Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
7616ec93cce4dc31f7b08f5771ad600f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7616ec93cce4dc31f7b08f5771ad600f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7616ec93cce4dc31f7b08f5771ad600f_JaffaCakes118.html
-
Size
115KB
-
MD5
7616ec93cce4dc31f7b08f5771ad600f
-
SHA1
8b85e81b097b804868adf06895d77e47727fc107
-
SHA256
423c4987797b4587f464cf6c37d9a8f547bd30442ff64b61ed5bf881eb2717ad
-
SHA512
dbe5ae6f3caa9247bea95521728f57962bb3ab52d88d77fd4b627cdaf2baf82b616cafb9292206db231473fbf575f07716b0f702dcb7eaf764d4496899f9d30e
-
SSDEEP
1536:Scph1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:ScpvyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f75c783b094b9cea8653371e65d723052d14076b5dc9fca801c130e4bf9d5029000000000e8000000002000020000000ed54adbe73662ac0792428cfd17a3d85c3996126c9e6bfa4373e3467f141d8d220000000999636f1f1bbe5fb158fdc012b28e3b500c63acc5ac9e424e2a8a3ab009c3a7840000000f597301529c4d840cec7bdf224bc46e19a8de2d05d5ea18100566d1164766cf089fccaabbc4989915d0bb248f6f288b58f5f9ce295d7bd1011c14b6258f1769b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08BBFB71-1B7D-11EF-8C93-DEECE6B0C1A4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000f8b821d90b09eae590d4f249ef51dbf2e0c028004eee5b85f078133492c24728000000000e800000000200002000000036afc343a94b56ff2cc1491003027ffd212e417d8f3a01f07462da71b987d9e690000000ed71a873e0b2c1cabe4812901890c6ebde7d4a2da90dd8492dcca96260713dcada14953c2fe0d0d5748d965ff6be971f54667a8b672c087b5482b3f67a92ec477642d2cf1bdd030f93191c518eac5d6c5e00f32e20a07583b0fcecd5f8265a4419e455bb503fada7647aeed21d839445736ea8488e8fa23b400fd15be7e18d40ae631d30535955402fa24238ac0a0894400000005e8e45a7e009dac9e443a1e0f49b5b5df0c8c8fd77d9cc49c8d669e2a3f1ae4841685ed5cc5e43befabe0a7415c3d4cabf0c777de208b43828e614608fc62e68 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422902798" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602a91f689afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2976 iexplore.exe 2976 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2548 2976 iexplore.exe 28 PID 2976 wrote to memory of 2548 2976 iexplore.exe 28 PID 2976 wrote to memory of 2548 2976 iexplore.exe 28 PID 2976 wrote to memory of 2548 2976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7616ec93cce4dc31f7b08f5771ad600f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563ae3715ece3b46b267b19d6c6130ceb
SHA12a8bf89c99d14540e23c9f2a2f1644e031077b7f
SHA2561bd65bd224809a1ab4873d83963c73a5174ceb138e35f3ff2fcc92fb2d3e172f
SHA512d0037c4c361422b2bf928d908d7a6c50e8967a8631bc0987169a9a3ad80dfd235b9c5c42f85f4ac22285c226b3121870204dd18e5d8c4dd3761d6faaa647948b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5599038298526169a87739934d33f9756
SHA17b03833d8cfa9f8ba5082028f4b0c4bbcc87de9d
SHA25692ddc38429e549e89dbaa8deb3ebe6dbdc4fc9731a380f7afe51fa47562cad70
SHA512499def348e2679221190afda06ad00e6c5b2a6cf01abfbd1b389da6859305c869876c26c68d235df9d274549e041535abc827acfd84d45ba5c9bc9517c356c81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7f87c924723d8e93be55f10bb0220d7
SHA172dd5e7dcd9b2fc551855764d722377481410886
SHA256007ac5ccc1bbf2ab201ee3400ea7f1727438ffd40bfbe3297e601f526b44c62f
SHA51263c076dbf48b0864e5b234f66eb26474443d376cda5d506431a8d0740bf7c81aa6b622d727d8675a4b62f6e9e7016f0e80c194ab2cfe727ba7623af34f7cc45b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5284d000ae519f01e19840e1332836f8c
SHA1de85294a6be1e856e060e8c796ee1565d5b3937a
SHA256954d4f2a832ed1061f9b6e5ffd2cf0d1c385f31043068896b51d42c05190785f
SHA512f1d22e6caf88d3a081f93ed614a926aa9ca2440640a3a1d297c1d3c0fceec8316b7296a6529bdcb90f0c0ec9e8d8a9056b054867855bf094ea101f25498a8f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e682fb9e84a16c30bc386ac2979f2cf
SHA17bf04ae3bae9123ec5fb1d6a77e9efc163d4e89c
SHA2569ed418536baa432f36d60f40b3a8318e891adc5236f33f9c6767d8c4c99235b7
SHA512602d56982f8f9752850e9c35bad8893fd463cdd38143088977a239d3d13ece9f1a6b002d55db86f21c74c5831ad8c93bd7933f1d6d737cf742a583aab2304b35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527d81099b29e581cfb0ee7ce3ac05366
