Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
-
Size
386KB
-
MD5
39d935bb40cbe2590a38b0d23a803644
-
SHA1
4dbceaef0ab63b49529d54f791d19ae55735040b
-
SHA256
5f7126449f9d3ff412b49398c16ba3138ad6f7a4158ffd2763a916bf720a8789
-
SHA512
1a747b9c88ef2d41b86802c949deb84a47a9ac7c4ff35c97ebf291fa95814b0bad23595b3d47b378c3ffe780d91f6d75705b3b695524a1f95a1d13bb4cd1ecdb
-
SSDEEP
6144:Sx+sMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:j5d+X3M5d+X315d+X3+
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2500 svchost.exe 1324 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
pid Process 2952 IEXPLORE.EXE 2500 svchost.exe -
resource yara_rule behavioral1/files/0x002e000000015c9f-570.dat upx behavioral1/memory/2500-576-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1324-583-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1324-586-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1324-587-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA766.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4597ED51-1052-11EF-B5EE-F6E8909E8427} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421674969" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1324 DesktopLayer.exe 1324 DesktopLayer.exe 1324 DesktopLayer.exe 1324 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2088 iexplore.exe 2088 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2952 2088 iexplore.exe 28 PID 2088 wrote to memory of 2952 2088 iexplore.exe 28 PID 2088 wrote to memory of 2952 2088 iexplore.exe 28 PID 2088 wrote to memory of 2952 2088 iexplore.exe 28 PID 2952 wrote to memory of 2500 2952 IEXPLORE.EXE 32 PID 2952 wrote to memory of 2500 2952 IEXPLORE.EXE 32 PID 2952 wrote to memory of 2500 2952 IEXPLORE.EXE 32 PID 2952 wrote to memory of 2500 2952 IEXPLORE.EXE 32 PID 2500 wrote to memory of 1324 2500 svchost.exe 33 PID 2500 wrote to memory of 1324 2500 svchost.exe 33 PID 2500 wrote to memory of 1324 2500 svchost.exe 33 PID 2500 wrote to memory of 1324 2500 svchost.exe 33 PID 1324 wrote to memory of 2740 1324 DesktopLayer.exe 34 PID 1324 wrote to memory of 2740 1324 DesktopLayer.exe 34 PID 1324 wrote to memory of 2740 1324 DesktopLayer.exe 34 PID 1324 wrote to memory of 2740 1324 DesktopLayer.exe 34 PID 2088 wrote to memory of 2772 2088 iexplore.exe 35 PID 2088 wrote to memory of 2772 2088 iexplore.exe 35 PID 2088 wrote to memory of 2772 2088 iexplore.exe 35 PID 2088 wrote to memory of 2772 2088 iexplore.exe 35
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2740
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:209940 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD523f40df3562d46ef7b80fe7279ce2f3c
SHA14014a51dcad27fb74b52d4d9d6adda92242e7b62
SHA256df4de317db847d5e22feaf8b211a751902c1d590aa25687e0b29577ee46db2b3
SHA5129b68d131fb1c565d658ec3dede7d78afddcf01dd6960bd2f6cbed691df092a82de91d536d53ada04d00c6fd671c2e512e9215554a7ebee17c72245bbe4230ff4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5939a13e423bb1e0091445cf3c60c60da
SHA17d7175e2c29971624ab6b6953b2504060e30113d
SHA256e51b65f88e12bae0bd275f4b874c119c9f9313ff1a2325b5c3d30176805fb5a2
