Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
5f19acbadaee0b837f496cf9a36e7e87_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5f19acbadaee0b837f496cf9a36e7e87_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5f19acbadaee0b837f496cf9a36e7e87_JaffaCakes118.html
-
Size
4KB
-
MD5
5f19acbadaee0b837f496cf9a36e7e87
-
SHA1
4875b8bbe0759062a1bca671b5c2f790f0eedc82
-
SHA256
fb429e26ffe1881ed904f5aee24faa1c867880a08c102bf676a385af83cc25ae
-
SHA512
e9b5b558eed5193c6adc5c9abcd7863a5f3dec1e7865441dbc21b44b0f38df818ba2513b022763c65a4d2f7425e014b5b41b3e7cd4253b087627855aa01b0262
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o+ICTMG7:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ffc6b03196d9b4d81987cbc4325993dec3b5b6fdbf71c5c30a75cb9befb143e2000000000e8000000002000020000000cae4fa220c73c63adedb1ba4aaae3d3452d97ec3cf43118259a7e54637b6005290000000125a56494a1d862b074d545bf868ad546fcfdfe0fd8669639fc120b4f4b58b36805eae82037264faefe9e8d9f2e454238ef5cec02430e375616599e485f313a05fbe8ef663eb19a9070cbbf85dc8fca3088941eca6a8305e38462b61f946c159abfd261a87a66c893025775143514118166a193e4fe9d8b107eececa5b049c8e85c6cc11d69602de46e35b62bc2f7c174000000034b9dca5eb2ab319204c89b521397fd9febf49888ef3a65541676212286622c769aa1e675ecb312f6166b05922451ff9d1ea502f089cf2946c3d20436d9fe3d5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a052a952b2aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422370421" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009ab8c73b7cdf82fcf3cc283225480f70fbd3154c5b6f1a1e8bcfc5f62d15e049000000000e8000000002000020000000c889175570dd9a1b6167ab0dfe9bc8de637b373f20ff37626582d5c5fccdc98a200000000942f43c70c9dc382055dff1d110af5c48e3eb8a85bfd4b64555241f098b10e6400000005e33a9bf018879b804566701dd8cfdc96f8e4b201a3109b5e60061ba348001393797b7c32c49de67ff2e5c98a600eb5bbc57ee358491c0117387b1a1cc9cd5f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E163C01-16A5-11EF-BEEC-D20227E6D795} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2476 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2476 iexplore.exe 2476 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2476 wrote to memory of 3012 2476 iexplore.exe 28 PID 2476 wrote to memory of 3012 2476 iexplore.exe 28 PID 2476 wrote to memory of 3012 2476 iexplore.exe 28 PID 2476 wrote to memory of 3012 2476 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f19acbadaee0b837f496cf9a36e7e87_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be652d0d170ecc87d169905c6c98d38a
SHA1c7ad440aafe880176448b09f194591cbdbd73c51
SHA256dc47112c26a3b11a760e844e9f1a532d296b71326ac418243c3ae3378d8be83c
SHA5121f89e6f6ada94269846dfae1fd0011fc07c7692ec8733e38593d812ac079daaca05cd414fd4db640afa68db3c85900e1ac4892db695a89f474543870b3264321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54114fddc95564a04453e8715d112f337
SHA1cb21d1f8601f51fe278195338f698ead1f681e1d
SHA2566f7f3d83215da29b9630b61ca692b9c2ba374f74e9a74576088ee0fa3bc90e4d
SHA512c4f34d716841fcee715022a9e05d7cc7160b33599d98d58542ab05f9b071c4fc1475740535e302dda2c7fa1726c607f7decd2fe4f454a3ba263a9f8664cc702a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b432077a4e8fa799d72eb51c446cd3f
SHA178e9a39f5d25e071e8c810265b52252bbc9295bd
SHA256f30f5ce7a09dadb4cc7a87c6e2a56cf135162a55f35c7f56ea20b7c46ce8a84f
SHA51261edc430659d1b418091a55d7aa36eddd23c7584b5dd6a61e66f0608f005d7a900a66874aed2703583b95b02241974353137db2ec5c2addab839782f94f8420a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54641d6f15f1bd1880463fecdc6cd3f4e
SHA16e36729f63e5f4fbd566845e2e936327716cc9f3
SHA2569a8e3ba23ac27c85a083b207b5cffeb91a25534ba7c4bcfd44695a93fe555747
SHA5122942a6a81be64020fbd31271e4c35d3789adfe9718a2518379c909e903122f237960c09434eade6480468965b67fa230e5ca87769f6e7a26ccb6e3efff243c25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533e5ad672893bb2a27196caefc1de48e
