Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
4399e1cc987aa6b5f61986c96e7ecd1e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4399e1cc987aa6b5f61986c96e7ecd1e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4399e1cc987aa6b5f61986c96e7ecd1e_JaffaCakes118.html
-
Size
177KB
-
MD5
4399e1cc987aa6b5f61986c96e7ecd1e
-
SHA1
279232665627638d80ee84aa918cf5059671e481
-
SHA256
562cb9c282b81e47d008d579bb8d851e12d56fc1e9354512c5f3f2271830a3fb
-
SHA512
b66c3569aae6f659ea775507845ef855bdb5bdc6f8659e44ee17fbf7f0fa42ac8d588e25b066295027329959da1aee90c93f20f6c53538eb61cb0270cd37b3da
-
SSDEEP
3072:S4mPrka3QVy9ntBzUBNwbuevli54QHaTbpUzQK6fIQbPfQI564eI82pCHJcyfkMN:SVjka3QVy9ntBzUBNwbuevli54QHaTbk
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003f4d112eab533f07dea3a24954c05a901604d9bf79ba5d3803d2e0a50f368845000000000e8000000002000020000000a347e60844efcf46ffa1066e9a2622409633544b68a1174cab28fb8b44bf166c9000000036b5566354c1ef98aacc6db6544dbe7ef683cb6285fc88268f142982cb2d17d2029bc0b16fec5859244c5e4c0fdfc2371e184b608d24e78685e9e9befe7cfe3db96de82326a64a126e219bf9c8ae5c29987326551fa27d66806dd1a73348197d9156ff06d79afca9edb1888111c541728c080bf495c960f3f76c03455e8a084f78e3bd2ad2ae4d45e832b53b7af8ad33400000001d6fd9e9793de65d0bff16322a15ab0b3b28d3bb62492e753385770947dfa215d4c189a6d859c08da9f46143cfe353ae242ffe48a1be6354bc17a079d0d1a6e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000007fb97d49bb1f598ec5dfdfb0fe458d4491a8cc24cec7686c1da2e763df05842f000000000e80000000020000200000006bf5613a463404e21679d02a55d0f7f0402072dc59072752a3e53885e8b1c6e420000000284f04fcdf29f760d9409c8f700b4b68ce9b19dfe835fe3710f8b2f7a703408a400000004cc9e9ea98ba3d5cbe05fbc5bd0a37c8b45a4b0f2ca8f0a26aca749772653f3764a2aa3223ed6b0e766feac2114ac5d3c9f51b3e92544bfe0867419bfcf15b36 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421891885" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51A790F1-124B-11EF-9988-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b5392658a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1888 iexplore.exe 1888 iexplore.exe 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2496 1888 iexplore.exe 28 PID 1888 wrote to memory of 2496 1888 iexplore.exe 28 PID 1888 wrote to memory of 2496 1888 iexplore.exe 28 PID 1888 wrote to memory of 2496 1888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4399e1cc987aa6b5f61986c96e7ecd1e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5811d0133889a40f048671c1cacb7731c
SHA1486df5e915ba21f0d962809c60f55004870f860f
SHA25682140bc9c1f7cd23c25787ab8c48e221d7339d355e9c443b34bdbf74ede1adca
SHA5121b916c7691b264d11d2694ab3ded77883abc528e0b192684264154622530d00539e3025ec43a94b54eab3fc90eb8b783f979b73e87e87bbe5ca4f00fe6b40c45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5805dead0e14cc034710dd30cc745c6f0
SHA1bf9707d80b045bf3aba2e66b380d23d068a62944
SHA256695a507e0b0e9dbd7db92f67b3b7e57228d42fd425e580a1de2af1806f9ea907
SHA512cdd16ccf14dcb9624d5787f5d54e71b28aa3978812ed565eaed47319c752bded2cb4e0c991b2586f94d87a397f350af3f7a2375f1aa02fe6d8574f1ce30dce0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5288f8bacb532d29757110857129b6411
SHA1c1aab73ca0f5b68ac025afd37e86ad24e0faecc8
SHA2562447e9adc7dbf98256762adf226435795f5dd553808940d22ca17fd3b4fa7e33
SHA512fdd6fffc92d8892019e49e211426bd19c6dbc6be6318d58005a16b42beb0706ae80a215877bdff0aa4f829d979eb0a80e841e6b4d5d61aca9f2807a3194eb9d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5021465cfdaa087e751385ea228b684d7
