Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html
-
Size
13KB
-
MD5
665565e42ab0582f6353eccc9b65eb3d
-
SHA1
87def8e4f5ad847d71776f4d3dc34e4253197c68
-
SHA256
3936d6cd03ac1b6a5d751127ff9606be44d179f74e06921f7c66d63b3162fa11
-
SHA512
8dc25abb2120c7abba75b3b95e9dd8285f74711c89cf7b3758aa729e85c8892879bd7fdef82183279ae67db4325fc8b4e62b90c41c90506cd88abd4b20e07fb0
-
SSDEEP
384:2bVtslzOOTei9oT2vdDWIiNNFgSP8bd2d4SUzbd:vF2TwWFgS2ocbd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000024fc0e4a9863d54288a663bcce48771900000000020000000000106600000001000020000000551ff00c115c6ed3dea1b13c9e10d3bb15b38f703dc457711fd97238feb20ec9000000000e800000000200002000000025c2bed969b7e94e31ab260fe8249f57a0157299de93d0efcaf671477d791863900000002feded3cad3674cf7d2c6a96d714d087bb46bdb280aa65dfb8fd8c4a296c42d54e7d70742cc7bda84d93b3543bdaa5f7da741b39405ae04f69da399834214e35b9cac8c83345f0c91aac98a71a0ed9ab725faeae8b8817f9e8c0ae782d5bddc579b35b9f018bb968de3c9d1d7338f82107ab7d2a90ce3b24e549ffa356821711fb33710b6b832da52ea9b7f52bc255bb400000007c0309c39eaef4f28975a88a462463148b45447515c5d1832ca16aa4027d3e8e01b1352a523781081052486681b7018f65f88833568d83343e025e5ee8734fad iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422521696" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c062d58a12acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B63AE981-1805-11EF-9F07-6E6327E9C5D7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000024fc0e4a9863d54288a663bcce487719000000000200000000001066000000010000200000007229074083886d7794204671ce1bb2b55e1145447eba5f95d3fd54eb16212003000000000e800000000200002000000047960b1ff8e65553f3180ba9da67b5f6afd34e9511d537b17fb6515bfce2a15f20000000509a0ae6791f2c7c9bbf8d89e6c53e96858d703361159939f289ab149455c1a940000000400feb54ac35c3d0d1577a8425a1a0f1e11e16a9a836f31c03fe5247b521425eefcf1a3caaba0ba69568e6335da89a0d9453079b0c085cb77ce5b48cd375b123 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2500 2012 iexplore.exe 28 PID 2012 wrote to memory of 2500 2012 iexplore.exe 28 PID 2012 wrote to memory of 2500 2012 iexplore.exe 28 PID 2012 wrote to memory of 2500 2012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c7ba77ed710b5cd3ed3a69c48cb0a17
SHA1bd151815e39e75ff7dfbc89af38a0937ef2aa3d8
SHA2569f867c4173e6c8b592fa2a8d731f98d5bc34ad3941545e77b1e2d8422385d591
SHA512c5f9b0bb4b6b83d3dd1a54138613e78b0d1d6465862af1ce69a8f9dcd107a08186e85c4777eeee9884ef0f11b89062ff9007a0764b6b4713bbc43b16e76a4c4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51183f224e7dc25a9d2bd208caa20576d
SHA16d9b2b1441426b864dc2096135f1fbbd06355560
SHA256c8a914747bc2609bc9b4bee33ead30eb3a425101a9749a86bc209ca22c1f08aa
SHA5127c2b7eb4678136ebb845ae6a042485c42e75a13375b7e337cb9d7fc91dee32c1b6d3aeaa38439f7dabf0990b9a5f56b7aacb5f359aea6b0032962b0e100332da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4dafa468aa3d885b0f40559d7487caf
SHA1da93418cfb94bd0c38a9f555fded22c71f33615d
SHA256567d32e1f81d69655252530f4af4351c915e550dc31a3ffa7d33ffbdaf658a2b
SHA5124a4175ec9ce4dff7f94055f73c390f6a591c0971dcb8d25dec5621462a98f283d0b6024dc4428ad7b152739e39ff6fee042b158226dbfe035d6bbf21aba3161a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1499348709d9fdd7979ed62b1d778c
SHA1d3915c2af9db26a032292af5e3511e5e50be9872
SHA2568cf7c702f0e38e6f5ea3203b6d4c9513c311bb4664f98dc6856f25f295bbc9f3
SHA51235827884a813447d06a9d4621fdeb4dc482ec7ab82b1828176f3e93432c059c8ea683c10fa0c0332cedd87e7119cb568e0e42b8314f1dfa853fd63e891c2533c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d1cfc52944f999045ff7d555e1ec46
SHA1704b732cb4436d7b35878df63a2b8dfbbc3370a1
SHA2561a025747db53476316447eb527c4f558864a41ca5c2bd0cce2d435d970a90577
SHA512c248635fad4f79ff5a15475fdd3c110751f78f8560f036eb48cde7da6c33e4c8ef46a6b9ddca9c3c253806904d437783b50d0c931dce797577d1fb5f06bbe261
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eef1a5048b97394f60296be633df6b0a
SHA1982cc1e725b167ba88f94a0f7f2e99ce12a1c209
