Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
43fc7f91e33d040dfc34c345599b0c82_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
43fc7f91e33d040dfc34c345599b0c82_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
43fc7f91e33d040dfc34c345599b0c82_JaffaCakes118.html
-
Size
460KB
-
MD5
43fc7f91e33d040dfc34c345599b0c82
-
SHA1
a17f602a7d1449680fe2a8fa7630804ae1e82edf
-
SHA256
5ee46164c6be7183722121f3be876ca52a6e066fc435f7b55fa6425d69ebc314
-
SHA512
ed7dc0b89a82c764faf13fc7add0e99b3d0e29b4eb53d618c4a69816c9fa80237aeedb90f2c54496dbf70d920b58b7ffb3868b27516bc7a81355705a14a6ae71
-
SSDEEP
6144:SDsMYod+X3oI+YRsMYod+X3oI+Y6sMYod+X3oI+YLsMYod+X3oI+YQ:Y5d+X3P5d+X3i5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001ee1202829ffb8174fbd6bcc04e4c1ef8b31f8d4db6648c004bf17f31bb26fe0000000000e80000000020000200000001c50a3b4a7fe9e7782424ac4ce9b2b9af9a9f5d742e9f7b6517efd17a1236ee190000000c6442e3f8a3d95a1990b582d40d1d2130d8b668986fc8a82ebf115957758bc3633fda6679987737b2159ae2ce22689d784e7137c1e6d005befd5092e86072b41a11a0f7fadf4fb3dc4806985cbe0bf776ca91cb471e79f5440f8697a4be30c7ba45a26c8d301dfb947c16029a50566dec97a7183ba2ad78306d8b21cc2c79571fdabc5ce8b0202db16b6ed58eb08936e40000000169bbcafbe3cedf0179c5145848828bd1b821cd9925fa4f6bb63b78fb5e9f5b81247de4495f8079cf349f2c8b22f5d0554c59751b702a2c23a5b37c3f2f7e655 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f2d7c467a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC55EED1-125A-11EF-8AAC-6EAD7206CC74} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421898587" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000000c7a2fde6f28ba7c43d7a3035fb2b1a392b8a63e129f276c4afb6c7cc08e701a000000000e80000000020000200000005d4840cc5cbb12c380133ddcac94e06dd4d20b7c07ba31d015d09307048f577220000000d96e095cc5b932ab7d08c248d29dfe8dc537fe7e7fee9910755a966f95fb2a5f40000000e6f7954891ddb80a235d8b2e82d1bf93a7be716f4f09bd999b3975a4d46f9149488efe1e81a6b06d38bd58a9039b4f05341a5b080464946ad1310acf14b2aec1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2848 iexplore.exe 2848 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2736 2848 iexplore.exe 28 PID 2848 wrote to memory of 2736 2848 iexplore.exe 28 PID 2848 wrote to memory of 2736 2848 iexplore.exe 28 PID 2848 wrote to memory of 2736 2848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43fc7f91e33d040dfc34c345599b0c82_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eee3a0000e4e0548af9031ceb26995f9
SHA19a595df01d6f5b1a6856df748e87d9d45829581e
SHA256f46337988c9a398ed64dc8f9ec00a70663aa2d7320d3a89f1da71836c67cdd4c
SHA5128f4024ba14a165eabcf1af92b656a62d6ed96e74298b79bfe4f3183b81d3a830eab1d9eac252b852151392ad924891be68c9a8d9d8a27847c7eb20b07d5fb11c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564d1ba1c73921713be59101e0f72167f
SHA1a1473823df6a4661318a54abbd66b31f0c076e23
SHA25676210396cec7f3980624f65592d6c1a20bdef4b6c382ccd98a6aa6baec180c96
SHA512928337198967f07a226e497b78094306408150e31cbf41b4ff4c32746fbf446469ef2fee190b0ec896dcaa3c2941abe41ff3463ed1d3cf8a4edaa3f46141fa7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef093c9be631148a12fbee3adc173aab
SHA1eb873369999670554b05093850833cdfbb3311ce
SHA2560fd981ec3e8fc192751c37dccd409ca5d96eb52438af054e635fe5a161ee9246
SHA51269c0a0d30870011e8b11a322d29b3278d92fd948c2020059090b17caba4e3ed09998a5ab52cad34532be3bf082f93d4b3c71c6a0b9802e29acdc7f67cd1bcb44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a9779d1f27451aba64f6418aae29150
SHA1387825fafe4a0b35b1d39291515c7601eaa6c1fa
SHA256a0cf6f691346757a650cdcaf87d3e7f9040c15093b0038af2161cc7be57fc268
SHA512721c8123f3525c61e347906226b893dd3765de9017e7ec6f86be9babbbedcbf5f86e85d68bda9fe9e4f1043e0e499fa4a9e8bc365cf705b0e58e2522d3c844ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f094f8a9623f8a78fd5cff6d0433f10c
SHA12541320ca575220b061821febd0e798baacb3d90
SHA2567cf32e751b5f9c2c2e7f0240ba2492df9efaa331e53845742d3db4a561e343e1
SHA512c9afc05eda649532684670ae63677b1c99dd302567d7c3b949522aed9e82168f5993caa25ac74365055c37f4c8265f811c9f7364af38946c603895ad18d6c083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ad31b5ae1649990e8bf41c686f7c6c4