SHA1c6281cf7c849bcfc16b1160a754c37f8c998c746
SHA256c9dd591f2817e8a087b4bf74a35a60c816646e95dd014e449a963077ae60bb99
SHA512cb737029e4d0b6d6225cc4af50cfb5ff972132ebc87df0c83c169b7b793047b73d6b97ade0cefba62d7b803652ec85221628271d11f71560681c3e1273ac3c93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b593858d0aee245da7ecb3ac45e8c87d
SHA107f235622536f25d7ddba11debcd82433e89e90a
SHA256f8d310928afdee4667a6dc0a6ce26bc27773a7770cdeb230ede9d9219e99845d
SHA51269f82a0e22a1dd3727c842a439209055611dfd5ed2f06b7ab9f6ff5f9148b480069eaaa96fe23baa823976410f1346935a0663786ce44383d4370de4b511f65f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50615f47a0c4d02118dd5521a2258827c
SHA1217a8ad8a44a285ec44f981a4dcac19841f97003
SHA25617bfb372bc88a6dd1bb6b812836af1b8a28b11002d4d370c5ec8ec8fdc55b27d
SHA5125a533c39a4e80dd6c69b2ddf09c604f52b75191bb507090d524db70c2823ebd94b9449e601a663407eaab2fc31c6701e6c98842cb47f3df1bf63533ffe529337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a4c3e6d1cc27510ab502db274319c4
SHA101f48756e783fa32b352ef23bdf4459196bc6541
SHA256ec11e88f771238a5d02aea0859d54f2f0da1e2be99bf73057baefd745d8d6703
SHA512a4de896dd5766cd767eb69387d291255fdc7c2b070d2827e0db52078ae28c70810b9135f2034f026fac4b54c1f1b5737f3494536c10261863d2e38884c6d0553
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecb1fb0fa0e68e39a65899bbc257c4d4
SHA19fb8fac9a6805ac61bb05291cf620651717bfbde
SHA256ea0fa1501dd0f3cd359becee7c7a25c415ef96a8513673562e8b4c2e83d75635
SHA5128a2ca2e60747999b809c3f34ef1a4ae181ee01da925a39fd58b842cce44d36319fc6e1e24b0615653356178810f70983004a24623fc5b86b039df3c4715ea7bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588366c39e633f260e9fda8903faad06d
SHA13063eaaca44d635cd643b9edb5c34ef0cbcd629c
SHA256e2cad3eb639b2c3929c6e64a376dfb63e550b0a294279e6ba9dde74dd2c6e7e3
SHA51252038151c55680f2942aef217c3470a05705b580b72dd0ab3e8ba363652c4fdf758f495256609ea9a83fd8a6668db34f38e7561efe52b89cf203e54b86ad714c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59275944a4ed5e19316934eb4095cd25a
SHA1fe95fe9baa4c6df715d8dc004260d6297cda3e4c
SHA25682253e45e009755ec130be9ae554b6e38f8f14de6af986ef470ff042e9c0050f
SHA512dbfd54baab5599d69ceb9f39d2009cc4d5b22a4d6ec5e76c427f6852d578cc06da9d77334cffec828adc1ed267d13871e4feb43d3795a7cc4973a25125997d30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2d225e6feb3ca6029fa63a15d239bc7
SHA147edbc8b316b0e2a237f09fcc421a35e055fb2e4
SHA256a89a5ef5bfe833a5884e8f41525738debfe91361b22f1a982c204e2abd6c46ab
SHA51203893d0496efa3bbd2c2cdf9a0a41e45e117422879f90d3d6d06154779b14a4785d28beaa11ab6b17b898c0714372b8f21c3195b7aba4d0af41f28fe49b04cdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e9baef2d78cc5d24121c31277f98e30
SHA110d98c2d0d58d06a4279ff9a3ab325dcbf16980d
SHA256632dde5087b264f41f2373bc91248710b860094a1506b5520b984d95a38c41b9
SHA5125fa1bfce11c08b6469d7971c4fc919cf26a81b897d263d1c4a310acbb92ed3f5b1a3e4d9225c7e2c8c0313dff5967d9b01aa287b6d8ef0ae09abc5db4396bb92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56342f183649b7fced6d4d90d8c9b0ddc
SHA1768e95cdf1a0ee520582a22a33acb485e1b510fc
SHA256cc79fc0cacf72cd066a5e33e27513e0d8a0c197f22f6530155589537f02db74a
SHA512b38b3c283a4bb548e4f773492e7b658d876c2d844b86ceaa0a1b108d5981d398e5a6dce99a62e4eac2469c0f66dee416d0483c543aded96c77f4153b381d936d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ba332bb9be7766fd4e53e522e627b9c
SHA164b9ee7218692533f46c76c2bb7db10f672dfb21
SHA256fa222ade3df0f49f600a58ff6c7c1bc31a7550c6429c6ea07032a15f43b53c5b
SHA512fd553c7e4ac8c1d2122be0c4ee21faeec09f442a5a8e1bc3ec04d80eb11bb74fc1f542f1cb726fb1de869c1728bd75be52fb51a121e5e9c0d55a27e706bc7c98
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a