Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
4dde1b67635f0e15efb8693ddc5a95f2_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4dde1b67635f0e15efb8693ddc5a95f2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4dde1b67635f0e15efb8693ddc5a95f2_JaffaCakes118.html
-
Size
68KB
-
MD5
4dde1b67635f0e15efb8693ddc5a95f2
-
SHA1
94e0d105fc603c050dd01f9b00c8380dc9dc691d
-
SHA256
8d7f34711eab380175e4548b96011a1d36c7426fdce246d1759d37477274e883
-
SHA512
6c614d1c6df4c87daed66e31be0e0faf04fb2aa6ecbaeba4ed8ffcf5eebca8d8f5fbc8c3a231e475507926801fce734e2d9a7f6f27b6efa4b571ef982680cb48
-
SSDEEP
768:JiEgcMiR3sI2PDDnX0g6RFB2Te071oTyv1wCZkofyMdtbBnfBgN8/lboi2hcpQFf:Jwiwa07yTcNeD0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f824a110c026554993f8bc81beec0c7100000000020000000000106600000001000020000000bcc905b5d2b52ead254cd98ee58e85ab8055c4befde19060e5dfb9efa7768770000000000e8000000002000020000000d63e07265a4e99fa54891770936ac7074116ad28e1cfc27480543862ae8382712000000017601afc48170db10e13e9428fc737fd452299bdfde64714ad5b796eab50b75240000000a6a1b284b472a0bc30661babfc2611eadae78387e987e76ba46d0e6aa493b0208006d6f5ed514e7de73717a8ca75a68084230e9d1b16f4f9bc8a14db02232903 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50003e47f6a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72A15C61-13E9-11EF-B411-768C8F534424} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f824a110c026554993f8bc81beec0c7100000000020000000000106600000001000020000000123d98ffa579237e7b01cee7077ca57be30ed2bbda539da5d30213f04f0fd6f1000000000e800000000200002000000053a65f76196a3251bcf1e881657ec84b9b02b176c51385878e8b679ac13ea26d90000000e1f8c269ed8657d7f5d0c851d4e147615c6ce874cd463ad66fb4f6598ab6a828f456929ee7760711c174762c3c0db9cd4cec4c139b96a64fa88fb71fce85fa0e476e265fed2e2afbe5858366c1c5c2789879aeebc6040d75d01ce3762bd01248b6efec75e80a7403bca38e22558fd45e64799b751fc53f9591593ab47f826288b91c883d4a9fb1b9150a9a9c164b6b5640000000be09657c453c90f20ab1334556f19c2c979acfdbe9b20610306c2a803682d5eba07f0768e83cab093f2073fa8f7071bfee730525151b511043b34f847f3b8fae iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422069751" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3000 iexplore.exe 3000 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2640 3000 iexplore.exe 28 PID 3000 wrote to memory of 2640 3000 iexplore.exe 28 PID 3000 wrote to memory of 2640 3000 iexplore.exe 28 PID 3000 wrote to memory of 2640 3000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4dde1b67635f0e15efb8693ddc5a95f2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c19eaab8aa0f8e817567f1ba9ea55820
SHA19be78cfc4e199e4c9e32c8269ff6a422780a0524
SHA25656311fc04f5c493b36608483a81ab7b3bd9f0f44a342b2f74cb8028616893a0e
SHA512b314912e1fd96e32cccd7cde2cea7c91c9b00e7cf92f7f8da35679b09ef8607bfdbbec2b5af4f3ef9b6489fa0a2896e2df3051947a2b5f603ddd34e3fc9d1044
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c84f9323af917e398805f0ff3de8827
SHA106ac5f2a063aa2800e8175c6fa9b85aa96138994
SHA256558138bc17b9dbbdaaf6bfba13be3f962c535638866354fae913ca6e8e391150
SHA5122a7fa07024c3b616fa701c33821d1dd13c6d25b608debf66917bba66081f498ac90b3b342aa941991c35ecee4c867455a463f3f100e290c0397bdb5001cf6c66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566aa3bc4ace97d0c6838824e00a67bf3
SHA151d45221fc090fadfb2ee105e09e3dc799ac5ee6
SHA256501598a58bf6f89c5d6f8e8ad29916af473b11547afaca6bd7f255a52735fabb
SHA5123401f3645fb973ec78ebbd03496f0f570daf3b385e561e073b79763ff2a8d4e384f5400b9130f32bc94c492e7917ff34dbda0265561a60bb815daff8139ee8b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f2f33ccfa15d1dfa48da4ccf1b5d230
SHA18fcda0a7b47c0c52c30e773920504cb50d19afa8
SHA25607f9100819f5ef0d594843d42c8a75debca8443eb7b69ad7f207dfd91a6d213b
SHA512cae01642a7167e27162e0abb307aa76c862c2d38c39a92d60d63edd1672d2d12764ffe68de1b0af489a0aad45ecf0727e71ba4d467f527715d5c8f6b5ec70765
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aafc6e0281e4b4ca8a8d3f70cd1faeac
SHA1a20ebdd92fb8cbc244423e47d80dd413cf65f12e
