Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
637dc87b64f6c875e3e6f4f92f97287d_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
637dc87b64f6c875e3e6f4f92f97287d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
637dc87b64f6c875e3e6f4f92f97287d_JaffaCakes118.html
-
Size
19KB
-
MD5
637dc87b64f6c875e3e6f4f92f97287d
-
SHA1
7f0f083dc87423144d9409501ffbc3134575f1ec
-
SHA256
23f19ff9857605056d77f3132c9b37977abf59113ebae1ed63f0ec12bf5b339d
-
SHA512
5b3e6e2a5047ce0d6790349492f7a37130495347ca4f26241755eddc710c4f6720ed22ccad232713c3d895eeae43b30df4d2a7ed59f534a9764f3f46fc8b09f1
-
SSDEEP
384:ziVKhgESDVBD8cyQ3RtOnemLEXucfIk9xhe3zVc9IT:ziWSDgcV3XbmFOIk9ejqIT
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000892b2019b3ca15f587871155d8175b9ea78570b7898eaa1527c00e02740a953c000000000e8000000002000020000000b8d4d61a36d8ead0424253e91647dc2d984fc4b8805e959d487c64d5561a9e1390000000874475ded2c0733b7afef2a81216aef4764e4bf0e5ccbfb1a32b91281399b84a3d74f637f20c019b2dacb434cb2b17443ce5b6ee9bc49afcce0a5d03bc1bc25fc079c2bc2f9373aee00e3e4a01d2e5cca72e6d4c06b3ad30cda3615540d7109a0658e9b405171a70ad1527b70b1ce4ee4d305448dc5e7bca2687b5daba461cd191cdf243e8d40d6feef170e7d0efe7e140000000c62d87df6051b8900151713f28fb4349147376a83c9242c60aac36fefa136dd78773442ac6ad50c7960499ccdeace4e5cbc3fff1c41d721a4cd82aad4c7d0265 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{459D6CD1-1778-11EF-B837-5AD7C7D11D06} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422460947" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002b93fd12c77905f61fe04080f73a0ef51cd715ca18f93d7a160904f3e157a7d0000000000e800000000200002000000034fa1f07c563a1e8fc024d1baba4cd4b6eff6663b748479cbd07587ce34a1133200000007391025f9558ed5a111bbe631fe8253e374459a100ef5ed6485cb1d3a499a50740000000d5c81b41e4c9268ba9ca5d36719da6c84f92b3ac2e7c8603424f6d37c68596a48d71f3a003d82dfff9c87d46edf6aaeeae794aaffccf734267f9f78976e9af7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807ede1a85abda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2872 1740 iexplore.exe 28 PID 1740 wrote to memory of 2872 1740 iexplore.exe 28 PID 1740 wrote to memory of 2872 1740 iexplore.exe 28 PID 1740 wrote to memory of 2872 1740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\637dc87b64f6c875e3e6f4f92f97287d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515563dee0b510b14f96d80e5cdae5f48
SHA18e023f0821ebf32b48c11ef8e43c7bdaeb1fd4db
SHA25624c8930201225bb167ffaebededa17368416b7a73abc8fa7f80d6a4bfec8576f
SHA51232f34b809ed2ef412869307e0d8f80dfb1a907c134147422390bacb6d631d20c5346316934bb6000a76e21fea1633769f5f3fe11e41773ac3c725570887ad9b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da57f8b65326211d8cdab662574de812
SHA159558e8f5e8f48307f24ffaca0eaed2ec55b10f2
SHA2567f4c6824ed47d88f645111141fd02847e27aff4e16ca8fe3a3c3dccefcf45f61
SHA5123d08a26184a6024b6b4e6499efa3dde8b5289b083a9d103cec022e35d6aa76829efe56aefc3a42c8a15f75fffaa24d359376eb3c102acf3936692d8c22f16665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aa95c19ba2c023f02ab85b3a3a57b27
SHA12fdfd24f4b5f56b02e1d850cfea07c4defa14352
SHA256139ee97c1e2a5f02b32dcda26ef1f81f47bbc3ba6440d25e2ea53c0a118e1f43
SHA51214aeab6acf03b137dc51600a16b3e54dfb3a84b83a547c9cf7d992fd52f09f87177517f84d84e979ed60b486d6e1054334eff2a99ba03c72ffa0c529cd2cec7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3c240f4aa7fbd6e435cca99a51106ba
SHA1bb97779e45e0c8ca8962d650aa898d513352871b
SHA25620b3e214c2616cd560f3767c0fbea3b29ce67fc4f2a75bf3bc5c2d3bd07fb39a
SHA51233e10168529ac0ad60d4941d0a64237940bcc4ca7a87ac3183bb8ad54c43da45988cc48b45a555f65ae57137bd0de3b70895856e921275e0932062b2157c738b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebb1bef901dc5b95f9e0956d3748e3bb
SHA11d8ca1cf26f5de21a52d89f922dac77715ec95d6
SHA2565a89e1f26ac48face38f5cf0d03d3260947e13f9ac29578af58bf360688c5258
SHA51272682c7cd174762a40c9d120dc62d3e0fd0654975c3962da9e12fecbad88fe27d6a3ee0c88de78cb12bf62b0ad29b3f6ecc96528b6b73f2c9b1a9307a42e6ce1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5582487418e71cb45a326069e09a4679d
SHA1eabd5c822d726b09978740990cffeabe80f45852
SHA256ed7e61c87edb1a460de30e05fa5a5b64556f33b279dc27d1080c63db094eefc0