SHA25657c5ac4ed0d588265e7eac176e750e196dfd8ef600ee296a312fa5513c71a41f
SHA5122df96e254447fd6a4f453645fb1dba03cf370da607b3f3934b58fe28aa40b79653164f9c1e1ee54b9b7fac5c8c0bae20c2d5ef927b20020a18aee737c5c86ee3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5137ac451ab1d14890eec1c367ade1970
SHA19284f3fe4ad8467cbc4d62727f087bf0b942c07a
SHA256214739e9b5e5baafb92eee2be895d01bb944292c6dfbc215fd415080bc766f99
SHA51289a50eb6b6224a7685719e505287735f1cd61572b6325cf6fe33ff6403abb22d89308eaf0fb954eb66c97087317b07bb1f4fec4a11e4d06ef85c4f9fc390852e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c9a46f292c081668b6d5fc6cb70f5e7
SHA102205ab587d8d3c68469ee5dfbe32d86b28d8687
SHA2565d5fd97ed57a9995b76944ddbafe24252657461837d4bebddfdaa81bebd297fb
SHA512cd765a3a323051d00496edcea5118de54e43a0b205a2cecf27b54d1b543b7467697a700a96f59a810db860945bd4cfaeed73aa15c7284b462b44801786c83948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c8725ea47019b83c53513f686e1d3f2
SHA177448b1ffa4f95279c6b3a30bc301e54b6efb088
SHA2564b7cd7a95f224019e93f5a0f05891c9b6b54decb3842add2809e1ed8b7e61065
SHA5127fd3597a3d7505e4a7aca26d538d0eb25a61644bedcaf99cc14bfb2e2f65dee99b061ffb77e5089b21344e928e326d29cdfac2a20fa4464ff81a26f3fcaf1b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ee990f0c962fc925ba59e393f16ec87
SHA1b2bcb5a804a6cdebd0ff5183d63bce0faec653a3
SHA256885d02c8affd95797830e3b0a2817e0ab36bba1e49c9c517cd00482d6f8bf1a5
SHA512577bca411ba80962c52d083f7bb213e932f61d9bf7a917985dd62e31e790455e211bdc478e36c9c6cd71c7cc87ba5802dd4be3a8f3e92662b8dafe11be8911ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517c33d5f003cce667f7a1afdf2baffbe
SHA10db49aae009606ec0e4264354cf7bcdff2b4bf64
SHA256cfbcba52bd5676cf313d13b7b48b9725422012da9c48d35e1663922b0d525038
SHA51218e45a79dfdbdacd14e8c62da9b48926ec564341c270c432350e1a0a7edd93bd5131aed71b88a433bcd09686a35513abd5daed90ec416798c15dab8305cf4a99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aec53b98a663e0775473ae244249a1ef
SHA131c26be26cbb244fbe7c093bdeeb2dd8c71baa0c
SHA256b64491e11290a3b4de7cea801beb1ba878c6fcd13823352ded1430adf8d7389e
SHA512e934136a2e1966c6d333c46ba37eb3a855422a21edd656e7d36c8b2768e46f627b1bce74738e045aa50b1f019ba2d2f00c421947e7789e7227de00b525639be6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec2e4a0089066ba0681475323d4221a1
SHA1f3f185b3a6752d974c8f480d78cf2780d042a250
SHA2561afb5fd2327d2e2c2285bf79ecb167ef4dac04e7d562e574df1fd07008653bd6
SHA512a88f6d2cf5945988a7007127e8fb6b5e720cd8ace2da27447aed0af177ecb85cbfe48d37e2c9a60aaa38c33f27c0d675afe4ddb7969ade0fb0e6750815702eba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54378b6ec6af79f24c50a8672e48d8c18
SHA1c8fd5cfe688869611ebd069cbb70be7708d76057
SHA2563e78a1cf2e2e4227373bc38ce0c9ecb66d21c18558808b128492aeed8557c177
SHA51251a70d4f51d93b2579140c1c8af9def9b768d1b9f6a1d83391b78607ef94c7dd01cb232b5c892a5d47bc2f9ab0de177b586ebb709fd4f0832e5f5c1db0ba748e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8bbbd30dae0677653e462ae4414a7dd
SHA118452210ae8dc2effda05840c611d16db9203caa
SHA256e78e3964b2d8560867bac31d871994dd27ce0b75c0bb63a0474fc45762b6887d
SHA5127e1628dd8d9cb1a7052058bc743e0f90cc2974a40bd84bf0cfd15d29b89c5efef2bc019a79fcb335e16192c2aa0fb4cce150056201910d32e516816497ddb682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eb41e55a7c29c7ab6fe3f25caa96810
SHA19d249e06ec3e9c9929fa677df0aab1679eb68564
SHA256570210cedabf734b3f3bd83fef7b50fca41ea43f467753255ef9413a70895558
SHA51211b77265bf6c565de7d28dac65a4e43fa538df2a89adfa47d17c9f4a30e369b7c0d8dde39974cb6493e6d0acbb9de8fc3f050ed5b2b62369c39e315ae0a5f532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e1db616d8cfe55dd2ad8d5c5d3067d7
SHA1ef8ee9f1367e19936dc232920b07c5d22916a688
SHA2569d514653ff48cca862dc602b4ac65a9b2e45b39266c6f5286b25f067eee683ca
SHA512624a2eaf74e2d463b07f5977cabc01044ba5ef14502829d5739f7b302b428e7bd7ef1d27dbe7b56ccf6d94c281d53f2faf43be1f2a5e93747e6fbf3b6eb21e1b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a