020efc7451c42c090ad5e2771585b03dd38da3ab2be9d668c05aec34fee4c33304c1b1c890e96255db063ae42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7f374ee2d1d05b6f7f3209c946bdcce
SHA1265fc57fdc64a5f735dd0495cb0b026802ae73ef
SHA256af67f56751631e148393b64f400bc01d066e916c5d86de3ddb5132954b70492d
SHA512e86ef389853bbcf382398f0050facf760731120202168ce4a2b278341f24115b8262a613d16d4ca7f295a71d18f533b379ab1ec8ebfe6fd5649985d39514b2da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4478ce615f7370767987f092930a846
SHA1889faf9c097923288b7a4449693fea3ecab177ec
SHA256c8930979b8c5f5767499aa60c2f2afd27d8cda161e3919ba6f40630909e43aff
SHA512770b7bd595bc26af6922671336c3e73417026d0a07cf96ff373bae02b725ca7ab0fa389b8cc6a32b6b9c59411848ed1e2b6e2bf875d40c73e8a038a1ffc2217c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51273bec54d94140a665d049f7db11385
SHA1c7d802c0b5a9f60ba6ee571dfc2040b9e95c4e0d
SHA256b0536d08d31f0afc02bb269c497ddc70ab10587278ac9502fab3120a4c6d6ed7
SHA512e5787911fd1aa35b710a1996db87ead6ab4dd9268385565561983a715a16c1b07a00fb3bda86a28f569d26abd4a73409f4e7bdff23c8780573d02caa5f6eb21f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c5c94e72f6258af1233d567b1e588d0
SHA185505a19f22e4e08d160b3f509da88677d93f15e
SHA2560fc011b8bef105cd9f6620102186aaa62aa39089ab3dd440ca03e7bb9d8faa7a
SHA512ceb36537cb06394e7a1e1c2951212dd4dfbe606229efc885dc084656ad6773af944cd4ba7ed1d6805c9e46c932d8db05b5eef25981e51b41ceeb03f9e1f1d214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1f01e8a811f127b54d2b66e5153d56c
SHA1ad164d3b1e260728003f361da442387f9b766515
SHA256eb5e8b748f807be4b47596c1774cbd3aa21a257b2c30e0471122e0777fef169f
SHA5120bc29dcce7b8f837288dd14c92e4321b15bb3eeb63def99c83295a29c91af2c4c9f147296aa22b7c7a2388eb92cdfcf2dcfae227c104777da8367e88ebf58048
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b63050ce15defac51034b3d6186d0cac
SHA1c150a62477f07823ff938893cfd8d19fab8928fb
SHA2560c2e73a36b6956b283597135bba8d1e4aedb977e03eb942fb421ff335fa4d813
SHA5123f05e85840d7f7f682e27a43bb81e2ee232ff5b230d56c06c122d2d20ae60912070815300aa7bc193d0ff9da9123e412da6fb1bb40dba64bcb7532ec0e21671c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593a9922f11b55b82678205e2ae69b682
SHA120c8cd320c40e9e61481fb9f453420c9e5c73c6d
SHA2563292302e97892dfe4dad422a533cfb838928aabbc1313226fd4f6bd4821753af
SHA512863082dc9d6aac35bf14236b2c506e6ac50a66118b11faf25f89776ac218c04c2851a030d949819b884ec0e5b0e35235211a1c14f732762f6efa1d1ea76bc5ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ded4ec4e66dae4cf6c5e6b963c959f88
SHA17348d4f6135c99ea11b3bc138681723f26c5ff0e
SHA2569a6716c0c038d957db95f59eb0914cad56175e6870c23835a395a2f1dbc39eac
SHA51207d26eae8491a7c1572454ee479567372fda938f7ce84cb1fe92ccd79e8f183447434ef2300f0344d43337abe277ec8407110f2da5f06db4e4ddee1d23d3ca62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7a4a610a8049d77eedcc3d0362e424f
SHA11481940d880efbd8e74aa8816b6d88166d7573d8
SHA256672a21b634adb3f845bfd64544b7d8ff4477e8a4d24bfabb94cb7107dbeb9287
SHA512323f7fe4f989f37e639410937c0de463935e4e9f8e0cdc09c64b3bee797bf87e4b4cf149dc19c632a20026a467949cb277a04865fd117ea1ffb36ee96b4a2f15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5014175b3f8618719451b3026af61200d
SHA16a780064f7404bea07485b90991d126b269ec9dc
SHA2569e4ad51da86c2d3920e4df1167b8e02737f8a0d924cb5c3a4c0ecc9ee8a1cc80
SHA5120286219eb0729e0e0ab25977200eb4be38494a48099c940c11f3fff43c921f874359d9447d8c6cb48e4bcf16fdc806619d2c3dfae2e478a9607652fba28af9de
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a