Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
5f6fd1dc872eb430b8226dc8f418240a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5f6fd1dc872eb430b8226dc8f418240a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5f6fd1dc872eb430b8226dc8f418240a_JaffaCakes118.html
-
Size
871B
-
MD5
5f6fd1dc872eb430b8226dc8f418240a
-
SHA1
4114f17b1fc39501041ac1913924d8757bd80290
-
SHA256
43b26c132f43fa7df73dfaf55749a9b83c759cba544d16b9b4acc7eab76117fb
-
SHA512
a31969fad171878784756edbd5703a0e5d109f76f4684b87c7b6f6c035c7eb0c74b42123cc05465d82deedb2e341987bf418c488c0bf74ff155f9bcbc3a5db11
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000505d36348a1c8bff16ff274cbdc1412328f499a1b28a7c969ceab1ad88e97f46000000000e800000000200002000000046044f0a852286337a9f8766d4d42923d31eb06bde732287e08b4a7104883aec20000000dd43c4342e7867775a1d5ee71edf9f207e2a77010629ba18e71c136fc350aef040000000ee0e3bbe776521c4e1abfde5bce3f03d437f25e032429e1785f30fc64ba97d523469077d064621f38a5f756f3e740793572d9258d1881cd7e19902d2b33a481c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a6fea9bdaada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422375291" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000df607afb506a57008e162456d274005d8d58fd79ad4a76f03f67c70cf65c4320000000000e8000000002000020000000d6bab913487f62bc186ca55f5739b8beb83e87e98f0b19d70db1ba36aee9820a90000000082d1414fb501048844d759d6fba8d69c4186d4523020354552d43a93ee3f6f30f3af6cf9611d23230d50ebe763dd7fb646e9b1f39296252c38908083b2f2787354694fd8b8d934ae55d8c680fec376a17a00bb725fa6b26c659d0b0b2dc746fedaab4ee4294647bcbcafd811a31876994a5b9d54ea431f7573dbb51fe5474d13f4cd9aea1ff363ffcf6d4d6dedb147b40000000281f5c1767a8607a0e5ee5f1a4532f3844a6df68a819aea85592e462a9f8675edda6bbf1ed3179176062d45661e1034fd561a62d3bc23ccc87d7779f726b0b56 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4C7F4C1-16B0-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2700 iexplore.exe 2700 iexplore.exe 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 1756 2700 iexplore.exe 28 PID 2700 wrote to memory of 1756 2700 iexplore.exe 28 PID 2700 wrote to memory of 1756 2700 iexplore.exe 28 PID 2700 wrote to memory of 1756 2700 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f6fd1dc872eb430b8226dc8f418240a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d19ad070856f50532f363665cc13d298
SHA1eb761c2473614fb9a2b1b5c2305105baa2b62d5a
SHA2564b7c0b493a917258878bc81b7c864c6a656a51d5a987c3ab8ca05928a87258af
SHA512b03c4ea0482c663669ebac0e328c7dedb4c0ea41f5a130c1334f647f5e90f3e89aa02013b4551667125269e4a5a921136f6f3131335735162aa27bbce14af2b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b5e8492ea1591bfee9119801a46e446
SHA1b0ea7fd8bd1b69c38903b32a7b6eee0c3359605d
SHA2569616bcc04c80f764999ade75b9a6b7392eabd88013812c9bcd619b7a51280d6f
SHA512c4481bb9dfb0be6aab9fda05b5a28de94bcfb3a3bf3b227b3f28d0889a811dbb2def558337d5030cfef1678fb0a505d8b07afe5e1fecbd4261737644f6147772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcbbabfdb5d87110b584ba32caeec19e
SHA1ee9d0edb5b587366f324bba5f5fe113e5ac25d84
SHA256f1276c1621876bcb1effe430196e28abb63e8965f0a897f676598434fd59519d
SHA51202e90e204cb0fafc16d7c741b1361ca417175c73f24e83a173f2784b2bdc0d18b45814f1de0c077e4c9a05f2a011d924fb64e3155ea11f1e25c2c203ab69c9c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bbafd3a5db2a9e3c70a736cdda13f56
SHA16cfeab71b9ffbb79d48f0de59b5c657feeed5392
SHA25652f4d76903e3d54fa047e81a74fdf2d249e1ab3267becb86f465c18037ecba23
SHA5122bcaeed95e401a530d84575f6c22d57cdcc93087a019bd94cf25034da36c6772e22fa4d70323506c25658165d55fddc2164a132586272e7ac4f2a42fff9f75bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562129ad6161a5ffe1fdb7f26b5268752
SHA1e32026b9e9c83f9e3ca9bc05a7f97c3a8eb4fb5d
SHA2563b1fd9bdb070c39a4f433c178b122dd6840e184a52ee4a293754eb1bcc5055d3
SHA512729fc237e2ae1f4a798b2cce06478db27414b596438cd0eb80382b5228bfbe940b085e10d26cca42f86716ff9297333d6a99b2156d19aacc02e6b34c5f2c8739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5845206b8f4d19ec06ab51f867f03d63c
SHA14feae7470ef88ff4748ace9890f4fbfcc9df4055
SHA2567ba600a1c723fc68cc4bff9a8a5aaa5dc793d85b08534cac257e6b2af03cba48
