Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
841e79ffa6fadc11384e4acac4ef8629_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
841e79ffa6fadc11384e4acac4ef8629_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
841e79ffa6fadc11384e4acac4ef8629_JaffaCakes118.html
-
Size
4KB
-
MD5
841e79ffa6fadc11384e4acac4ef8629
-
SHA1
cedc1e1b9861f0e77ad387b5cf798c3f6c0c4363
-
SHA256
216700ed1add5b567af7645c5711d1fe970643272f7f736d47804724a9b9dfcc
-
SHA512
087562019224e30bde0e8c23e43b30b57dcd09c463a51a4c085957a4581d9a8e8aefbee652bc723a72eaf1bd16341d4a7d9627d9808b38de7a4a86d05f62ae88
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o6xhWd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDA
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dffb12e452fce54fb53e8c9fb036a992000000000200000000001066000000010000200000008fda17f3219226641892c5e9604d25cd51814513c0d9192dab28a353ef2915a9000000000e8000000002000020000000e195835853117071b0a46e5bfa6946b9b54f32e2856565f69f89338ce0f971cf90000000477374f7495106032ae1b26911472a1e6787f4c3d743ba3343e59876b2747be16b6a496a6fb3c1e5f7b51785e483e506d366a0b1201dec689fb0b94242a6beb32dd2e565fedea1b538bd6c6cd3dabafb7c58a08a6044b1346c0419f7b50249997e4a0878c977a0f2ca373a93de06228fd8ce717462334b254a292b501344606836d903e0933f00ced7a0fa126e0f405d4000000047e8fc9dde68e0d0ae6c4e436773884d988b0e80e5937231472c7d5181fa451857cbf0a33b0f2db10e6d849c9e9e29d4cffd4596c909af3629d53a857c35de23 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dffb12e452fce54fb53e8c9fb036a99200000000020000000000106600000001000020000000d7a4a4156622ef564086cea721e96bbe81e31e79f8fbbf42705ae1d1dd6ac751000000000e800000000200002000000008bd19345b78f2a8f52b8e92cf37c947f7d047bdf544405c4200e7de9eaedc5220000000f7d61f5eff30824a0fd23b2a760b49efe7b775bf921e978f853d759c117b39a1400000000c1ccbd7c3755f735c98f4e0d8c9aaf90b1c3d9853be3b44b2dcd5eba663a85f3ccd140cc0f5c500f8ad1059d336093c246e5f890446f94e911afee96bf899ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C8AF3D1-1E7A-11EF-A01B-4AADDC6219DF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09b180187b2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423231423" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1924 iexplore.exe 1924 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2892 1924 iexplore.exe 28 PID 1924 wrote to memory of 2892 1924 iexplore.exe 28 PID 1924 wrote to memory of 2892 1924 iexplore.exe 28 PID 1924 wrote to memory of 2892 1924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\841e79ffa6fadc11384e4acac4ef8629_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f606a544d30906ea77733c747416bb92
SHA120f8e61012351328014c81e6b9ef7ca374926384
SHA256cf5ede0a871aace59fad0c44181f28cbc423290708e3da4575de24707abf1500
SHA5123fb95295efeb4d6f04805f737c0e282fe16f2bd4186a5160074cb10b7f12d1cb8a66af606c645d5e808f35db0de18334e484f4b278eca1a256a1a70f3d21258e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b66918fc7946dbcdc7389bf81935469
SHA17d5e4fc498bc06319f1a56b9f460445233b8b064
SHA2566097fd30e07b8e657a8bf02eab364a01a54ac368aedd3a3382624a8b90589374
SHA512aee749afec93c570f2ce2679c18f8d6d5eec639f52e630be7e0dca6dd9fa79e6bc694ef7e25b1aa520625e4359a1b725886f7fd8ed5d708d36e39d61a65086b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e74bf857de5d2c8383ce66dd4bce2481
SHA1cecf2b7639c0d02d76fab3ed5948b8e21607fa3f
SHA256945ff217edb84fa9b904ff6040a2d3796112d0baa9e655b16d7f893805a76291
SHA51289e48fde7faf251fecb4b3a902d61bb2ea180ececdc1bab03ea9dfb5d0c6efb95f2e659f079de59d621b32edba2d9337d80743f75ef3338c9e9f60aafffa0fe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de24d15ab4d64419adbd3c75fe4f2b6b
SHA17a70672e880ea352b2641dd062edb9d587827d7a
SHA256a04c7afc938791c898a885145dd88c810b6f0e5068410d4567e783be866176bc
SHA512e398cab4b8aa7ea12ff6212fdc1ec7faaded13cb51544c4c167018ad9ab4ba3bdecc55016c9faaba24aa35fa35997e943b067b7ff3f1bc1d414e660cf4ee4cf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b20727910cebcff386c61bd13e4465c9
SHA10580a71d5b7a7a135177fc6fbde0b27f3e96326f
SHA2562197cdea1c571475808ae7e42dcbc4ca18e82410a9440b4c778ca8053f154236
