Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
894682e51e8cd9dc2512bd284bb1c1a8_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
894682e51e8cd9dc2512bd284bb1c1a8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
894682e51e8cd9dc2512bd284bb1c1a8_JaffaCakes118.html
-
Size
23KB
-
MD5
894682e51e8cd9dc2512bd284bb1c1a8
-
SHA1
b00b440016bacb47386d509394dbb8be7a9ae313
-
SHA256
49f4a6d309e6c0926847df919a1ad891434c2cc4445de9e9d5ad25c8c839a601
-
SHA512
7441770d0fd81031fbc051fbcd210b78e8a076b398c008d086884a6df71c361f05c70cf1093956ef6961670effff4219e6990524c3f2659f49c89856bf616e49
-
SSDEEP
384:U+zIR/BP5oMhR6AKKqSL0/exwg6nPqLnSGoc9/F6Dhxl9hBds1NBKGLijM02AI7Y:RUf58DfSL02adnSLnhNadCeKo9j7gP0
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f6facb57459ddd4691738d55dc1db797000000000200000000001066000000010000200000001d35090d71221bce207847451d07657bc6858f3835a71dc529ea46439a7b7f04000000000e800000000200002000000086d6e1185de68b8b412fb7e7b25ff3d854dee4f584fb67ec51567b11c82f788b9000000045d2cf994907cde477c14ced9da5ba23f95d897882337d2b0f0c7f09c47306af9e5ab84ec262ea08b8db04dab539c17da03f08af3d2fca707449cb7e864f734151b2cf801bfaedd7260625a4d8b0f2c1236816a859c4afcc1f115a3b8ead0dbec50238af75e36876e3b55523d85e138edfe414b51fd15a60ab81527c38dfb69260a38b0cdc8e0bee58afd1d0dffe780b40000000a6941eeaa80e8aa6dd0c57a9d7ca8fb8221ad459ca8626ab6f7b897f7ae8b4d552a329fb3db690b7032b4989cffbd3ed114df5899e221b2376c73c2cbb8992b0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f6facb57459ddd4691738d55dc1db79700000000020000000000106600000001000020000000996a83e77f659ccee38137564dd6d34f8da5fedba4b9fd11f636474f61b72802000000000e8000000002000020000000a62ddf0d3052f5e2e410fc5453332b6c3d18c7d0828cc167b2c02388407664b82000000027bc04b717e1f1da1928df07a5de3cbdd8d30647acf4ea9734aebf58150e1fb64000000088bc46119745c001d6063ee5001843e31216dbb39ec90571edb1a722aacbf099a998bcb082b16c3a9401175df17eeff04ab9a2e24212f33f4ac82a50b5ec1f9a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809be36cd6b3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83E31681-1FC9-11EF-AD12-DE87C8C490F0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423375451" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 888 IEXPLORE.EXE 888 IEXPLORE.EXE 888 IEXPLORE.EXE 888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 888 1728 iexplore.exe 29 PID 1728 wrote to memory of 888 1728 iexplore.exe 29 PID 1728 wrote to memory of 888 1728 iexplore.exe 29 PID 1728 wrote to memory of 888 1728 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\894682e51e8cd9dc2512bd284bb1c1a8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bfd3f86974c7c3692bdf39c6e0a8630
SHA177062c4a4fe835d9faab69303238a71de4742231
SHA2562f136a91780be429ccf91a98f104d7473ae9b533278664699a38664628705208
SHA512787e155528e1b3e6241b9a513217dca1e69cbcf3cf867c5786d65f27ea89543aa257cd33baf0a8d6b618ef9fe05de66abe7513f6bd47f9efd74fcf2108aecb83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c40ad64047be4f0594415f2b5bedb220
SHA109b6b0cc4c89028ee2bb0c75c969e817e31786d7
SHA2561a4720e4fc73ffb3c1fd34ea3c1953c957e716d2e532de3849f062dd924ae5ef
SHA5127d9b31737811b7a06b5e417df11ddc29afce733653270a8a26734d3a3983245c1bcabe50a764a88a46bba6a1a584833d997a656345d37a19299aa684a9460469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e6147c8c0feac4868c011581f2c225d
SHA1b313a6c0a73a7c54d825335a60de4cfa25b88b41
SHA2565671549b8cf3bee96305313de1a053d72a39eaf7c0d7e5210b8778b3d8bb7178
SHA512238c13534e2c1e5fc52e42136343711fd0c7222ca9d9ce85c5ddecfe1eb043001636d94d464d3c5b10d98aa421d621e3e22a2f018166f76087bc7cfd010646db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515ed1d4d8233e28b6c88d4379125fbef
SHA11d3a5b3c3c42f6e86ccbea36186136a29ac37df4
SHA25659be47687516b64b03cb625c13da40beaef70adeb25d962ec916fcad5b8f5148
SHA5124364bba8e6985276599ef3519ee49226aedff9268b683b991128da363584cc777095b58386a61a0cdd849a6acc60b043193894f5aabd1c88391f5290154ffded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ecbe2172cbe35aafa372d3f7771f153
SHA144afed6ed813266787b96579ac767a87b616374b
SHA25630fa16da9605ae32ef77be269ceb2e706057e1b620a7a94d29f21b9b41952ec4
SHA5124076d8b53f2575d826c608b36b8a1f7f9bb918a89c06d821786dcf04f27964a203d6746aa0db6c0eabfe86a994acd58b167631fc067883f328ec8ca232164970
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505efbb0f47a76575848fd01e4be3cc12