SHA19655a9f42c6a8b10443b0464bf44a8c12bfc6849
SHA2567fa328d854cd43465b07fa0f401cff77c3a957cee1231b9437e53175e6fefa91
SHA5120350b6e34e80e09320521b4d67fd368e54d761a0c761a4446243a58008052250d3051e0e639879e16ec8fb13709561f9c483dee1cfd1c633eebbfc9d5e51e7d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b637abc602a59bb91ed5a943fb247667
SHA1e85225333d940d549535333a3f3552ab92be5155
SHA2569db848072b8cdf31599c2d9b94377167befc5bff3f54da3d11529fa6610807bf
SHA51250cb54d9c3d280bcfde4ea0ce742127e4d14beb457c970ea8da8e316731587613e9871583753c558616bcca81f0e8da2a919125a7f368446f2de4d8316caae29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd57cd07a770e1232ad39f52e3bb695c
SHA1115ed7287ea59545c3aefdb68565dcf8e88a6570
SHA2566f8be75b6d40a3752bbabb7b62a25f51c27d9fce15820a68c828446dda4d670d
SHA512abc809c41145e43d58e2b8850a8a0dd1923ca688078063ebe69b99a0a1e27f2e1057992bdbecac34f3763e8e1622f231811704a3bdf7e2ad7cae5d197efaf9b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afe86abc3c8aeaf073ab624066705735
SHA169072e0a1906ebaa543bf5b0f62aa2bbd2862c78
SHA2564118fc058023f185728d1ebef13b5c7394f1ba908cb15530bea647d158fe114a
SHA512172431ede6337065023467343cda8bd774fe8af13d66e1a18af4923476c4c87f44e9d43f9e1d740f3287719d30bba4949baec24ad8c0cf06abff88c405964ff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52daaaaa13a043eeacb733cb92c6567c9
SHA1d5d85e1428aed5ff823acafe7edcf28afb54cc76
SHA256ed348554f80a931338ee495be30059f70547f0cc3790ce4b59d4f30172b19900
SHA512d3fc1c2df2da5772b2cca4d5d62fea1699321c394f96a772ff0a46ee496eadae7049bbec01d48b74dd5eb4948206d1da7223865cb6c80e7fd8e4147f4b9f1589
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541dd5a36c1e717ae5caf0d2a5923c9fe
SHA1d9f64b17b83994711c3492f9cf93f1dea9a03451
SHA2560459199daf8ac508922af73045417363bb4ae386b7307b5b81bcaf41d933a813
SHA512e81dbc4f2f4d52302035874965d4df3f098da0d6789739beb25d02e67afa42ea117d173297b7f69688e75c39ad7d9db5bb51fcdf1466f002ab028e59219ca14a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3bc8c727bfa8fc3f34a67b0ea55b255
SHA16b6ee7c4d1c179132fac2a1e930fb17a46e60b0f
SHA256c1246c5da1cb4fd94ea790814e170b391c73ab37080ce09ee43ea82009110e3c
SHA512702f5f92e39060085871a838faeae2b0a3b4e22fffe0a5a0a0a73fa308a8b5246d336d2df793fd04214d4e89475e2bcd388df5ac25e159da6c959f22c2bd1c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59de6df139ec072e7140f576df074c189
SHA1c6314d56014424ef8a3eaa669f169ac7b2ff9d02
SHA25657df5a644665e412c685b28c8520072e6290cd975a89dc6ee3d8f2cafc244dd0
SHA512c99155fd5f69b34060686cee43423d682062a25c4393d81baac40b217189e58bcad82b8ecc020e02ebdef36e5d567d9b2c3253193456a8ca431226c3dbab11c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cf88abb8a04eb9f492ff05fb79732e5
SHA1d08e621e891246e6b80e3a7bbe80a72290a70bef
SHA256e999cd90af22ef8fb17c2c512b8be0020a58045f67925731c21a2b076d241f35
SHA5121280108bc53bef1e9a4de2d0a5496e8a49ccf82f2ccb5a6ed76f84664753deef272744ca56a897473e2f035e63f1e3fd3c47e0845b946f210780331938091cdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c5b09a28f7e811f646ff1cdd7a1b612
SHA19dfb99af5e9592946b5fd7a78901d3f653387eda
SHA25633b801e20d7e77e20a15dad1ed0f3a9fdafcb12aa2d7cfa2603fb0fe5db8c378
SHA512cfbdd95ce2a35f3b5f5867fd371b5599b7dd0bb5fecafa8d170714f51dffe650ec901406956c49e3e6cabb32eea9f750c7996428e0280b12740a6f7bedbccbd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562357c0c5378882bad94baa91555c0e0
SHA149726e0a8f74c5c1cb2e7b4dab9a5f443fcc426b
SHA2569180b34b16e662140aa3499f846bedeac69b906c08bc078c5450c59f5f198e23
SHA5127d197eb92ae41509badac91c78aadcb1a3feed2f5aece64a0b327c1bb08af9700ca01ad1a896746037f00bfaa428a605aa31f0cf398b3d763a4fa61ec291e6ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5535694638f378091fd83d3b24a41fef7
SHA1abc1b533df03728b05e6078d6a5e032895254e7c
SHA2569f4df9225a9e8aeb93499fe11c4719355ef4b6b0b6d75523d8f6d1f30fa26b38
SHA512d325aeeec1cde3755cbfca369ab8da92e517077eccbe42e4a10440d917c41199870c7d64ad7c0abbab5b3ac62cdbc99bb2b26218de2a49005df4cdb6f70b1497
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a