SHA512a1c23ae615882a6f70d2505091ef4e54b30a18a3ded84aaaf397eb857e6ade50f595c89416a18d6d73b386b1f4c6fa8054c4cae6e6a590c65eeb7c388f9444ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c62c91f7c4c12ba9655e509d07f7ddb
SHA1016a06e4b768ffcf78ebce98bd8b3ef9d0d66b4a
SHA2566aba744b2c9dc42e5adf1150a0b156d38212df5fd7f30cc225239257bec0f1e2
SHA512d46994ad730a463c9b7858e92f3b660ffc6bf119b0d7a5dcd437078f00748661c2cb0a0e67679af8bf90d135e1a8a33ac866bc71b5696b0b10f29072626e763a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af1c75583c930ad0959c27e8945db816
SHA1a9ac56f626c7c6e722680ee3a4f3a42073d77482
SHA2564e2deb39f1c3a47626122f01236aa321dcccc8aa71d16615a5fdccb3540ceee5
SHA512a8b613b2e2631681e9b16aba51d016d0f12e67f604174dd1190b1cd6e6c0fbb8082801b50c8fd3f105f31055d31aaccc967f71f39a674eb4f9136c472f0af7d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550f9f35a2431423555f90c3fef8aa7bb
SHA1f9c67fea8344f11425b98572594824622028025f
SHA256f00d907504da9b4e3119c8069796dd95160df09f41cbe3cb0cbbd2511e42865e
SHA51222b5efa2aa713060bbdff613e5c8979d8a32b90ea4d46d77e312770bd1e44c18aa5e64d8e442c55808c82797a9e3db8635993c0a0dcca0adfcb512bfd0c1ccac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5816feb933f319cfc27efaabe56806450
SHA1f2e954c7cd06003c12bb7c7111c6115d355df16d
SHA25615eff337e7a7589a8b80ba67f11238c8ed4715e9b045d8128b443795c035b6a6
SHA5121f49d3a6ef4cf7fa4d8424fe7b1be4be829961faef08677674e5ab29335ad73b1e39dfa1fc5b2ec499bf0a49fa3c1baa51aeed491378deb118580bfc334338e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6c472bc89dc786ebc54aee9ef6dffae
SHA181edcec43fd279988e8bd340d69915cf51c09e3d
SHA256a660ad87e74eca5a65355a79f235fe862d73a60805fe34bb83d650f19e897161
SHA51275a3a60567b88092fa02f177f79b5a04b90a61f4fd29cf8d5b7006633ff4fb9d50392cd6dd4b40e8b0eb4a6638ff3b4cbbfb77ce8e286ca864076e6feb52ab85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589cf6c4ea7bf3d0c2f7b728df1601eb5
SHA1f5dac4990f8bf0d4ebe60f7c0240592ef3d71417
SHA25686215518ba240352dd7f213f5cc436387f35b3a7616783db1590e96af40e629c
SHA51210497458eb89f6901cedaf8f0b1ef26e39edeb13f77c5cb3abea6ea4a4ca87e9196c55c6966d46e39f7b7d255bf79c9009fd3076d55f58179bc328037a39d91c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c553ffe10be65164af80447c356ec36
SHA109b9e4912dafe441d9fdda67f3772835a8279f3c
SHA256691dde0e803ffc233c3894780e3898c1fac8cc5b7a3ac42e22bea1c79b821cea
SHA51222ae6f36382503ea36cca656dd132945d5131a8c603ee3d42b8590196d8c8e6bc115d4d2c4b93a11229420039254f75f4665edc455893e4bee16c268946d0929
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d53cf05fae940f0c2daaa0ec8de97184
SHA1100609a65a28cb8a1fa6c60171cc15d0cdc8232f
SHA2568f3be6acaa15fbc5a9488aa786a14e6a843d97a75bbd1c9e9c3d682f24d6db6e
SHA512a6212ccc8c154728643a06914b4914e38aa163edf2cd7427bf50d2b41dcbe37e40e06c990ad0b5b5ba1e08fd0f6c67951cb3bad7df34fcb34f7b5401c965ad32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505dd8f26c95925162eb465e519c2cffd
SHA1fe0f0bccdcf2d79a9318f9cd644daf80e8fc258a
SHA2569ccdc145cfa7bc617a0f6ae6332072c2ed39db85d62ef8cd0fba558e6fd19746
SHA512d26ae5e665bcc3a00f411d90c2343a39cc34be41b2a2c0ea9d86228a5d940d55a35270cb6a2a585a415c929609b61ac0b41b41331fe49c409a242cd1b9d27fcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5235be6ea6203e753f5848a93b9a448cd
SHA1d7d58a59c97764956976fea2ea2444f8da536a63
SHA2567f1efe9289c0abd76276d6633fee293e4c86c52eb91baeb6a64034270575e80c
SHA51222259d5693b25a3e9f48cbfdb6c09dbd45484c84aeff422d3ec2a502104504f6a281742767a5adbd62390ac0b9b6234a3fc3fba8114380cefb4f348745c243d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577aa98d45aa9a94c8413c9d72e1e0549
SHA1cf123fd371cf50b4c6ca55c1b8a4c8f43a7dc63e
SHA2568767693ab829dcdf23d8e1031a4692bd20795867c82b6bc8ef83878b9d247afc
SHA512c5eff3fe615712e5c1f8fb191d7b7f245f471d6c67065a5e4ea3c68407a9fbd2b28565c40c2292aeaa085a948ff7e095a3f37caa99082c4f348b517199bf7774
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59932128a4fac2cdaccf35c4f11125bae
SHA1221a29de3cf33ee0bab493c9841b09c0375625c0
SHA2565d98633a8b8411812dca5689950175f4b9c758920eee68fc2d62ae8d5e2473e0
SHA512b34ca1b8eba94d70213baa09d4d040063d1fdb867ca5240ba8839fa33c9a9f0ed4576b2211e37d5c7d9b5b20f796daa6b30cd45f727c6b45aa6eede416f0b9b4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b