Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
5c427d17a9d2a4b607e1da3608f04573_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5c427d17a9d2a4b607e1da3608f04573_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5c427d17a9d2a4b607e1da3608f04573_JaffaCakes118.html
-
Size
480B
-
MD5
5c427d17a9d2a4b607e1da3608f04573
-
SHA1
98b7340733e1a550883905b12a18c74292de398c
-
SHA256
ee1552dbd796c705655f3ad4d19ed61e2dac5a190909af8ebca90eccccd210ca
-
SHA512
12a7a7bd0aa02aea5cb5b2bc1a786131d6de704d7b9fa35fb83b01d60ac2a7c8833cb46777221db69ee0bdd7c14bba07a7f3070433fe71a0a133810fd107b8b4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007586814caada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422326688" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD0FE711-163F-11EF-9001-CA5596DD87F4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc5b096408ffee47b2117b0cbc66f9ec00000000020000000000106600000001000020000000b5917dc6a99d105b62031923843cd62f6b38b0d73a3bc51ff4d1e81c81e9d191000000000e8000000002000020000000b3b380f58fd1923d5a184818095ad79a6b76f4c1bc7846e19bc81c5f4cdfbb6120000000b4f76549af698b69bd1a0c913d24aa8eeb8e7db475058afbb609d37feb5ad1da400000001947b862aae95757aaba5217f100da570e790695fe3c9163c755381e9928b5ef980833c49722f9e0c3bf3c05d27185f35e83462531c81e8b79d683254ac8e350 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cc5b096408ffee47b2117b0cbc66f9ec00000000020000000000106600000001000020000000c47c885ed4d0d1b8a0a90ac4a6b17c6a453bc2d05bd646ee838cbe7a31b1dd77000000000e8000000002000020000000a9277099a64c876272a48ba46dc290cdbe404b55c1c32940e3c08526a9d49eab90000000f2e8625fef1ca770ca9604d093e93ed3c0e55df54c8524ba11749776b1a3705f1aeb7c2808c295db8036bc80b15c8d90f8725f34de349e93bba2c199c12779b1f35d39487df3299469addb4b5a91d3dc217b1de3bc963d119a780d00716512adc81d4cc9bb7e2ec1e21c6a066e3a99c03351a77e2465dae9c3a18e355af3186b6f6bc3296f28bb4b7ab914ebee72111540000000f127d79989f243e278103e83c4a5c31f4999087f19cb7a1da14800046b9c1b5d729b7a64755ece91e27fffcfc136cf1cdfaee49945f940cd04d3e639aaf3a452 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3016 2908 iexplore.exe 28 PID 2908 wrote to memory of 3016 2908 iexplore.exe 28 PID 2908 wrote to memory of 3016 2908 iexplore.exe 28 PID 2908 wrote to memory of 3016 2908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c427d17a9d2a4b607e1da3608f04573_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD546642c8d56967083bb897456dc1a3aee
SHA1df13d389cf8d4f4c118dbaca77f644a233ba0bc8
SHA2561202cc0188e5dc95829e59c0d410f4c6915d7495481c5b817329df75e170a3de
SHA5127a0d98488a8c7436d95e98ba7c9f741d50dadd2bb3235a39eb9fa1539cadc67503e9b4b68b56290b4f7b6d9f96912ccabf4d1eca195ab1cd02f3d13292c7111a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5973d845d75b5896566559ae863316f03
SHA195d2cdb143335fe221ae35edfb6e36d7c2f9acce
SHA256b270a90dc870c2dcb407a1ef207ef6bf1519378fd95db9bb59510da0b3268209
SHA51299dc1596fc84c8215ccff94696c96f4eb81a35f30b63ff3943605dfa601854b6ab1cdaff53861edf756dda26afaac91e3ad8ca438e234a895c9f7f383887030b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f24d3768580b9e4dcf522f7fa84f3ba3
SHA13e63d7f0af6635f8788cbce3e02325f0f95a8cc0
SHA256e97a1dd5e551b1e8ae4a5ab26e263215fb84c610cba90ad5c377b85facb70ce1
SHA51215c1a87fd44056c1517063ea1fd45cb2d15e9a478399075737b3eda65f16a829f05cbc55127aa0bd54919a76efe302c49a42d6eb74b14b6a8104e40f0aa9d5dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD532396b14b077b2da61815bf867374c51
SHA1e99c4b69d8d8f052b58bfbed5122f181f392a1bb
SHA2568d0e421e6f515c6bfba564c04d66f1bd7cdef1b6a251b91db4bcfffffc428c9e
SHA5127aef054e473d5d8e232c04648a49215dc3f9a0450ec0138243e349f935732d386c969e59325e7bdf750487c3c04a256b55f1a4492ad9c44f1109e01c12857377
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD571a5c38ca79767ed7b47dbf40dfc2333
SHA1a199cc56b74cc708e9fb2e1e9255997e69aed923
SHA256afb055272bd829d6396682ca8c50cf0958dc32d3ef3085040340379142707c75
SHA5127f8d0458e0a4be19e8e2bc2abc16c7bfc19696161dda62a0d47c62df3c42ed5bc57633d5a867031674d077776ad157ed474ae6c805afc69a78593b2f7c746e45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5214d8f9426b2a97042e0a12de07ef796
