Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 00:31
Static task
static1
Behavioral task
behavioral1
Sample
7b16f67514b8fb9cd0824eacb646f9a2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7b16f67514b8fb9cd0824eacb646f9a2_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7b16f67514b8fb9cd0824eacb646f9a2_JaffaCakes118.html
-
Size
353KB
-
MD5
7b16f67514b8fb9cd0824eacb646f9a2
-
SHA1
c0e13c4c64a6ed10ee4545af0806a1c87b0971a5
-
SHA256
f89b956f100fbf42bc293292e5daddce104dd1da9da2276ece00a7aa16aaaa89
-
SHA512
37a4cd3be7895dd81342d2af1636862c0b98fa5feffe6bd0a12b5c58860444a0e0723c826fda55491ad54a7b2cad2894862c2689c6ac2814ef7a83fb4faea81d
-
SSDEEP
6144:SzsMYod+X3oI+YVzQsMYod+X3oI+Y2sMYod+X3oI+YQ:C5d+X3bS5d+X3e5d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b4fd7e96b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b2566c8489cc5644a84c06e8a7bbfbc200000000020000000000106600000001000020000000dd11a646c1f40fa0603d91df12e686b13edfa4e0ffe5ae33bb523b40979d8104000000000e8000000002000020000000f0b74911545ee25911afd3d78cf8d3455340aae269382e2e7a99437741ed62b920000000ceabb9ab679cbf01752d05c90338419cb8e93a58eb79de77a7b60338df3cd997400000003d9b6e30a2ca6e453923343b3979d0ee120be0b2823c9605902b889299124d5fafb655b70675ae8ae6235e418dc1a9e09cd0e28d91e5f88eb42566e349597528 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b2566c8489cc5644a84c06e8a7bbfbc2000000000200000000001066000000010000200000004e026ab18f1a641603abb04deef8508f8b1ae22e37190ba40b4d25ec28fb553b000000000e8000000002000020000000a658b167ba9de3604e788f121c4b033de449d445c8d3d1ae81080888befc1d3c90000000fffa1f7dad124536320a2228a28ba9195c7e91fbd22ee210f85e679e53c56ebc2bb0de287dc23519125ed112e9cfbf9f763061641b633661f79bad95f46fb95f7178efd03b013824af0e458538ca47a8099e8fb170e5a03e80185874075457a73994a0c464d0be1afc231f8c5429caa4eb4dcf1b4f20c31b65e1b70589081331702a56394118e8936e8164deee5217df40000000661202e8c6ff43469899e5bf8c46b7c3aab5bb83c31ed117ac316adeb013a3a87a3a146fc3c1be34845983783b88b018fd7ba442d0d809876902515d544939fb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA363801-1C89-11EF-A8CB-6EAD7206CC74} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423018174" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2092 2220 iexplore.exe 28 PID 2220 wrote to memory of 2092 2220 iexplore.exe 28 PID 2220 wrote to memory of 2092 2220 iexplore.exe 28 PID 2220 wrote to memory of 2092 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7b16f67514b8fb9cd0824eacb646f9a2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59653d131088aa52f8e9abd7379e22132
SHA1552b0a46614dae5b13760b035becc9cf2ada9905
SHA256cafe5d74c90668998f1e45b947eee8e46439f01a26cca453c04c30bfb29bc1c2
SHA512e676c2ae9d474d1f191b7dda6dad1cb853d370bb88ab7d915f9a42cbf680fc53ef223855e6a6e06693c75ec9a2da59462ea9e1666b2fd7bde23c197e0af8f267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538213776e87bbb39f6690f99558753a4
SHA158d683382e7e22fd7fac24df87b8befc61487969
SHA256b7125f785d493c0d8367b13b066fdaa6eb5a9cf79ea3617f16334720c52a3853
SHA512cdf16276a560ae11f01fe5536f00fee1641bdad822e05d0d8ccb7917e775603e6f33213bbaf2c96acde59233a6e7675106f988c56b386e28d5048694e3434814
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595bd8468fc4bbb4649d69d16e70725aa
SHA1cea840a5e14e67f37ee15318656d37f127590a7f
SHA2564e510dbbdbf4fe1cc181c58a7343aad60fcc9fb981308ad50385366df6dd70c8
SHA512895c67fc09f10bfda0c250bd083c94e2f0c20423cfc0829d90891a09a9a7368beb99e630b7048808e2beca5987a73d0afe1d653c197dddeac8d078d1847ce275
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f0e7ace3eddcf57937478ec0b7b54b7
SHA1bf0c4f21d98967b8e5f358cfd4d153938f1712f6
SHA256294130ea10149c87368815e0700c8a93cf83f151bc70cde2337d88387e018bb7
SHA512d5ff1288467ccc0f0303c9756463bcdf96c8f81ec98b890d182e6a359539abe574f0d91d3e708479f2c199a55b7c41d8407dab41bc81a67e63e1688760533b00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c2a546cd3cf89dcf34d4585a14f6611
SHA13ffebe1457790d8b5f98762b7f5591152ffe346a
SHA2561c0c5825ab9e7860204f9df232069fd0153b709c677b39f24934a229f36a2890
SHA512c8b51a422d9cbee1f42994024ee9b18253e3ee2993245d861c576fa3e61482140df1d78d2513a64bf780576d70767ed499d22d64744d449fc9e95d969782174b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597726bedf9161d33dcba42d7025d35b1
SHA1a4369a1cde5f4af9f9daf01230152539f581931e