SHA512fead34b295721d94ce07770f8552663d2aa370e19b48a1643b94dd65cb873e299bbc6238ffc795efc348248f52ca4ed8c7fcfd019b683d8442846b0fdd765692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7fa3b4afc20255b38f8d5c1a261287c
SHA1d8cb0d298e1062999221474bf627efc8151fbd49
SHA256d876dcc60bb852c4606f585c5ae8e82e6d54863ba67522d5cc5f0d61b54ceb42
SHA512bd8e7e0a8a69a1fb94fdd0609ffbc3884f86103e11dbdf4cf08c9d9567c6b747f7b0e128776bd48dda55543cdffb5f311d45ef09844f134ab1ecf4e1e0d91f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e62c564b4e18c83452594f44dc823a75
SHA18c70efe3f36be5ae4891ed0df295ba329cb66658
SHA256014845ca237de2c07efad6d0c946f874e4531c4a53877a2f571c5925f3b30032
SHA5121a4cd519db4bb0ec076cc764cea76c59d19d61f02103948d7875f0a52540b9b71a56aedea85a2d687837da090d97167fd7a3b743b6bff79ddc986126ff1a95b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da8869d03808b8caed43c286f5d892c0
SHA19b21d1315412dd2946e534a79e39b4029bc27f88
SHA256219a2ccce31c95a081f81fdd13a8d646fa83eb0c7449084997d93c9eba672859
SHA512bb463ef0ef940c05ef47f83b7e9a2fd19c72d25f1bd98db1958f6a684bdc7108e0366e4bcf7f4a12894401d2f6b77365c52c84c0c2885d5e59a3a1ec1d7e58b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5499ce056ab1d7b70a6fd7fa9c75352cc
SHA140691d30da916859a3125492d57ba68def20606b
SHA25699f237e370d7679a174cc93c5e659ad4bae72cfac6280cc6b38e0b511e26add5
SHA512523cf0c5154c6f88db2e3d6bbc024e6b37eadf5534b73925f8483caceb571014f1763c55349513ab1fd8733cd4bf4c20a3450ccee4f1cea31fd593296d5541c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f79d628116d81168292129895320bdae
SHA1d93ebc9e3580376dfe422baae1e97f34d807d092
SHA2566950d71ad1247403bfa48e6ad75bdc8112e0350566ae03af5e30ce97441a3bf6
SHA51203fd5607c0f0f90e22abe1f41f89d4d33d2fdf6a29329266e69764b45a4d4b5efc4853f6574e40ca132b0905729c2ec33b23cea5fabe93fd8b1c6d1131ed8394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1601c63f5485916781d5a95e918a89e
SHA1cd8e5d015712568bf6fe2d87e9a952eddb4e6686
SHA256635119bd57adc70b9b6117f70fe336f67866bb48a2ac65e0e88b355ea39b46ee
SHA512ee48416aa6b47cafb5669dc2117f08ada16312db99bdded7da27b98ab13d6cc4289496985ba3b328200aa0d6c4f1f7937af564fe02a033038b66a0b19db98e36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f6f3139b4de144a6aba83cc3e8313dd
SHA1f3d054af1fb0aa4db03db73a89f8992a69d9bcd1
SHA256e092956c4048ce1c829ab04bd7f537b9c5f955bb87b88898060261941e0b9be7
SHA51283fdc5f66d05e78d146e7d58b6d630be609bca5b3c3d5b611f3a2c49d96020e60763b02f847c8c7ab3de804a41bf9afafcd21f9595f10c7d86861209f09a017c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541106782013dc7d6b02608932186457e
SHA18a3211851a89aff072d212359f359107d46a99cb
SHA2562bff66de60ae08770987587d87b22e2a0f2c8166ebced5d6d4901d9841af5225
SHA5121b84c4f1df4af75f77434924772a2206fffeba4187df69b4b932f0fb9d641671afb7109e0ec339b614f32942180604e528519efd3af5b7e0647080f7d96b801a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5982dcf8bbc56dabeb742305c57af3347
SHA1694bbc0551c6d835cc3952bf42788c2131f2d75a
SHA256c1622ff08f7b4a040078feb61ba7e5cb9e1c3b8ad6d683c4732210eeb2d5632e
SHA512d5ecf41abd8f9173090d88afdaf359e3c544d38eae583415f10501180a47fdda52019a9d5f0107aba067d56ad6a3cbd8ee20d02b9c739126491eb82045b0055e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57efc01c897ab5b93d7d06049f8b6a0a7
SHA1ec27256c282857798b4af2aa2a35a6b62ad0c17f
SHA256e1c90b70585600c92d31d11bc16a244383b228578e37a6f49dac4992e879d3c2
SHA51238ca619aae2555c9645c57e272bd7c8babd57a830151723dddf2d5f446420d607f133708cb1742471a0e290eb4d34ea37f1946a77711e15efe05284049680b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533ae8a073028e2b2b0055f302330ab98
SHA1a8fdeb969f83ddd91919dae737c4916a0cbf4343
SHA256920e56d4450750e2fbb704193337b1b2074c61958a4ce3ecb4be794739bf02a5
SHA512a58994a01223f6a625b6af1addc1b3f3bd87eab94df151f7dcdc15f1de0efffd5cbe2065347300ff77ae3b519e215a49179327443440cd351f582e9e879e42c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f43d6ec279143f2f9669301d6c18fa47
SHA1eb400e10e1108b8306a162f6acd7e68cb916c940
SHA256227c7687de30a19b92e73514697485b7cfff639d5169664922ba47f35e00e6dd
SHA512bd27b0507838968ec68ec3005f54fd96ac49d224f0fe76af14eae6a539d3a0b901e10c8cff998d64cd954bb8eb0dff7f66b64cbbfa64fc1b7eaded151256434e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a