SHA12f890f6a3567106cd97586f1cc889ad5fb799002
SHA256bccad29b46f04bd75dd1369b16b1cb28e2eb106a037891168887165bcf17e734
SHA512fc289a2f16e6f4df438e7c0010c753ab66f51ced68641f22ee65934742f99da963fed65f95afbf9760b55a230b3b9497f3aaa72530c769365ec0d04449eeb7d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55172d61074a5d576e752beeea4ae9336
SHA1f6fb86fa865e19c30852c5265c8b35c3aa8362d5
SHA2567898f00001e9b516ef8134162a1b9f041b5b98040d6895ab71179fe5e9294cf5
SHA512e03ada62cd459bca00a16c082ed95c84f83b7d5c0fc59f7bdf4984e340b729f4fde68e30fbdae220a579b1d42b1df771d01be9e90cd3a738a33620d4a715a230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5444e69501486b50fcb218060949791d5
SHA1827de595da708f90f3f259e371b08bd19bdf3719
SHA256f55ae3f719d5633de29ab15cc53481c2a6f3d564ffad5a0fc8820afa1bd03e2e
SHA5128df3eacc3bcea7c6440dd4235e594bcc4e2ed90932d7282c68b84cea01c1a187f07e21b0f2cf935d9ee8fc5ae1ba8d9ea03cb527e9208e61b8e1f9c2e8cd7a10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57310780b32c3c99663937681c199330d
SHA1ad83f561d63bdeb692ff591ee3bea6a0093dcb28
SHA2566f0fed106a27066016ea587512135b54f3c9a3f072a9abe385151c1ce5c90fd5
SHA512eb1b77286a3a093f77f3a02c10b471ad4b3e6910fa8abf6e311572f3e89b0093840f291772f365f385b32deb5db1f5d46b1d2df5a96f9dffbc460573d4e9e1c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51cde34f344101320d7e75eb93410bae5
SHA1056be4604169f4369a913957a8691270bd58d330
SHA256869eee446e27f6b171fb4432a749a94d5238d5042ecfd579c469b6985e1ca20d
SHA5120bb6795526de6280cf9ad2923b13de939fa2c1fd21a272d5fb0fad9ff77fd805a42fd5e8a3eb0a296855b871c6ca7791782738698d6a07616464c0fe048b4dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59eff566b60c2ee44f7341c5cc349f6ba
SHA161a8029a4c12bf9374324a3d6d5674dc20f4eff9
SHA2568eaf6f097b9ca6db1dc9c91bb282b44324d8155a58506066075c17edcb6900df
SHA512a0b3ec7b31bd6a738d280299086578f040024482f4745c367f62cbba5dfee55579a84a2bf52290f7eddcca1794dfacba4df7b52e96f181c22dadceae9daf7498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f4c34b1d927e0e5ec23afce414140407
SHA1632a698f93c2d062273cecc1d1c08f0049240fea
SHA2564cd41ca1d3f6a6200f0dce7b6c2d422e7c50f20f087c3dd5c0fe99296c3435ed
SHA5128d9fade9f4d7d3214e40fad21dd9cff3ae374b2be5b2f0107d30c6f7404888a3990e1ca3afc6a4620bf43dc8d801f7f20ee7e382377d5fa974a3d173d872c29b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5afea772e1948e8049632a4ed9e3a73e8
SHA194e652cf4536f4f1cbb227a6942cb961e4a7b823
SHA25670a32160b60bfb3e9e4e1fdc82cdb00c14dfaef21b418b98ecf1aaa0bc31cb2b
SHA5128d488bf034f7653c0b1b7d1d891b33f1fa61f0808fdd1b66c5ef610b7780234e74baa052f3ee4f3d0b5620231ffaac4d080151510a2de29050942f398d829b7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50b47b7f1a0549c6148c796143c6dd41a
SHA173d8bcf988a5160ef71f49c9e58222fcefe29688
SHA2569557bc782754a71caef8b17c012b54e7984348ace1b265e5f68a262530fc5e58
SHA5120a10bc6fd74901cb835dbe063674e02748d0418b45cbe068a8fca93c436b11860d2f3bfc7443d53f1e8aa89d8527816e14873beabf025aaaa5828e1cc19f9908
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD556344ac87f86be6be31ea5c8e9264654
SHA139c115063be9af85c99776df7f7cc9062f805e95
SHA2567a2823fc65fa92f98e1d834d73d01ee1718a73dcb549f7d3b329f11109f236d3
SHA51207f59d5cea939b4244878ee1d9603131e58f69d57cd4d283820e5a7a981705b67ea0a1235f2abe236d955ad0684de018857a341295a0c9a049b4af7235dbf499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e5ac78cf3a6e84ff6faa737d51a8100c
SHA1dca3f38f7a5b31ff7f6623f8bd5003c799f30142
SHA256eb2a753843e5cebbe3eb8895d23ae5d4cbdd074f035f6875f3c517020929c0e9
SHA5126774cece0a369a97767e412e3dad8b5352d5ae29612f7ffa6366b091f58d51d8df66c0d7a5412a8a232233b19ec588628769c652809cc2c6fbf51b83f39da09f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53a446b93b372e7f571746bc7378fa652
SHA1fc79e2c8976350c838061b01b0a83016b31ae3cf
SHA256ceb4737ad704e7830596ea94af6ceeb8ce64738d09be1479180fa3582044c087
SHA512abf1b12e1af1224ce2051cb6b751327fe220dc60ff7c8ecbb68c43da471b76f93c7900f161f3be26b12243892a9b42ad7e71d7c71536c85f7095bfb699880f4a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a