Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
3dcf9011a7d2b986713d769bdd0392c7_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3dcf9011a7d2b986713d769bdd0392c7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3dcf9011a7d2b986713d769bdd0392c7_JaffaCakes118.html
-
Size
34KB
-
MD5
3dcf9011a7d2b986713d769bdd0392c7
-
SHA1
295b358db4396e5a798e1bd88f64a17c3bfca017
-
SHA256
77a5f69dbba2c462bd0b87f329af805a79b12e3bf33d38098487ee0e6139cc78
-
SHA512
4d7b418226fdac8116e1ef56be2dcbae5d3dcdf7f298a6abe893a5d90510ed0eaf1292f5808dc5011618d3d6eaae6793d03a2253e40d3839e4c0b91f6e3941bd
-
SSDEEP
192:uwbrb5nFSnQjxn5Q/UnQienNn6nQOkEntk2nQTbnlnQOgucwqY7cwqY3cwqYQ/xF:TQ/36fx5/xhYVHgeynNj
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{608430B1-11A6-11EF-B837-5AD7C7D11D06} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000e03b2609766d1fd8670d69fa658bcace2f5b27d650290d63ea026b9c60717c8d000000000e80000000020000200000006d7feadde03f11745b207c94d54ad5c869388bf04b84b2205f455d95bb505ca9200000009ad418cf285549bda36b85c76af996a632407376da55a316d92cd58e930f3d5540000000fdfcefbf81b5ad93c4c43662949a119f4924345f8e31efdd6a3ac32461017e5ce4388b34ba7ce5c505e32614ecc5208b1c82022d9361efb70184ee17406a2460 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421821047" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000fb865f9056d49f017d88ee7b5d3392228607afa9b8db9770d9150a3802bd47b3000000000e800000000200002000000064299068a4e33b20b70dacd3b0231ffb75442cac97bde88c159fea3abaf6467390000000f827793244d028796d951b18fab206009598929f868cca629451ac4457cb92a8873fee987ac8ac4b2f150e8705fe5e3e9dac3877888fa77f9f8ce562ee14b64fb461ef22a40497b63b6963a60d5c56edcb2aabcdd434883da9146077fe18fe055839398b0081fc7cd760f94ef5b735154f195c80dbc2639fb89adcd008628b4fa4d5e41340a6a1002f364019aa2b8851400000003fb0299362a00fe90a2452308aeeaaa6e7bf574c63f65fba6cdcd1f8d024671243c101faf3ba5a2d8f60b9fdef9e298bccb68cd93aaf4fc2084f439f84b68aca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a83735b3a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2712 2440 iexplore.exe 28 PID 2440 wrote to memory of 2712 2440 iexplore.exe 28 PID 2440 wrote to memory of 2712 2440 iexplore.exe 28 PID 2440 wrote to memory of 2712 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dcf9011a7d2b986713d769bdd0392c7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5505094e0cfb6db7a290d1bf70084091c
SHA17d840fe1d66c7de2ccbcdaed7ad6e95769943e8d
SHA25604a09be2893c908a75ac5808b99a855eeec59c293833e87b48f6588aa56c1204
SHA512fd2fbb0c85bd1abbc27de532ba361c900a8e6a71975e73c090711d0861890e49ad00bf5b41889a63dd1fd980a4991b542f8495b69e85ad64eeb3077449fb9b82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58155d82e585608f3eb5517a19e5b9b11
SHA1d5a1de33631b4f2b9f84adaabc334b609f3b327a
SHA256a4e2892330d7b5eccbfebb0b5f4f44bb8e87e40d9df313cd374ae4ee3616b8a4
SHA512417ec04273fb47ca5d39234eb9b87253b0c91eed40cbbba3df12088af4b03138bc4be145ab2950bb0f9c72ed8555453d71a212858efbde87d9a9edc1f230235a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7be9e0c408952a07a2c2dd9bdafaf8d
SHA1227d8787f4eb8135946bed994ef98675e1d15a5e
SHA256f0728f1c7446069c1290466a79dcbd38726b57063536f458ff83ea347d2e2818
SHA512c6c5cb37226daa413bd607063bfd0e92ed0d73cb7d3b6927ed30ab5345bca1f680a57a6f45fdffed1787cdca75c885593524e61629c52e6b5ad067d085ebdc76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d5a8f4eaae149345af0767d8ad4ba48
SHA1501558a7189509b6b3fbbaa37768a03cad9cacb9
SHA25667de1006f6603321c68137f40f71869a648b93f11a754962054ff710eb4de83e
SHA512ec3fe7f5760bd90dea2b12e0bd97dfa5be4319dcffc4cf3594449f12ae49444985da1c2d83a1d4b672143d094ffc2e39e2ca2229000f8433d72675d02cbf58db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532c2e2f183b73952fb87bdbef7b825da
SHA1869ee7703d2662969a43de82310172be8d498fcc
SHA256df56cc8dd95ff71d32cb91005491c29661836c06b35fad69d9bba688073fdaa0
SHA5128b94b32a884cc7c76834b460ad5451d00d2b1804bd7f02e1b615541544a3e922c0c98de1bd0d167fd62047118890a03811b5c23c6a562d97c50cf8b128266843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502a5cfd84509c630ed008a22fd91b2f1
SHA1e7c2bf32e95ae8f3246cc1e3609da06a94caae58
SHA256fd4ec2fffa3534a044a5a28d89a21c6671ec66248f9c0cd06a63d1aa13f858ae
SHA512876eebfdd71c8fdec5b092e9b68bb0d10d2e90c0f9b60e0d3a17af5d20a29bb706358ee75c22d8c118fea15c9bd5a1cdede54637a66d030fff65d3951f29163e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9a507f9fc26e25373dcec341d3e3d0c
SHA10e9fcb806bdc88820525880bac619b8db1420d30
SHA25612c12214028dd21170f2177fa879f5adc164cafa75ba7fef7e63b0d3769c75a3
SHA51253cbd2caf3dc393a348ada06a163719a87d88ad70ef2e32fb6f066339bdf00c3eeb766b4d3816fc8ba4c47e78436995e18f2d8488dc7a4a150da763038579e76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5623c1c5502a8c9e7bc7f1bde7e319f70
SHA1f5166e4680a9390ae4d2ec287ad45dae94456d47
SHA25666605078c311521aaa7e61b96f29dd8343b12c83b3e63756ae079c1078230ed7
SHA51236620d16fdfd0c9a4ca4ee1faa6dd7b3670ee717400f4e8b92bd24db4bf408311c3c28145223a958be35a10b91b467dabed2c20ad3ae9b7c1b11451640002c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1c95dbeb595cd14bacd7a5a9fadcec4
SHA1e2a8bc360b9411746b582eb06257fc0ba41c0df8
SHA256ab89235bb5625ad0e6c27fa81ce0f0a642288bc035971bb7a53fc04684adb535
SHA512d974a17ca20ed00f9a4f799a89781d037fc702c497bde6c7d8a2c7f38f758fe169eed62ef52bf1dd6abec014d705f73cba0ac36d9b14b9ecb3883f23ef30356c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a