Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
32b9e7aed050ef0ac7c26271ac11fa79_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
32b9e7aed050ef0ac7c26271ac11fa79_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
32b9e7aed050ef0ac7c26271ac11fa79_JaffaCakes118.html
-
Size
82KB
-
MD5
32b9e7aed050ef0ac7c26271ac11fa79
-
SHA1
f9d013b7f9d8dcc33b2285879459eec9545af01d
-
SHA256
a307426baaf78544b4d009474ea610523d66b3964cef11e1f140b0b5e8f82bc5
-
SHA512
202658a8edcc30b7ebe18494bf402a81a641fe966700d6109e4344b4f78ed806a42ea7583381ba09f5e618fc04a5d7055f26642fa47d3961980727b8107329e7
-
SSDEEP
1536:npPMlbN6FJbTM7NbLxS1lSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:npPMlbN+bTM7NbdgE5/ezOlSs0UC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ED96BA1-0F4F-11EF-9BF1-5630532AF2EE} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421563717" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 956 iexplore.exe 956 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 956 wrote to memory of 2140 956 iexplore.exe 29 PID 956 wrote to memory of 2140 956 iexplore.exe 29 PID 956 wrote to memory of 2140 956 iexplore.exe 29 PID 956 wrote to memory of 2140 956 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32b9e7aed050ef0ac7c26271ac11fa79_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d9798eef48923c3802797ecde64d9d7
SHA1db167584299a0fecb67292a0a84a39b3ff70c5cb
SHA2568fc0335ebd0661f7902b50e23e5a157aeb120687516c856209a000434140be7a
SHA51215ad8b543140cd1892401f0f8c28563a9f1daeb7c6e256c454f6565e0294fc92487c754ea74f01110bdcef9316dc3cfe26fb3c86782332695f45d3c076690539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e7f61e83c3517ac791d5e8c9b045f3f
SHA154fa58f9eb6178712a89da78eae9a068bbbae6af
SHA256faaeed3e54a20e4be3b95ff0b9add0fb3aaff6c7992654706b572c510c8ef7a1
SHA5129d9d2e6135d9dca99672d9674b828205f7bbd80b42d1eb1702c3eb680a024d2fe8de865779c7c0ccb5170ff8015fc7a2148b025ff335262c151508af45c3e3e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556cd097a311c8de5950f70508d5fcd9a
SHA16576218d7c6f4812940b2cb48a0cffaec82430e7
SHA256f3054f797283256bd343851b858aabac548747e926437ec993e617e009c4da9f
SHA51227c4f6596660097006414e3548309c32bae8d99e020228eeddf17143aa1e1e5112b218cdfd306b8f3604e28d50d3cafb4002593e2e53501476b1d7113194c2df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c952cda348edcac18b286e325d3e0f56
SHA1059d160858a61383abc07a7d66d8221f6a928641
SHA256649d805fe82f4b5680613214cefbc0dc6d4d959ffd3fbd330cff62d4ffc9c7fe
SHA51218994f196b1249d6da3242d554eef338ab71eba8e1fa98138760a23476d2296553935fa9e139007087cb11cb7115647349582bc1f455f18a79066d693d90ae37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50279d48198c79d86cdff93826a7fe5c3
SHA1f4041a54e0aa34941b1828c3abf7d703bd44e9f5
SHA25623f808a675fc6db415429e95a0a5dee3ae3b8dcb42501a59fa115d75df5a611b
SHA512836e3881dbf2c8976c309970cf897f73cbabaee104628a0aa7aba9495b37120c2b4fb734eeef06c1b37b20919dd8ad7352e7135ce49fa19fd4daee224bd5da1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8e88b247e417f0a80775a2b3308ea20
SHA1837cdb4a31af6013d4a7ed9ad8739d2bbd35f229
SHA256c0fd59011e92664d5db7492966644b655084b0b7d10ba8be97aa44e2218a0c06
SHA51217c9f33b565a7b9f060246aaf87c7a1d8a01af675da9d0d52ece66f07de4a42629e26c0f129301f6e139686c2fd31902b1a6212d5a0b8e212cf284db1116d6da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4ddcea9a4cb0f28c6398683dc19642e
SHA1377b5445cdfda101c748cc998144a04c0259d488
SHA2567a14e1a15f44665def7833df38955ed4938eaf6fd0c40114c91c17e7c86fe39d
SHA512e2b8db68f4863c1cedd74b71c00871d56de83e1e8c9524286c1b760406bc463022019f9952fa35eae109ef439a8b2a9cbbf4298789a5db728c9c452604217822
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c36469c7f9df0f09bb06c238f90ad26d
SHA17951ab117c6c5e51561c0f6bcd24e94b1cb88d7e
SHA25643c8f4df62ccc3820e7dd0e2aa58159b90fb405c57d243f34d52d9f38586ace3
SHA51200b41f899a034a81f52f190e7749b35ddb5ccf50a570bb16ce9cd7cde3b793f7d794bad32de25d1acba8eb3bdedf055d7491fcff9daaff472b1d148abb149f9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d86c65afa8a66fa679f427f902d572ed
SHA1cf3bd3904a23fd5337760475dc1bcc017b9d379c
SHA2562e4671b7ae022077d6007cfbe35fce037a1268cbc708eba0ea6b0bb058563580
SHA512a771dbf59e4a40743569aeab07925ef6137e462e895493be28f6784e67f7ecb3c96d178d4438b09dade56e68c7b59ea874bb16478b771123bb674812c42909b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a5caa1c29e75902350fa9dee40c6715
SHA135c9e3475931a7bc261285a743508e8fb477ee41
SHA256bb9d6a7cd6898499c3417d0f3c9baadc242c308f66b3f386102a34120114f5a8
SHA512d43e0d3e4b896351b66691e0b58653cb0ff4217590b8349ae98be66ff89c449cb5dfa0785e90f91f6afa8e8e3c66fa7d793927406979521af2fb41d8c60e9aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55290ce38307c4dbed8b4f2da88ca9beb
SHA1b4670dd9e26090a90039d807bb276bbd5708a43b
SHA256f4cfc346071bcdc6055e4fcafad693da08c6b4908ced80c5bf38a113000a8ead
SHA51231b653ae83d40fcd9ef81146211803914b1d1017c2975a4d40b4a6a183f57a3a0fea72c5efcc6c779cf01f0327b3182ca3545c7d491f826ae0762617471c0273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55725856a88313ab3fefabf615d150706
SHA12673751cc6298c6a87f905f24b45e5b73674fcf9
SHA256659a78558781be194db08f5c8071083b49c1cc30428b12801f480e7bd8d9d82e
SHA5125f6e4bdec674f8a2964fa83b2182be05d62c0ea3dd482f015c1215d8eb64a361184746412380fd4bc968a735d98dcbdb8dd8ab9615e211251c7adda3f999cac1
-
Filesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a