SHA256a909e9ed7ae2a09ec5e29dee4bbbda46c613e1b25fbe32c722a92a69b6e09a58
SHA512818d2ebdea2d1933a76d4386f40581dbe08e044afa5a19c266a897116b11a1f353121f99895ed9d0cbe9769fc5655580e7faa14cc270dc57d789a9de4a466dba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56888a0000cdb4b20251e4c36a1057e65
SHA1340273452926b2cabc2e648c176a8acd1d01cea8
SHA25620fa530ae15eabe9fd91630c46b5c1560c8e33b4d155f95cf24e794cc95919e0
SHA512198c64f603bd1e421df62b1d6f2ab77bcc68e11c8619811cee2661a38e62abfc9596feff94cbd8c44b8e17bc2db8320b1ba37e3d0a0ec7019141444b0a74d532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506e247c7cd9ed3cf6328af88c45c7b4e
SHA11792c7847da0eaca2a0d54affc1eed0053dffd75
SHA2565b002fbd22f6592dd152bbc520fc6b2e1f3ae41de8608229fd4ebb8ae974f264
SHA512093abf17538991b8c275ede38da4278d8b83f60399634f2b072663c23948fb7b64a59121184f4ec7a90ac8c58e9ec1835408b98dd23daf25b92040301ae28a4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561e00448d3b0219573301f423be1ae6a
SHA164ca6cbfcaca1797d78225c5603a4a82f1ace70a
SHA25665562adea80fa971176637b779b39ba90ac71f7a9f26567261df344732e17310
SHA512b5dd8f49645bf1bfc65952c12b2ecbb4811509561fca8ee062a4173994ef0dc1aa32c6acd9ea135a1b35332533ed73eebf2f8bcecfe77fbfbd4ad7f56352460f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c27bad8d49af202c8dc36f12c3531ab
SHA1a168e3738123f2f176d35e5495a2f04772ef000b
SHA256fa11095972c25b53f5969fb0d4de703339436c46f9a29116b0088cea3f6c8308
SHA5125f0871009a341072f36bfb5a6b8596f0b9d24e92ae2498be3713474f98cb34a9bba58f5609a8bbf0af37ab8c10c60876f2d1dd27a63d3fa4d8872a93e853e63b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5064683b11ff7388c7c5d0c1d7e7e00c7
SHA16000af8870f0b5b15d5c5b0601f1cfafc29fd124
SHA2561f8564b4fc3b64666d10f91a7ad838a2be1ce2c078753cc6345239dbb7eb28fe
SHA512ba3189b3f5e37b5fced955d71e4de63b19342a9d9de82c44265794dcd775aeb9cdf01f10247ecd10558b4597db96dfc8123076006b69adf01b9cb9f50b9ef4ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d00729cfb8601201ed1fdb95e8804e0
SHA112fd823dba1f606bf32825334ac71863a0e83835
SHA256e147979b1e1006c9c2e2f7d923ad93d23ca389b4b4174eb2d79f39abba87ce13
SHA512371d0d7c3fca4326cf91e9c48ed0771fceb7de321639f3d4792bc9f7bba1063f36e32d378a95317e41a10414db7f2df895e8444bf8484d6632f469d3e3db2258
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5735b24925f92edb65be2218302b4672e
SHA1ea4f7872ee3f137368101df4784737168428307d
SHA256364af49423942d323268e94da8223f96421471eb1d775ceb6268ae08c659362e
SHA51240e182911e714ec74572252c70c5a3ea850acc5fcfd890d4ede8903390a1e4a9d13e7fbdc935bd6fc462af9f0da1e15310388e06d24294944cd3cb505fc995e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ac1e65bd7a74c4e4d689460614bb7ad
SHA10f579663fe972b5bdfd31b2d70528363a25f95dd
SHA256c5de93cceec5996269356f1ede0992f86824a7472d010a71cd63b1bb14b9032f
SHA5122762d72d71d3171e98e06af103748cca7ccc15d1d4978d750f9b285dab205f476e649293948b6a1278f1864e9f59a3b122b5f9a960d9b5a986226afa0666b892
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a124986528602d781632dfdd05d17eaf
SHA177927773cda53db042bb7d1a854a09a11addff22
SHA256c9b4c2ff01a74bf945544d0776b7264df4b70ee29601f2fe96ce6938814fe772
SHA5120d09e34a9425256b42a482ff84f2057fc6ab9a90d0e4811c0fc3790e9f86aec9b3b6f87e42cad536ad99fd6bbb3bdfef13c355b1aa6becc5a282f0c6d56f6124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ac409101dd92b7a4354a1113984e969
SHA12a1ef8558edcd0dd68b57c34c2b810656c11b7b1
SHA256cc0a48e9ef2cc25571b07a8fce0a3c87086ff8673574f63794778c4b57fd080b
SHA5125c48207543218ab5a73bb99d1bde72ae1bf5044673062ec7fd4eb12c34c53d3ca798561db60a00d7be01dba8ba4865cb6e7d921c8bc940b3d2cc4161d8abb48c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535b9771ad0d88513c58138b83fe70b31
SHA1b3d0554dc854eef63f183b7f36586d5d5fc5c53a
SHA256ddfd803649e6bfe688ff0ff64e088d09d7dc9da19078766ad9f448a2facf3dc8
SHA512c6e0b631a69b4bf27c73d3b5395e246f7909e3b82a122e68d0337cee8a0ecbccd4a8d3c40a5d37c2f8e474fd7482023fdefb0121f4745bbe6033e678090cbe21
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a