SHA18f640a2fc8d67f9a6382f58ba4ba43e8f6fb5adc
SHA2562593dd0157eff1be434c5d63db9cd43e9c3902a037503baeeb01142b0685750e
SHA512c34687adddd1c76ca8d9d079cf0dd219805f5ce63870d6ef26cf5e479f8cf56977b00985199a9993a37fccacc0b39c44361429b2254fdb4806a40d7fc4621b21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57699b873db8ad826a265eac4463fa760
SHA1dc9916890120baaaff0227505265c114a63fed3f
SHA2565fd5630f5332018d0d5cbb1a5102d97232b5ec927f033ecc2f6fd040d2d1681d
SHA51266574a22ab33d7c13b16c9b69dc7fe262d8e3fccc3a637f3ac291574b1507bc878463851abb6a532308a68c506b66d6cab1a01d1c059946a4cfc099d253a0b8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f572d3f6aeadaca3be8132ce1408fc10
SHA101cae28cedf0f7a90dafadb9f2950d4c135cf23d
SHA256a5a322daf571e9a274124d07e9f371f576a4f2271318e5f37ac0a56a73ee5a95
SHA51245c3964bb79c9f06d891fa01b81fb85d0d31731b2ca5d6dbb794d1fa6d498c9bf3867ccd54814405e42ddf1ca0918530bcb2ef8cbccc6d6360a8886de2722fcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cce8785e7e6ce7d23296c58c7476f5a
SHA193ba0fb82f4764b30c08cc2b18c444ea448dee25
SHA256cb5b05ec40c13d00e69b3112caf0d9f4f613f6a297a292ed9bcd805f62025c74
SHA5127e5d23bd1559374882f2d68464caebe503b80926aa6bcdcefbef5f0f0ba4dcc60cef71566668b7b7a8609992f3205a5d9b0c4ead78b07e5883750f4e23207c95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bf3bff1adc8afe02473884fef54cba9
SHA16b30553106dd4cb0912c3166f7bf9bfbec84f1ec
SHA256679ea62601ea1fa710d7a3c4e1a8a28bc704f09a0d6e0e0c34647c78a3d2b86d
SHA51271757f098bc9310c5669cc6c66fa3c7e3b9da0bb35df578e2e57cab14ed5fd9639546657fe95194ea47ed6ce3a2bdbcc8c5fee22443b4344c03b55744762868a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3e9148627a3656a53ce5d1adfa5ae6b
SHA179979b98b8b0cfa2a00fe78f516b9f535286f9fe
SHA25666d42fc133f018c4867f7e4281b208391ccbfe14d6d8758ab4df81b141e94768
SHA51260730bf3a53f0d03ab1fa755620271fad1258535df9e58cbaa3f39e1c6992857083ac96ddccd905acc8170b53eecf6fb7799aaf86e1de5af80269a6986ac9f2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b6e1339d33a7a66d87ef5c720ee7eaf
SHA1b8c2b87a27811714c53d4d617243f0e485f6bc33
SHA25667a6fed63bf60a28913daa76b4107a2e7248020c1b7b4109c31e5ce5fbc24c2a
SHA512b899e7127b99f8af2d375d3e4502b36b0bd1606f0a261dd913ca267c87aa3b1da4db508dfce5581b6eb9d799e5984632ea69086ecf9c74ae23794ab3f1c842c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f743ab5f65753b2520a0d77e37ba112d
SHA148784eb10cf4b1db2d30958e3aa3522599312e49
SHA2560354e4c7cb5beaf1fbe27e4a0a80e993691e3a4ef860e5b976598d7ab3986a7c
SHA5121167713407163b9e21bf9a07c250a9f71c2a56ef0c8b5bdb7e34d37918d026e0583e8c0cab0d9a980874b344ba2e77f1062a905ce61c5a915d38b7de92cee9c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cda5c2ce371479e6ab3e7ce98f7f436
SHA1a977f04581d8478ca97ff50856d62662ad6b724b
SHA2561229ba590a3955a164df3e2c0a687cc03d4edee9e6f4bae8f6570afae5c74414
SHA5122e3d848664f5f5eb808c061493dafdaf4cc3c9876671753d7e11ee772aee450640089219409716d6fabdd86208209a3b6089fd84fc3125926b1d0c2076333cca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5558db25926640d3fd63f6387a844e544
SHA174e5f93278e2ad7b0793c205c431b51ed37e2e97
SHA256569a20d33ba000b7db3daed84c75c6c862b7aaf78022f11fdba335fb7a2e6053
SHA5122ca5b4807d35cb2ccf5fba259559322335c234570755353756f3f859e8ff31a1a9be5d1b9c0953532eaf6f445ddbaa4d2f9b4d5fc4f98918caab048fbabaa34f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a