Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
8baece72045bc903cfdcf5b1cde0482d_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8baece72045bc903cfdcf5b1cde0482d_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
8baece72045bc903cfdcf5b1cde0482d_JaffaCakes118.html
-
Size
50KB
-
MD5
8baece72045bc903cfdcf5b1cde0482d
-
SHA1
48e85929d6e210bcad79e3deb465cf761687dfeb
-
SHA256
068bafb877d58fd6cadf42d275e4ff47bbf8eabc3bce6866829f9b721641d436
-
SHA512
e30496e4517986d41f9d8b16917d5358dffc7afea7a22d8761fca70ca44b3e4d39fa7815344f4f04bd02a9b815d6dd8808ca5af37449a7f30a359f47e38dfc6e
-
SSDEEP
768:v2M4ROXvqDKt6YAtkfPa1zuRSe4ZEUUekzsI5JortiPq7/DI+oRA2RlN/:2D98PPRSe95w78zL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{622C7361-2055-11EF-970D-EE42DE2196AB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b931c4eab06fd54d9d55de4821d6e80400000000020000000000106600000001000020000000567faa45900a8f3a05197da858c7dbc572c59c549cdb0a45e94f760317c3bcc6000000000e80000000020000200000003580f4cf308b7ab1cb86fb9f41bcaaac076870214a6da28a935cc9f629b396d8200000002bb744776919435a91783bcd6bedf4b26087453f83d001c89b64762c181c7ce8400000008b57cca57f90fa4ccd64420c98774d332412e9ad805d5826cf8b02321bf96778ac9e9f24093f3552e6a5a0e3f52dbc9973f1e91141657963701017d2f0671e93 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b931c4eab06fd54d9d55de4821d6e80400000000020000000000106600000001000020000000e3f2cb95a19d11bf6a28c9d43fb24ab879eccae8f79880c5b2547e6c63ff57fe000000000e80000000020000200000009e1f4e88e836722db6edb1679c4d21d4585329724d266105458acc690c68ba469000000051f919beb4165c205be6f2ef73159231b48c332c548b1cfedf3e06170fa7a449a881d04f0764fc078d164705d4ab6a2f5dc5877a5dc20d771291f6271061899acc7c99456526abf71954818c504f68439cea70ad7ad324521ff4be601b84a65a3fe84b3263e9364413c4bdcca7ae12aaf2492b8f25de502f42e883b9cedc03f1ee11994e9d1cb54e1f5a7f2e7dae62ba400000001c9918771bf76be0e4ae336a209c9a7e55f3417ac05eca57c3a4c45099a1d9311ed0c013b50949e4c94f5be4bae690c6b49557db9a81e636600abbb0fc790ae5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423435524" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2091b63662b4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 3044 2100 iexplore.exe 28 PID 2100 wrote to memory of 3044 2100 iexplore.exe 28 PID 2100 wrote to memory of 3044 2100 iexplore.exe 28 PID 2100 wrote to memory of 3044 2100 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8baece72045bc903cfdcf5b1cde0482d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b41784eace3425d5b7ea22a0b0c702e0
SHA16191b34b4169ebe116b708b679bd58ed0255cbb8
SHA25629c633d4d71b4c0cf6f9f3a9ea02c1e019e49532a9ec43c0d7a3356702ace191
SHA5126ef51ac475b358c138ee04a723775f8211068abe9afb304e32fdd6a3a99b455fc01585dad0bf005ce12a1dca713e36f4e6e074bde33055706f110733fd35464c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e69be5d92a99f683b65778bdd0c74db3
SHA19fb03d6bda62952a3838967732589ca6b8222a50
SHA25674d4d98db4cc83112925966ec71b544725544403fda568253c5556a799b488a9
SHA512cb41c6a95a7487ea41dc2354c5215152853eba6e366f390583f902e9ef9cc6e679cca536970cc59d6fdb3aa178c0e202ebaa05b58f2a1b803dfb42598fd9667f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5815382b5137026229f8eae0509265b10
