Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 05:47
Static task
static1
Behavioral task
behavioral1
Sample
5d7a0529c81bcea535f535a0a0b0d22d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5d7a0529c81bcea535f535a0a0b0d22d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5d7a0529c81bcea535f535a0a0b0d22d_JaffaCakes118.html
-
Size
95KB
-
MD5
5d7a0529c81bcea535f535a0a0b0d22d
-
SHA1
391fa992bf03eb6efd180375df1e66e9cb8954f7
-
SHA256
6afd1451e930071646d87eb30bd9de3a7af66c118bdf21faaf35b22e86959b3c
-
SHA512
48b35833d54d0f49398baa15154b7e6e73149411af59d66830271779bea43d14d3c6251c33e224f72b554d215b368d93193f47ebc0de6dda754abaa216a79aea
-
SSDEEP
1536:O+DrHFj/l3FM92G+eQlMbp17jqEFLAeGQx4:OuZ/l29PQ+bpPFLAeG64
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01fec3679aada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422345891" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000770405438000d1b419c4b711df700cb8e5e0707f1a4601b8448c72c95de8e97a000000000e8000000002000020000000044ead038785c86dce425ece60b5a97d11e74a8d7ac2d2bc1e91a3045a70950120000000c31c164149e7120f85ffd2108ab7d821c1f28d0d16287df9b1caf6883f539dfe40000000d64b57f51e2ee2eae4049c0189690542928125ed279b3f6fa93eee710783f9b274eb11751c0b8817f936aa1aef6ca0f310e3bcfe5e87bb7bdd17fabe6a640643 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{624D8FC1-166C-11EF-922B-6E6327E9C5D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000002d6ba34678e4126a02c160f95a6e46b38e4c5e40bef49944f7dc9c537d0ca376000000000e8000000002000020000000204a061b805234810d1a6d4d0953475203b6ed7626a874568d99a33724338c5e90000000444e2f0c307fd17f2531ff581899d3ea1f5fe2ba1f691410af433e35855ab6148aa9281f97cf7874ad30df7e8a1a4f42d70c817394b041e40f2c6f7d74c30e5308cfd4ddcb7f6201e283624f2be448b2f3bc8ea6bf04cf56c14ec31b26d2b168d7aa9733cea4d0f0e6feea68c26770d465d179bd36e16d9e3e10c0fe9ce0d4025e73d02dcc67bc57af4a122e1ddb05db4000000004be4ac3b1b3ca5e6e7798e57280c0b855bc6ee770bbb153bd6f378d237d3a9486c1e741bbe21bcacbd689e6b9d5c4f241c715ceec2ec79061fa139c6ebaf67d iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2272 2220 iexplore.exe 28 PID 2220 wrote to memory of 2272 2220 iexplore.exe 28 PID 2220 wrote to memory of 2272 2220 iexplore.exe 28 PID 2220 wrote to memory of 2272 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d7a0529c81bcea535f535a0a0b0d22d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5260023dc7ccdcc198fe280e296f8fbe7
SHA107a754b40ea726be1242f01c980ea5666e648bb6
SHA2561b20850cb9d034f8ee866ea043a1513ff0a2c0491e113a7ced541897a6e01be3
SHA512c0db86c28c275cad9e3d2418de92962ac6c231d128b0a79d6ab88a6bfe2a78abc64b5f302a049644992b23b4663fb951e4a8ff2abdd7d838d8524fd40bfdc386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7e7f27078fa90ed2d282088054f40a4
SHA1b6f8d0fb3462e24caa42b8e50c2d648caf05802f
SHA2568a301b4f3a2c1222df1505d10bd7c5cdb9882f431c18e2260d937b978e6afbe5
SHA5125c7a7f7a4039a79f447ebcfb41cf0091e81946136a01f37f5b12ae9671e86a14885faf567642a3feebbed642f4c0e84cf4f2dc78b91040b78a0f800ba25bfe77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53612893c9b64d27e97bf4ebc3fb15565
SHA133a75b9209ea3d75fb49ff44fd1273ebe6ec8eca
SHA256d10366ab0333cb73a169ba2dd5950f1245b481a54a27b06cb7529bae3b585a01
SHA512cf38fc42db44aa73ae9a038355a315cb79480aae466f0e147b9b13532f142e6ac149f1d72dc50c6b3bdfeb2649bc6cded149146e9dff0aff3bcb632b98792777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c0f4035942024a5dd03d98b2c162aec
SHA124524c37fbdc50c84462d3b5f1dfd500920ae5e0
SHA256ff45cad8ac233b5ff42b750166abab7c87cb16a1246225a8372afbce832b397d
SHA512b2a56689bd610ab7430fccfe11a9c6f4024172c1e929e924d92e8041c1c9dfb9cfd768305115a4955c18a29ea4dacfe902b6bf7a08a36665bc72985306fa4cdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52390e5e89e8f7f2559064ce68c648897
SHA1100356c7c11cd1a4d63849ab3ce3e95b7c3ccc2c
SHA25669f44524e6689ac1f1a3eb7bf35ea98b041a01b178fa8e729b81c791d81c0f59
SHA5121f3849d54a3ab073e4f03abb55622b63761c890cc91acbfc0363cfee7d7f10036a6f2e6a37eb0d66d5a06e977e8c39c1f68862baf4ee8197c1617c8fe566eb2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e79c0947a9d4590fe09146b49816f40
SHA12cdb7dd5108e7c682b11b491735596a474fea2ff
SHA25613ce820ff15381c62612c2b163dea71f47de56ed96fc229aeef3d6ba36429431
