Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
7db5e40968e214bc50bf6d1f713f77d1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7db5e40968e214bc50bf6d1f713f77d1_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7db5e40968e214bc50bf6d1f713f77d1_JaffaCakes118.html
-
Size
2KB
-
MD5
7db5e40968e214bc50bf6d1f713f77d1
-
SHA1
8be2f0c53ff679578651d5052c74f7cedf002949
-
SHA256
a3fdf48b70c3f671a4497cd33e3859f250445d6b65e615360766fe0398e59914
-
SHA512
0a370a0568186c99dc131bb9772a1571b63a6f6167dd2470609153b62ad290710383e9ee06f6d1f29b5bff568ca24042c03cc32544f50a5ba052f186f4b86d05
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000237b5f72b8191f4baf7c1c50f9e23737000000000200000000001066000000010000200000000976ec19907919ed29fe0a69b46c610eeb3d051824ddd37069474f93c3803e73000000000e8000000002000020000000bb7d64f18bf3f48f8bd0b69fb3dbf2d4e849752707990541f712fe3ac57b23542000000031f73c110ca35e68e77f95963546cd774cfb0b4535e108f92aa9ef9fea0867cb40000000191c769b364f5c7e769981c76b6305736c7750877a03b56478e71941d670faf66b744448429eda4cea73c471cdafc27fb30a1f4b74ce13d0d3d9dd34c78b1ae4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000237b5f72b8191f4baf7c1c50f9e2373700000000020000000000106600000001000020000000cb3da736fa18ddcb5f2a6c6a556d2bfde78abe8fbd476bb18dc9fa14d8a71b51000000000e8000000002000020000000abfe794880e5ea19bccc7c2522507e507af9a59e6bea2c4557654941ca3d80ee900000005633f970413d6a1248c5ad6ce6320680320d46085c1fd684e7f65a91114bfb0f77c7009a29422a5b1b5a3aed0cfe1a8df1451a1200024d36153657e394f96d6f76eb6800297159d865063b1a3eed6497df16abe15475cd4f3af11e9ac1091ffb5d880d17228b848a71ddd2afdd00f4dbcde4acfb3df08fdb532e203c2d57a02370d110c59f9ab4051d434d5387e473764000000074b7cf2bec4aefb2e3e2085b1d6c75cc6b369e1efe14c11619fffe954e923c6a582a8ec20f26fd1dfed95b9d42f79f5222057668cc0ef6ff3a135c2f2ca98f24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423077639" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0688ef220b1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E1060E1-1D14-11EF-92E0-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 868 iexplore.exe 868 iexplore.exe 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 868 wrote to memory of 2012 868 iexplore.exe 28 PID 868 wrote to memory of 2012 868 iexplore.exe 28 PID 868 wrote to memory of 2012 868 iexplore.exe 28 PID 868 wrote to memory of 2012 868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7db5e40968e214bc50bf6d1f713f77d1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5095f9f8033d6cf16fa8425d57cf1e5
SHA16e6e2c6c086135e83f7a74e9a325c144bb768acf
SHA256f88db493171f759f64edee9593ab2961c627e4c3b34628765c7b356687f2a880
SHA51240188d480c4449abe66c49b8aba854b4f71b9e519afa8e27de8fd29bb33974a3bc53a917cf00b29aa0076be58caf1cb2381d8d5ca9c6c38eb5780c45541c89ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d68205ed9111500744e5263f5cf755c
SHA1c1d673348c3352e72dff6b889210dc16552cefa8
SHA256e59aad5cfea3ab475f3e6a2263cd3f58c37467b8d1cefe580c94eee186e0c8c7
SHA51232cb095f7d5c74f5ce66fc98b97d9eaedab9db7ecbab5858eb61d3d61798093c936aaf40cbc20000a3cdeaa4f22996767ddbd7070b474456164a17da95f8b3ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5945725b2d0212d0b7273552ddfb208f8
SHA1b02e0fbc9ebdc2946b2d6a298adb42305915ecf1
SHA2564d8b7749e5e1d7a0622ddd94907bb930dc6baef07dc9114df698041f9bd1f4a1
SHA512a14dafb99b9cec97d64e547520260a05921e922f773859e1f5e50d83996220b2085cee72fbaea4f4308ea69c6dde79a9c4ef5e01ea9a458241eb6dfaa9b0bcd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556b27d8801230716c929d03b8df3b875
SHA1f5fd27b92f5743cccb06fc1e339f4005807573b4
SHA25631567cc8d03ab00fbbf35e728ee5fed9b04ac210462d2d7707bd1f5cc2c352b7
SHA512a4a2795756f5901937ff968077fb53263f460153770e1dddadde77897ba714e57779a3c99449e850dcc227515f06f5a0c497c6f992edaa9950c02f5820575a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548c0203d77b2e6d23a3ae86398da2882
SHA105c85d45f64466f8d3ad0df2a77eff05052f9aab
SHA256dde04e14c74debc462175277444e3bd5fcee508530ef7e3064df32dd8d726446
SHA512ced9cf203babfbe4784f939e33540c7f0961319c21e7fc5e6997cd09ff9ab0fdc74d04ebbeb59582aba95c9f34315838b4106ede12dede58ca397a10fb1955ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573f9ff3120c771c3163262c596f8b0b5
SHA1bdad07052ff88521d50b904139e4cba7fd119bf6
SHA2565dddf034bc5096acc1dff8eed7c06ac8d58aa48da9dfcce35cc88c4eb38a80a1
SHA512482adfb7eabfb40952f006d4e138b443d3806b6a73767862583fcd12ea5b7ba6158c616848b0eed1a3651ce648b0cc32c6e7cfb3a278dc6add259b380e03588c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57106f49e860b78d71447df3fc5313334
SHA12c4eeaa157e2295ee390d2f224a9116e5cd594ed
SHA256ca64962e7a2492778cdf1fd18603b6f2d40ca17e86048c823cbd2af72ff9be4a
SHA5129c2798e07c4018f94f4e45812a8d97acb4bd99191a6341c766f217a37724349c72e58bb0716c767fc1cc8a553ec9777213b1c7c62f19073978cb1a1135986692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dc7110b1170d9215ca4f91b35ffdd68
SHA196e6dfeb63423f4e9770c68477d8b9854186f69f
SHA256cab18ae30ca9d9afb629a39bc69160945cd1c4832e35935f943b5c74217b24b9
SHA5128b59d21654566d6fe5be0a095a9b0a8007c93c960329dc9934632b71045f5a8c0ee1f9ea650c22fa3730e3c84195519b7d199f75250c333d9605cf9070f45ed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc33c818d2fa30e79731ffcbde6bf36d
SHA19c121d23368bc452021bad13a2346924af733a2e
SHA256e6a60809a3cf593961c270ad6c195e47c1503112f475c79359e047d6a94d9d9d
SHA51227206d68a24dbff5d2fddc4c9d6c0f93982f55dd66ccde4adc441d04b3ec597f2911462da0a84dbddca9bbfd7a8f8a457e933879b0f4013eb3a19118630b1219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544933d49e6413d8e07d81a917f559158
SHA1ac6d99086198fa7bbeb603fe444732a0e5310fbd
SHA2562163fd77e3e799856d2a22e8c5d923678d85f49fd833f879a910356bf0996c8e
SHA512c1540647ed775e890b4fbb444f5c4f6d1eae77b2959b1bc352f16ce1fdc5729ce554eb2a75cf1d5162baf551d49b2b5c5080c010bac585924962cc9aaa8e88ce
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a