SHA512e9b291615b31ca00ad8261fe8a1b96466759bb9e49246f2bafb756f2a3cda29247b370474326343c98a042ad1a6b162201fc3953ffcf0a163cca97224eeb0444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5ae71d07bb203654d308f498314bd09
SHA1cec446aaa79380b2ee919d1c7674671c5732aef2
SHA256f85986fd3bfcb35cb4a29dbc1180abb4e31e189d7be67ff5146de2dd31f107fc
SHA512f12b775782a7ba2e91b75f2511b3354ed6862e2a4b86a77ea0b1d8cc5fd0b130bfe73c90783070cfef02c64e3e348d5f59044c5629dba421c8499681c4bf715a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e2f75974c540b942cd5f02fcff33c65
SHA169d95765e83d03dca80c1da74b558d9079789551
SHA2569528405983cb55d9ec576d09487b27e1bd11acfaed6c83566160cf5a637ad6e2
SHA5123e88a3a655481cfa00d4c50a1f756a84af457ffcbeddb8183a5fd826b407d4beec2b5655ef89fc56b270daad4d28429940a430f0b1b5e714c855e2e93e7b96e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c5557be29d019f67b41592af0680cdc
SHA119fb653a582475e65f22eb577ba999ef80365214
SHA2564294abed0a5ccfae03ec95348d88696037a6c0c41e7fb4e0d4ac5ed3ea6aba20
SHA5124fc4c2343f417b9d3a90fe5e8f9d14fb53adb1a289aab84383526282c819ba5319183a7b1c1ef1605e9b80868d336606b2b1186b8bde6080891f914ac331380f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebed3089a878df9b70b79c71f3ce8397
SHA14c440949777f7cfd5eba49291c257195c6f3ecb5
SHA2567dbc7a9dc6e58eec4911d89ce7c1428de474e98dc93cfdd71da183d711c044c4
SHA512184a8eb62e7ec9b87a3459aa1dab67563481785f04afd463c48764b95b38ff270813a071b2e0aa076959810512d37984e59c0d3c57e28a89677b738ddf2a1bff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fb18528f1f2d22f94cefe746202fd84
SHA1409ee710415f964d34a09ba41b98b7b46501d9af
SHA256b0700829081d8b7d9b995fc5bf5f7a5b1a4f7b70485edb236a9ddabb7f657977
SHA5124951b0084e1a30c872afc39ee0ed9713f45c289762126958339ae3859bb4dcd9d58d7701b4b0b78a3ebd021ff903a8f6e6a4d239b94ecdbfeb0943599bb562b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5befc0f9da5b4bf2798560f3baf0c4432
SHA1a82e34ee03ede9cfec29d06ea257a8cc3dc6a50e
SHA256a43d1b9d14d9174330699a3a38984e02e447ed9ec39c479d788c33905a415da6
SHA51285091467fc244e14e3723fcbbe91c6117b0afe4e861381c59868c5e39a60099da8863675226d082775e0f190931641f501e065932f38d84939e9b69ea2e37525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2a68fb49eb181729f21b10fb271b01b
SHA1419109a79d517115cded73f00e61ad871c319cf5
SHA256723f9f2b7aa95f27b5a7bf9d09044fa3cb4d4eab26757d8869b0e30b526b1804
SHA51284972a13fd090434feacfa35543464fd14a603b9b7811d396e1ad5be5bfae4214546eee44125d480cd2b5c1e6987cf8cb362500a36e6e1e8a5ed5cfd869507d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567513d889fed9a038bda2d370d58ddd2
SHA1271bbe53d94ba62900fd75ed84d151974196a2b9
SHA256cc7ebd2b054cbb92009bf3fa052881ddf2c2252f5d2f6f4157c94e3c05676f24
SHA51258a5d01a71bf82abae6b2c15073f341f023cfcdea8672cb91b4f50f43d1c80c17e89fddfeb8e2a9cc873a8d0209f73d1d23dabd5e23053d91cd83d268bf88428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5b4e7b2e5d0339051894dd39a7dbca8a5
SHA1f0e0284c0481a7e4ef32a4d452dc195fb0b77b40
SHA256c84ee3810f98bdd89f9abb6834a21cb9b85ec19d628b7e2ef914da26ee88fc98
SHA512776e1d77deecda82d675f37ef7a3fe46acef5ea14a4cfbbc46b8cf60ad41f32515f73ed8e5ec7a937e84e591649ce1adaabced13f8ab17b820877c76ec0514fa
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a