SHA5127e74c4cd3c92ffd73dc7a6d21c2ce2f11f63f3769eee5fbc569d923d9f9acd2250e7a5a71f4892f3540c3babcd6853415f8df4e8c0a9b7274ba761994e694a4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc014e0a3a47493e38b46fb6bf58f121
SHA1d887e9d96e35d55a9f8046bf3eae8f668ce107c4
SHA256258c2817e1688c0c5b384b60b07248aab88bd5e6089b22bff2d6048d68f9cd19
SHA512a0d138cb53a4423a81022557300fb3224edaa8c834c9b3cbf322eba94f777129cf3dd5c38ed0455d8882cd26bb737ce0bb5f296c2c1f0e817b6cafc769c7eaed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bd6b495bca5d2b70dbd38bcdb50163d
SHA111b3f3f3aeb85b70ddf8e1c008096e2f2bd6106c
SHA256d93e2362dc1db0435869f5913f3ede8fb851a3fa1de0ea2660b747db56e04570
SHA51237b610d0f6155396b8537892e941e2b2d2942dfcb913f0facc4803a0cbb8ac5cc4295d25389255bd5b3c5bcfec83b0285f5d9e043b699c3af9d81f44e56d5515
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4c6230bb935eea72f05dbe1a0cb603e
SHA1debeeb1639d07285f88af94393c1c407aa383fcc
SHA256dc5eaefd56d02b19348a95d6d7fb1a0cbe5e2c53f9bc3b3a9fc1db594e45f846
SHA512223dd3202bba4ea0c9de09a7c898a66afb52b48f7b57346508e99c3f5805dddcb0d6d688e48cf067838bcc3a479670f081bd1c906ee1a3a1806eac16933d374f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56532224e8ea1cbd7e3dd4f10e1596ba0
SHA1c7ca62e00a7262ef238712daf55ae2a861e29743
SHA256bcddcdcb9389e2ea9d51d8fbdb8b3fb4c4838cc7cfc3f18ebaa0a4acb6e6debd
SHA512524715677d4b8539638ce4135e85790952f1f3a02f66ef55ea12fde81a64f0d380e4fa6c19fafabb040b906e755d764b19b98563a6c33aec42a5dbbc9bd0e80e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54aade91ac349febef782e32debf60abf
SHA1c6ddae55d0b69bc4fe9be46c4cbe76d8704975ab
SHA256d9336d15780956e52150f6d79932b74973594d340d74704e84d539bca0b5e945
SHA512ec0b0e788448d90cf60bea239f081957ddff83aabd01dbd0bba25ce1c5f418d8c11c65b89c9405fd53579a46afdf5b3ece279df1f9c319fcb18c458d5877fc07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb7643eb2862300541d59d4f9a93b010
SHA19cfc784275696d150b1189a01e4f9ec8d9eeeeb8
SHA256533effd37547348a51352e7c45fb18c8208e5c0c18d549b1fd9c81bd001f587e
SHA512bf726af4dfdf98d1ee1a0a47eeeac65ba4eb951142b09606737a87abc640d6b90932371023bcedbbed26a3ca2f27db31f13457b8e05e998c1bbf7684ea539452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5446ca29d353a2d9239b956cf3657a5f3
SHA170bf26618e4cde1141a365f64cdb4c459e609731
SHA256f3a046c3094c3b8184b4772e406b9bfacf33ad7cbd36a325746e50112fd4cd97
SHA512951115c8822d1c16e965f062b7fbaf8ea151632cf833ea32f24ee3bfd64f65894427e37e29054277aa9eca1298244400fa0461406aa6fec854cbc029fa59e827
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584c8d741c78488e6513861089c7acc18
SHA119d1fec1fc2a67502adeb3620ef991f5314180cc
SHA2568f97e94f737dc6fcecc27533252a4ae556d76eadd6f610a9fff098e4e57e4bba
SHA512149728bf0768162920286263f8362a21c3c7b00ae37f877eed8509f1708ae272cf5e960d9f3a83cae33db4629756729e524e274f9144d5f1665f651c34ae10d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2d8f752a02e4aeb4649648ab0ef4cef
SHA1d9c001cc8b43bd9b66303a62c0fbb4fe59a23fad
SHA256df9cd42bd6cf082648a648120acb4036deac6d13d1527b2a0776a7dcdc4cf076
SHA5128df321b38e019d107b64948f8bdc59650708e04435f3bb6b727bc43f5a93314add84fe8456b1082fb447cfdaa14cc7ff8dd01fc01df3b9924904313c587e81a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9d78d3842b09331339458b4cddcd05b
SHA19776f1976f7057140638fbcd915ee6c1158777c3
SHA256632c64e669ee6828b6f0308c96f9839d5b0fce496c84b0d7efe6e5a5cc3dc1f0
SHA51232cd417ecb2e3f255541e1837a7c257bbdf47eebd89e31252a08aade98048cd3c687ca513087b46225b8317e75a6743a4db9e28f2f4d1101de59cb5b81b967bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5365935c73e511561ea54b7a853cda00b
SHA124eb3a7b4e5e4c745b871c8094a04a1c13b31ff0
SHA2569029da1a3be9ee331ba7a003436ecb20ab8966649a5bfa21c7532547d1be852e
SHA512a04c27c3e3293c84eb402bfe5a0e1e7303211ed99641889645462f74e43ed366be8e18ea72fa4a8071110c6e143565d4273e63ca77950789328d943143739190
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c340be3d48daa5614f3e15fa35913648
SHA1802a5468ee25385b5c63a24aeb90c3590bb70735
SHA2561fe195002eb23dafb735abcc369d0ab1b755a4b2439f449a49c000252be98d31
SHA512d1d85da76c168b3f741ed4d767972a7498004a1a5b1385dc5801b7dfdae99987bb00c97c3eaa7ca577415d5fce276c71a36c4b8857d63fd767bc5b86d2bd87d6
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a