SHA5128442f850cf0f3b87c1729a40c35f6f3f3bb15a426d6519df9f34701bfa8a28b56f722c3021476e89804fde0a6779cbfce17f5bf2de4aaf62dd6bc97668387e03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe04e9c7af9099b461c57b82a8ad29c4
SHA146ad8fb7b517e39ce3efaef9c68c2ffd3e7782a0
SHA2569c2d3619aa09daf339811fa6b756501fe704ffde9534d8b246f7c1719c190800
SHA512f5a84166cfc4843eeaaa93ca36d5145eaf72289b1828b45ca5623ba0c6c335d23108165d06068f43fe5438bd4d0ae8c33b3c36da8e02121836191dae126e1400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7439fcd43895dfc50eaa6cbc79845a4
SHA1807864b6f3e9cc1ca0fb054287831c3916a1be4d
SHA256147c6d1a2b40d94600967d5a53b7220e286a718d4d774829df8fe047f3fc270d
SHA512b65422582718527bd61422b0c060e984b63021cf951db102c79b8d5a34221bd63d2d7199a95dd3ee83828f30defe11fa7a394239f47113920f079a770863c350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bfb89d17d92bd21c9d704f038ae68a3
SHA1ddf00638a935a0c67b191c76b52e09363afb1af6
SHA2561b707f621e6225c7481789364bb940a8dc449f2bfcbcb470a8a5bb3727ebfe04
SHA5124ba58335962da651df2d4b23438017ba5158785677e14eee1dadfa03e374e16dcd095caff1d21b3641083853b988fef28a666b3041d8cce89a8f3762242dcdf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d429742db26c193e04240bc63b5bd45a
SHA17e37d94cb9709ceaebf17721826632d903289898
SHA2562806ecc0a13c7981a820ee1a170008c7b94281858ba684a02d548dc39cc14b88
SHA5125eb48b0daae17337b13f5a8fc189acf11007966fb9659bb623c59b172c8a69c2e5885c59fe9fd8cab5c2784701a9e7e5be0e5ebcc223451bc59cbcdc4efad2f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559bdd7dc7fd2a4adcd8d68a4f38052aa
SHA1b324600dee7b472aad70261c754db8a32c7ef0bb
SHA25699d02653647aeb3928fd99c94c3bb923fffbcd73e1725170fdc99c71f938efa9
SHA5120dc5964c7f08a01b3c1d8d73092187c98d89f9a392974fb2e39ff8325a08979a0421f493184f59253d67c5c97499542879768fcf07e0bc1de7e71c68323c3ded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a27344b789adf30b40327198e0478cb
SHA1abb11be4bb2e8bf22c55d32021a7c974b329103d
SHA25615ce110d50e6ebf71a06b0ea0f1ebffd6c0fbf965d72841ee837f51df9f2f40b
SHA51238f1bafcf21eaeb1e32745b7eaf6ef7c1f9b437bf33fa65bf39f6192e308fcab2f2bc232f1a49e115831807c2c93ca22d0eadd322d215e01ef6ea4fce83c4f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55897552c825adb55578124cf8b7dcee8
SHA1482c5afdc42f9c332dc93510aaa0b5d917b9f164
SHA256d3b8685325e4e6e8ee1c71aba5fde81a9e3c29c002967b5f99ee96cf774c3654
SHA512d94073cb8ebc5142f66987941a23de86e733b76ee60126678ea68f030210da5ed6ea221462770986f734b62ee5d77763e81364736a1944780139944c79f1bb95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f63c97ff2796d44e82496950749c6275
SHA116341e3eeda94134fb3537977d0b72a7be11a584
SHA2569cc889833c3e9b51d4953f8b6ca21162b141cf26773d76d3511c1cbb953960c5
SHA512ce94f5accd6b0b121ea8353b38c240ed18bdfdf66d52d76f809f67edd8bb365c54826907140240b9ed8cded79f294247c244e03e8cff2e5293d189d1f053bdc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5889288c5fe2094fde5bb58b16d4f92a2
SHA1c27e43ee321706167b2a48596eada85a39a0c01a
SHA256bb1d30c7fab275e56c95230f5de0187a9a28298a7cc48229350714e60b814662
SHA512105af4fa9756ce1699abc484fb9f8c436ca9de792329e96ad08c4eabf0e7d746ace6f957093285b7b59f956457f900bfa6d93c58bcfef0afd4ec51bf9d160ea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c38fa5d31ae117215060e06dce70df75
SHA13118c92904a5971c7b8f23b4cc4866d0685d2844
SHA2567ae960ad54141d2ff611f4c3f6399f7a7ec2b2174b97bba602566bcf7633fccc
SHA5122e8fee922e60097afee504127e94802604d4687daf8f04cbf301a2d684ef03b89333b598f9325da8240a976a5819dea8986b090ae1b53a8ef17d8504a5f896ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2d783034e17c05d9872dbf8e0531186
SHA11eee029114a18337dc359e2e85f11cf50e7b7984
SHA25676e9323fe13514fabf675179c89ca0c0a19415b3b25919a6f72d0a4480707d39
SHA5124af78bc3680a17bf756660abb05082e4048ee7fc011a1e32962ebc3ff7ca5968aa02b8e527725bf06b9b217e096d0db9e9923fdbe7e182ab2b9f054ac9f1ef09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a634813bc9055c73e7af39a8b14268be
SHA169a59951a60a7b95d169f6d286e100ff40ecd60d
SHA256ca042230195093809d64d1fd19874a024edbd40bffa2b7373462dfc64472fe83
SHA5123cc9c89df7f4f07f7bbe7a5ecb49b2ec9f36bb2bd2a9e4ddff4c61985950c8a1de9fbfc16b282439e731733902169206302d3c7c4af1b4b1b1dc6c6859b9b851
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a