Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
3a15c2708a8770f14dbe72e79f20fc48_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3a15c2708a8770f14dbe72e79f20fc48_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3a15c2708a8770f14dbe72e79f20fc48_JaffaCakes118.html
-
Size
249KB
-
MD5
3a15c2708a8770f14dbe72e79f20fc48
-
SHA1
c715b93c5b5b420ef6e8a52961e64d3d77f88240
-
SHA256
26c98fd16b0915a2b1211691447b81a9533a0c9258dc2e17bb705880e0e875da
-
SHA512
52f10c5ab8bab5da0e5c1bd3cf3b940dc11b39dd5bc01abe903db09ba72f1387203bb3e67928d044d4b41bf4dc8b0d47e0b74be0fc79a031fa6d050b75bebaf9
-
SSDEEP
3072:SUyfkMY+BES09JXAnyrZalI+YhyfkMY+BES09JXAnyrZalI+Yw2u:SZsMYod+X3oI+YksMYod+X3oI+Yw2u
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000008c1ace617ce52c20b3159e52e263032421c5d8050048af88b5e5dbd46962128c000000000e800000000200002000000006e662ebcad7fbf5704ae2159079ac84979b63676697e859caa9c7cc1603f53790000000e9be2dee5bf2faefadb918cf16fcaaec9a3158def63b1c2678bd53fbc8716d85ea559f12f2464ef16e3a41a83c935beaa08eaf60ac64cad3b244e83416e8be4b3401e1ff2b4b537ee0256b4a462e5398e0e738dba1856397efb1f5e4a1fc6958c06a3bd1d2b3b311ef3c3dc1253b7ada222bf3776c44820e812bfd92fb6c331d8b910a588ce0b411a025728dfc870a574000000025263502a11d00c8102234b7b166368587a4cc2861aa2187bddd21ea8234d3ad05547a350690ae399f4dcdde95677824bae16c51c5965baf3bdb610ae10ce851 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421678383" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000000d381277ffc11114a8453aff4b946dae065000c43062a39f58256d6733026df4000000000e80000000020000200000008eeaad9ed2eca9f2fe344ad6ca42377daf99f0b7ccb264d82efa75e1847be2bd20000000c7d3a4b751e810d50b28ddcc44e4c4c5e398e667558632747456b9b3b1740e7040000000381bb7cc3d06c4e8fb0b5db1694ae623531b6275d98ca77f2565dcdda3db614d44c0606aeeeba5ccf0d843ceb6ae28feb373db7e78a7471ac0ebdf73e2e64c78 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806c850f67a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39216671-105A-11EF-BAEF-F2F7F00EEB0D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1868 iexplore.exe 1868 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2956 1868 iexplore.exe 28 PID 1868 wrote to memory of 2956 1868 iexplore.exe 28 PID 1868 wrote to memory of 2956 1868 iexplore.exe 28 PID 1868 wrote to memory of 2956 1868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a15c2708a8770f14dbe72e79f20fc48_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5dfb02061877bd9d8d3d3f933606ae9c6
SHA1b7d6bdc6a7a355aa8dbf7b7590fe0526ad085de4
SHA25606616b5ad7766056ad40313945ca3ea5cfa4c8236f9595cef70abc991837b68c
SHA512f549aed8eb47424ed72bf3ab5a1729920c62f0510a751101feaf292a359e20ae6eed896b215f95f1c47bfcab57e597e4c92f0bae25bd35fcf7f7d64c1c90f4b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D
Filesize471B
MD5f0ae9db6b73056b546b107177ce09859
SHA1c92276281e7225179751312a2075ebb9825733a5
SHA256acde17cd960be95c2650369ade9b3fc676beac5c08e451d40958247ef9da1627
SHA5121f1e69e67afa48e531008699d1cc69ff63769132d8a99f2a273391a8ccf03329d3bbdb382004c6f8e71402eb9d68b71c9cfa069152f4abfdcdff476b261177fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3217AAECE20956500C22BDB70A7D005F
Filesize400B
MD52ad61e51c85c3c957f5535f2315e7542
SHA1c396d161f625783086faa5081f5c1418537757b5
SHA25640c4a2a594bb60c3cff2c660f586ba6333f6d5f9bb2cbcbdd1bfe1ee3b420fa2
SHA512a3cc22cee88ba4bbf314e4f0463448c17310eaf60a95d1c81601511e8d7e46aa955a201fccec959de081920b6fe4e1e0e4eb8be339e292babd5429c28fd56181
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bcbd1b0af7e5ee170aacd95b8c1154a
SHA1c46d32eff80c06812d32e05cff1091f1d78a62a3
SHA256d966daf0a51aa9a23480307b493fb48baeed5120fc88979f7d2b7251741bae2d
SHA512f48cd42e53c13ed51090a4c484ec48bebca14b8f5e61e3a3a307aceae9d0330fa4d2acd2c23340e7d3ca21526fd5459c5b7bb8d6cfb1d5bd33a067079b0ffcc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554192475f9510f4aa005cb299421a88e
SHA19f89fb77ff20ad435a6fc7f548fd0fae57e0ec49