SHA1c929fdd2c45f0e09d8f00e70158eaa1c286cfa9d
SHA256a648ba9d6acd88558808503c14025b1ba4fd9cfcfaed154aad2b5ba610130929
SHA51268bc53cfe776b981bd0803ebe19a25637306f23e6a8933b8a399ec150a0b19e2a278e4518097dbb64f6dd150ad8f7f73c09778dc919c7c7ee1fd3f303bc3b9d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcb1ab4986665bd733c90adc6c2ae7e8
SHA197420691aad745152a231c523a1558b57fb7a1a9
SHA256efc6a73830bdd29e1b3878b3fb796857b5eb8ff01102827b9142a5cf7bcd6cdc
SHA512e443c97e4ef45c9bded85ea3f962f1f06143a319a048e85b15d2666b1faacaf6e9912df6e0ac295fe0a5b563ea91f1145e1c0c4d872c5e75ee5a07f3dbd5bd61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54433449d1c335029bc49273db5f03d00
SHA1e266abefcde30b8b75a68f23f8fae07633a98e8b
SHA256914509f4fbaeaf90bb7241c01736e2c6c9cd2f7fd87edc10b90afa7715a7432d
SHA5121bb1ab0f61b2824c7fc6486583251a11b66bf9d4b363efac2a15e4525efa44137446fa2cbc98d2647f09a89211f3ce796ade67e1cba1be0c2af04a72a820c4ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501e5d8d95c867dbf8ece3b820b3ce948
SHA1eb59aa8e98a062c8b7b34095c4356f672ed555df
SHA256f21905b49b1e746506b83a910790ba049fb5c0de004be71fa4f2f05a92974fcc
SHA512d19cc639a6a06c30c88b6d89de9f814fb4b802000ccdeb997326bf39dcef18b741894d08fd87b21f2bc421800c6fbdc9c02b1da4d0fe5ecb74ba546910310d2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5326c2b6e581f14f153827ff5c3e61408
SHA148f638c4a66f6c41ff7c2be1832312fe49addb22
SHA256137bf161bc89669cf5736dfab63a4665a1895e811b02f4013ebd830553d6d0d8
SHA512d1a9ddacdf2a0a2b135cca135206c5cb5ca0ebf2eb7be9015087f36e5cd0cd5bc129324700dc7d4203352a9283f97741805c243b0d4ff84ce33c85ff414e4ef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514813345d3275ca8ab6a0443510fcf42
SHA170d815889a4f5d0c6b8a1a383e1853f075038b06
SHA25642d23bd783028a951a1302e5541a99d888e9479f02619054b2c81ae00b97e5cb
SHA5126040dcc11b0debf0f0c750601af16544e62f5a57f20dc9263a7a1400ac63dab6465eb66b41f0363e95d14d2256cc8e285cfbb9d3a3237be31cb91e750e4d9860
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527563b5bc0a3e554540e17fd61e6ef58
SHA11b5981fa635bfb0e252eb9e445c76fc894687921
SHA256f323b332675e5e8a928a33aa0c9118a941eb38812bb38be949f7b4c20cdb1dac
SHA512e53084552954cb60d9c6b265ded0406d4759f5a7650004f26943646aec222843dbc58218c55ca9cb983d229ee249db77d620bd4403ddf7e8d7386f0d6a09f9c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd6b609dedc9c4a72ab027ec9e1b135a
SHA1ceb9e4114c44ed0e91af299ac745fbe067446cf4
SHA256bae90256576ab57e319293c817ee59ed8d3d04ff942b7b0d9a6f3676bdb9d566
SHA512c74c81b57bc8f0bfd59d5250387c39065262faaf0d19c52fa639938066e2bb0d0c303e23e3a8dda662f0094b0699db3af9fa02f2619871caffe267183e9e8662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57232b756f59ac0af01ac5d3fdc53bb8c
SHA1229e18e3318caba7963da7b78077d204a643ccf4
SHA256f64615e3d67375cb74934e30bf72bc010402a9875d4fd731fb4a0c4cf7ccb51e
SHA5125d1c30d30d489a067728548260033a53630b96b389f562c36c2e33542adfd1e5084ec5074775faec818206762bc6eb5673ffa0f6c6c9c9d197edd238764b8354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3faae9472e3e3a8e9bfe067017ee352
SHA13b4abbfa107f172016486e8531001362adcafb9b
SHA256e4a85a08691369da35bd8672b05c0b744a3155db80e4d721047d1512bf798e77
SHA512898be9700cd287ba638f843e0e7518294996fca1613b4b6d483ab0d91b590ad90e820edfc969fcc34c5ec81318b77a5e0600a574ad8fcb0af6502a9cb326612d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5396a6e9dd1dc7ab3252fa63e00410334
SHA1d9a31e14972ca36954089330a94d203291d6a670
SHA256a57fa2bc10e0268ea35c62e209a255aff2145429070a39790f59619b691149d8
SHA5121ae840d4ce49a8c63073c681949c1afd4823a39e0c10f5781fa590d2d87dbc10c257d4b05efdc647297d83dd3c31026a72f9eb32cd934102d15fbfb37448a243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b49ea8872e016d7ca0a4044f5841b6c8
SHA1deb5cc45202d50fa09cbb5890c5f42a3900c57ae
SHA256d45ace7581510d978be13f5e075b1e6e864fbdbd1dbadc5068dc9d4b48fafdd7
SHA5122841df6c1d2d358635e8c76ad416270845e2b62675085554abf1077efdbc0ec2d1fd2fe42fb4f4e2dcddbe2b183387a45f3164036721b527d6bb5b5bc8e0f24f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a