SHA256edb418d33256f3a80ef1f030d187e75d84d09bd0a6a2c430815c5899f093525c
SHA51266418b0c4a95a4bbd76291cc044b41e3a1b609aa55410b4435e630b29507d3a325be769ca4632a0eb5f782a9aed39f5d1337a9f3c228a6e93308e5b12f4eb4db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e550fcecb56f6fca1bd84a62f5827d7e
SHA19aad484827cbacfddce3d5508d560e1bc3774366
SHA256ae3e72c557fcc01956a769f2a2581effbf28e171fd37500ef4f1c6904949f825
SHA512ce0bb7566f06e55ce104ab62fb39ce282b0dd0e2813de710304799fee4c27b79300b7741909fabefb4423feb4ff775a02aa7030a15ff4116177b686795a1d703
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dd50d42e9c5a2c01161d33ea3015beb
SHA1a4d4299194a120fac684362f4af623c18c0f0d7b
SHA256333ad569d13c5f8953f2be0f91104cf546a0a862a454c408d5dc36976ce910fb
SHA512ef8ceada48913505d8fa52776a87c2dd53035e8ff99615ae01b477830757362671ee5cf795f7a3f376675da2f4d5d1a34784f27bc1cf34035d58a6c3458f8606
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5325a0dd85810f8bf09b3b5433e6ce803
SHA1d8093046aa5780b69eba5232069cb3d8f1ea7dea
SHA256354faf651663f2df84c00d11ea1163b939667695f14049f47c7045215e87a5e5
SHA5125a7567ba65522bb7e42e238043d4f1c3b1c56a499c2a7b67c3332e7b51e09963c99a01eb5fef9bcbb511ac7a44146d941898110c6d9d4487c788ed9ccbabbd6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ba495861298ce8e9448ddcdedd40b24
SHA1776af1708bb8a1c46590e49e7302cfa0950d4a64
SHA25670b0e399e992ae55d023ca67ec732a37969884ede9adbdecd4aa347128421de3
SHA51265753e3d0fec04ae25f8445a24a963b371c1ac43f9980f9076630a3c1a26ca36657145529bafefdc8c7aa445d65bf3bb72e3c07e51c0187728a96f3a6a669d5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575be7adc201ad8a719c85e2a014f3b39
SHA1c839a984cd8ea150cf95754518872e86772e12f3
SHA256b2c225c2f0ac836a905ead8735b53c1b7d01dc1aade41f5f138b362c38b2a24d
SHA51250fad1c30026f3ace7b39327d1665cfd0dfa71fc525832afce5650974cee00957fa0fc42c2f3ab17065eb5992d70c84186e6f164b567926d1b0f8634ee1798f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db76cd4b4e4bdb295fefb9b220030563
SHA168eb8ac05b7b08e2e320320977b6a0e45ba5901a
SHA256e52570761e579bd355cd639cca37a2e36e944a3231b9a2a5c6405957fc8e8ff5
SHA512bd74c82a4ecb0f171a5d4579882e32ffef76974faaaa507cd5555a3de75a03184fb88c0f69f1319ea13a8d2d1c387bc0fe52bb42cab266f18058a4db973baa99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a25870098f8d80d67c03d3dd679f680
SHA1ca847beebdb3026aa76e1b3f62f154f2ced0b1e6
SHA256c1f585df70f0c4c2a396c0374558004abc608ede1df420f5df674cc233dfbaed
SHA5125e4191b070b90500f419c831d51a1f09ef0c0d23f9fadd6c3f00ef6ef7b9f5022b2a66c621f0841ad9b84986bfc14711bdb226c83cd8c78c79428b56224ebf32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c90c832c94a5e387c5014cd3edbe1386
SHA159295e8ddd7076c3838659393b804287d4d73889
SHA2565c434def1d8517d7be7b57121baafc35c7ab8c367feead4e78f12d7aca8e26a8
SHA5120bef0925639989e3e398460031835f24e56cc8e5144516fd30ac073750f7a06b71c6d80d3a1ffaec98833c43e1a48c8483dcd8c1f13e11db326e565d06709ef4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bd13f0a4e1bf013588de72ff915b909
SHA1e1564751f6e7d2464e1b47c4982147625e56465e
SHA25668b433e12c4da04046b7b175bff5f8ef6efbccd5e9b0d2f7f9a0ae7483e3fe50
SHA5127b3bd7512f4b2c349449c014f6ab44f64afde33a02a0f80a1dd8fa2692884d9b1822adadc65ef7968f952fe026f65428b6a69f6e6861981827cbeacf4f8ed381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6e74ce40f97bc89705c5a231da5aff6
SHA1ac1dedca94b1e31fac84a2d8d3b09f499efe4015
SHA2567a567979b77c8e2a5b8e1a604fee0ab5f43d36cd3abec8fc71a359e9cabe502f
SHA512cee3d551520f8e49bc44512421e49ce556f504baee1905cfe33e9afb64eb1d77a3610167bc839db5797d2e9301fac8e0c5b55756dcf6dec7414509afce2715a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50afa520a5747f475a4aa283334864082
SHA15a60953ff5f678245c30f6092040838f167bd337
SHA256139795fe6e7f11a8dd81ca93e1b549cbfdae33c3abd70f6242cc6802ac05c80d
SHA512db0037497402c0e57807ba458769a9eff0f6c754a6732e65e5cef0ddde49ab948b8d4316c7d910901cb64a049791f83e9bae9dde0ce77e532181571f126f918b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53429723854603a1b7434544fbdc4ab7c
SHA122640b17ee3ff57281a441a0bc51f8cf4afaa75e
SHA2566cc78ab0082f01ea9dca06f2ffb812a4bfaf5077b12ea712836bd6d6619dc2de
SHA512bbf98c7317e0e5e07193d656e8a5f9b6a5146c8189095f1b75bd611b719a7670b0c39d86e184e805077c2cfe806b0b76fc02089e284803e8373b914628dcc3ab
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a