SHA2566cac17679e76764002b031e7bbd0020a5ba4f59f45b27273a8ac309321112288
SHA5128ff7a899300e9efe903a649eada1dc4ccac2c7fa69deac42cf529093e63788e7522a9fb997251bf7c39322f0c6138c1621228233e050ff6d5e518395b22f8236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2afbaf6b5b3dd80e72e090949c31382
SHA11111c7f7259a3b7cb80b1f0170584d69bc1de238
SHA2569c07e49f33c3859a250af991d1973cd63110f5edd2ba1062878afeecab59a25d
SHA512288844c5e790dd25e94f8c025837a3c5449207aa995b8ecb92ee3c39eecef7cdb90d668a34a0d248236499b6db2e6a62cb5672e5614f6809223e69bf3a73d082
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d8e55519e00f1e0908457ae3fc8cc46
SHA18aee7cd6513e988ffa1877bbe1f100802dfca8ec
SHA25620957f0d50ab28938a1ea6f739c091f671933f76fc5d040e88d48c1e38d90fa6
SHA512d1dff164d8115bcd7e0c569018360c224eefc6207c03addff030e2eba9dd6ac7ce94a668f4f0628441edc9de85ba6a26015cf3f64a3d8a8a6697a431a6dcf477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527b2ceeb4d2938f2e126209da27908da
SHA1d178759e615082a31fceec47a2e6a6e9011b61f3
SHA2565b153f02ac7b8731072adce76b88b01c8ec8beff4a0bbf61d7e14e85556eced2
SHA5126029f6ca44ccc640f8546d16f3eb480151bb1050c25a74e0e3883ece7df51b83fdf93698498d4949cbeaaa1457cbdc608532332e6558f9f8a6afe1ef62d8e1c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585d31ea031bdec1bc91074bc104ef230
SHA1a8e823c6f4033c48d46480a954aad5f9254640de
SHA2562caca6d92f290d9ef04735cd6080b9f6b294d03340600fef3b722b5e462c13d7
SHA512204464a4e12c29b4a3bc1cfb3e8981bca7af83aac20f3e83b63b2a8155a97990935f4d9b13aac69b32e3a7d1f84fb34bcbff742223c3cf5bfa232a1c3f67c818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571c0b158b7f3fd2e85b97dd935e0f5e5
SHA1ba0768304f3cb34b19c2d5b9bd4a757e2f2071fc
SHA256d1305313fbe8437dea7c8d48c7c7e6932b8814c78b4416619ed36075347c9416
SHA512bf072c11fcd4a6e38cc37fc943dee5749a3c60543776f6881cfe6c3042dffaf6f0240792403c01f883cd32d32605f7b3101c54472cb653c5d703c9c4aa19ce5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c664b5763656fd59f2f788a98504101
SHA18a11239b338488774ad1b8936629e4168eb97cc0
SHA25630fe3d508d0bfa1b284e2a54d642fa0c9166e8eac6402407b47ef283ebdad9a9
SHA5127b438018581d8bed424624d2120456ca5afbd948a64407f83d6b258e8fd67352d0805085d79643c0aa9ed7832e19fb845cf958ff2f7e47ddba28b47c96cf7610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5977c049b28f2c5d3ad60c2a245e63b6b
SHA141b4d8f8dae28c299bb16cce81575a512c80f095
SHA256159132b4c447d75bdc1bb5afa237a55221cf0855c7c3ace59f12bee4cc0fd636
SHA51298c5b2d3130e6e522bd656971b26ac4d6e97a96b9c028cd0bd93896f1fa7ae230a19c3769b4ec1713445294ad22329e8a64a43b131c53db8ca7af33889f90d7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebf36068584a742233fd0b015bdbc5c2
SHA124b90c2dfa268cc1134e9fc289e83825c8595ba6
SHA25647cbf6cce8df9aa976ff408d01f0df668fbc709f3c0248a0bfb515f0c1940216
SHA512af2633fc6692fda110184d42206bc690273882d8c844b770f0a2c86c305428a74c0ba20d995d1a3771086ae2f7dbd31522b6d2d29805e31ec68b4aab07bfb8d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5131125a28e09719dbad59afec28cb5de
SHA1eee939ec19b7fdad2aa746251c6e17dcc72def4a
SHA25630ba637c1b5c3f014b1b5201a91d2d72b74a1c5f5a8240294e877c9c8fcbd763
SHA512f651471856d45217b1d29ff9417ea628612d61f0e6a9d18e90451fa1d71c512e0bac66c156724a30055a9f8bb8044c4a85d4872df4387344cb67f5463be20597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1ff048400b7c86d97b9e182eceb9cab
SHA1d4ffb0ab6617807e394c5b03f16ac92d71d20046
SHA25608a5d5bfb96b3bb4c2631daa8f0396f57a9c8a460c6cea928a513717ffc4df6f
SHA512310273c6e5a029204f8de272149010f63c0beb712edfce532c023c81ea31bd9b0d2689ae366a46b89e3ff8aabb7309cc514740d2cfe00e70044c87caf0d36d9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D
Filesize404B
MD58b4c901dbc55c5b057df17c0b33fd5fb
SHA1800737c5a0fff545ba95399a04177b1d6be26a95
SHA25642d0bec53bc358635027610dd6dd1631ef0049265d77a040040e887ddf0961ae
SHA512281105913245ef877bd0f8e07c873fb99f3d5b91207b7bb9b5fea5b197cf2db8bfe1c4c0b6676588f6c00321e5780bdc4f4c34af973dce0c145c2081df3fadb1
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a