SHA117ab2102a15dc6001231d770cd1d194587231d4d
SHA256b4022dfe93d64ff4c588ca1e1225db8331a1cad730d5417a221fc8960a44a7bb
SHA512b031ad16b1eabe37dfd61098ebab0e99ae7fe79ac70fa01fb6ac157c2169a12f186b84a029823b3b27440a8113b0b834bb2bc8826369f28d88c48d132447c3b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c126590235b4e6f02492243b39abe972
SHA1af927a7c0c472723d6b115a03d64a3c408c4f938
SHA256b68b2ee2a906456ca171f3e08fd9aecd98221e77bed41756e3b6f5488013071a
SHA512e35bf525e0abd3aee6f175227084ceafa955a0907c4f51ebd285becbb5c13bdf9b46f5ad22d8360720d0216e9872615cd4f4bdc05a2fd613514cfac68143c031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6e51bb5edbfa3bd57027f04869e545a
SHA1426cdf38b671c2c0779623859e611b4a7976ec9c
SHA25600709c562804124793d7ce0a58d558f3442739812e35a08d144a3f587d7fbcec
SHA51204741d15682678a3b630d365ec7fbbb85d0abb44307cbe6f87bd294619346960b9f81d15efd32897762eaea12a13e19f5557691eae4e84cae6ce6702d04aa2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507721c5e8b31a355ac62266c070f8fc0
SHA109e66a523d33bd1134946abebb0e0f93c74d718b
SHA2567882012cd4ad79f4736fbda439f811520bf511de27827a1e64fb768cbe0eeb23
SHA512dd1430ff2215256e6af327aa8cce0752d419e6acb1cf36a4cd6ff31d18dd626731d3f0a87edacd4d0c64debb3546e0b48068715bf5164e7f353b7914315b5c46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508d2ba502aae71d0fdbd361e5f34244d
SHA1e72261ac0a9b56114ee4517abe9da4426d8d4a03
SHA2568efbc5b9f30b9e26b5e6c34be2608a9291402691a11686e19d516bd0beea0ec6
SHA512a3899231b03e90f429f5c200416663f8c37e99e5af392580551749bd81be67be928da3f3490fc3ecd26989eebb8f2efb8013d0073a62a88dd24b72f3ebd1130a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1f7be71ccd51523181eff62847e3978
SHA14f8feac225d4782ced8bda66bd0282c4b06720b5
SHA256a1d3e4bba2ee0f68c45ad1cd8e5de4d05afbc9587f37230087f05637b80b9dc2
SHA512f350c5bef2711528aa3ef8ce735ea686d6ce53408bbde68739d43400ac96e37f14b85de94f111e2d1baf13681a47ee3110904be96b6091aef6a9b040599e6f21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5115b1c2d878d99144cc3fb9584e782c8
SHA189ce77e6a0e8eda6b291af0a2f07455a664a3960
SHA256d865aa15b904ec6bf935c3e79370041d4c52f8ca2c48de3ed6b5b3a46d6c352b
SHA5127ec5a57d62fdbc9d359ba063e3e7c071fa5607532f1d9034465dbc6fad7906a7c18dc97b39853e62883417cf0c58489c094cf2890f9820727ef5fdc45f171bf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e449870a5f69fbcdb9816976b7ed79f
SHA19c440f1d0e752847250e9935b1c7a323787721d4
SHA2567942f900684e6d3abf2504591080bd25632d9f42e4148eb8c0efae206b3112eb
SHA512a9deef1da93bdb4bf34e15675bcb4d2b1359d54eadc706d5eb53610684e82d535789369ceb1ec4f29b26b7569ce9973f0959742513992f1569a69087086d48a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed19928bb565319e7799afdde3f51d66
SHA1ad58766f9b2e6f45bad43957c5e581de73254926
SHA25663f355034a8c1e86fb0a175c77da2708feec6177e197f4848cdec6e62bf60ad5
SHA51275ac89aaf631f13bb59e4454bd06c0ce5d5367ed9c0335118ff42960ffb58eacd0a5121e24dc43cfa7292f6bd346c2fe57ec8d740bc14f9c315311faafc38cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ac3c297ed23fc93225ce020da5e5200
SHA12ec2f37d1d698a765f4843178eb5f14bf9883e56
SHA256bb91cda0bab5d86439d20abe1947e5fe10640a6d0eb2f043a8b7b21b347567af
SHA5123685b4acb807b37272793c9f40796d9df387b69af517054300d66eb6602a3a1024278df5b2e4c238aa0e2faa02c045adcdb31fd16873039cdf1afdb751253fb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d781d99b7888b5daf546bc008606d7a
SHA19745604b0b454aa51e0e15630b71a6c771399ede
SHA256ec6ea9141161eb355583f2c6901ab50abd09be09a497e2542a66ca060947e110
SHA5123c506f660ee608fbb31ce9a29eadf538e2f1bff264d64b17523c97820347015c0acb1b5d59829cc04936abaf4ee1a5d6986e5a59adf9fb6a75e2afe12f8ddcf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58012cef61ece89b11c3f16a5357cde35
SHA18cc17073ec3365abfd02250e04051a4fc506331d
SHA256f3911102ff93372052f597dc4dd4fc6f01005c4479bdbf9c066669ad989e565a
SHA5122ab8961e8c3670615d3c0128f91827bca474c5361e531603e5cac0ce6b2bc0ab471cbcf56e7334886a52f19ca85faa5a38615e34ae4f63a7b3f07f4c39d43de0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b33cabfe299598c8466d4ff935b3bf7
SHA16ae554adde6626fd45955ebc3af8cef3e50bf32b
SHA25677de101a1dedc566ab397209cca9604095135d6b56046ef8881bc4a1c46cb7df
SHA512d39726909ed3b3158446cef6dc652631768be6c1f77e162c951765eb801dc07f855fa3eb47b008ab8503a76854af51c6a22ada05679d88d86645c44f39386e47
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b