SHA1f108568fdfe1a904798e4b563454578e9eeabc3e
SHA25665dd61d17efe343c52beb5ae60384830c91457a78b58624552d480e640a0979c
SHA5120bb90d5ec76791d0707e66002a96b8a85abd6bca888b6063ec28ebf62df3c84ea744394421b3ada5e30e09c0a75d2ba3c9fb0174c22755c36613ab4feb228725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5baa99a9a4fc6f75d72e5333d69602eeb
SHA1ad2a7cd863b61fb45557cf26eb7a079b33604894
SHA256c742d312c22deaa6270ecc046ffcbc6c69ff4b4d1d02f11428871609b52ee5f0
SHA512cb4f5731250fd2bcb4fea6cffcce43f4f814afccee28de5e4a3c58ff129ce66af717ddb126531bb62065c88f74c7f43c74c8284bb652322f693c42ccdfb74131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59db7ed58dee55c201edaa4a5f4fa46b0
SHA1cc166df0ade728e9bd540eacabd7f2da87f88bfd
SHA2569a098baf0e4851f67b9a15815e30566c4129e81ee45660139012118b9e20fad2
SHA5122d367c76ad4eb35aab73c8ca1b2727026289d08843bca27bb71fe08f4680aa6bf1e574123211eca40cdf3f5504f9172b32ff93cc56aea5c84f50733eaf3ff22a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd9087400cb6c3cfb7754b3d492ae469
SHA1aab4a3d1f1288d95006b04abf2075c3496339d1b
SHA2560849ddce8a01812b25d1d502dfee22ba8337696515523bcb58441e8bf1e5d4a7
SHA5126b98941a1d22f6071671d3acf4ec4230b0dac4fcd9bc540043a8338b1469b9b6385640561ba6bb8374e7d929090ece47b80908cd2804ce2b996a88aa92380242
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5566863dd8db660495be6ea91e131bca1
SHA1b7cde84d7f8ccc706ebd3c72d2941a4d0e4137eb
SHA25633cacd73a04717d1c4effc443663f3892237c2076805c4a4995f08049942b59a
SHA512e4300f2c7de13861f2ffb4e9fb0b9bf80fd2f8b89db93648bbb02b0e622d39d679586f41eccbac1f53bd14885b1f842bf6542a5e1bd13da6682f7f7b6e2f25fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509fe428e4e16c7e51a023917cfcb3132
SHA1bb8edcad6597939c18c3993aff4018a00dd25ca6
SHA2569235d4c678d008df14e1c23d031e72a1f6d19f4c2eec4e39704fce2e75d3609e
SHA512f0bd649062e9aba7106acdedee25722f6bfb01bb84ad96fc41ba30a491438228489867bfe7b8c3eb250dcc1d0e3e058977ec09c42cf14dc95c92921c5ef7da2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542370e10588b1873a6e3133214f999a6
SHA1f033322722c841bced18f2c1489898ae05e3ac8c
SHA2563ea37e6afc6aaae06be395ef622ce0b134587f8281ea1c111865037ec8b6960c
SHA51225f909c3cba71cfda1d01aa9f83c2dd3f86770e19535fd474bfd4dd2326a63d0d1ae8f6357a6d6ed78b337f9fa5f2bf80d7ab4fa230374d0e71a10e30b2831e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3dc37bca166351b26659b361ab43546
SHA14057108d7e1a7999822d08a100d69b96f61c8c35
SHA256c5e5b7a4d85f60fc8eda3782875d52d7102bda657159748a0d961d8c43e45c28
SHA512fe74c6be6116e1f86570be2ff4027c68cf19e43aa1abe8ff1bfbb746bb99cd39ceaeb07262164365a70356f5147b59fa09b8c8c7f0f887a1fb3e4a5ed37396ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d5a393b5374df9a8071f59c045c5d6f
SHA172200d0041eaa5a5830e15cfc256bd4803b5de1d
SHA2565e7db0f0bf52b0b20c8fa1b5e0c3dd4de3ea750a561a0b284b7aeb7f8facaa77
SHA512190221eaff5d79b10e0708bfed5ad305a2bbaf0bbc5aeac13ada2553ffe3ac478de1aa865223424f0326193d99861a5c5a5ab15f5702f87fa7499209af965039
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb6d1191f4c0242dc9b94b449b5922cf
SHA1defa4a135d2c704faf61509a2c93ff86d56cf190
SHA256529f57f71a12a1fb8614d8a841b3ab6a8ef44eeaeb73aaa40efe01d74be4328f
SHA512bee316f3c0651d31825a6bd4d377784154f2f984f675d110e9007b3258d9a531c30db28cbf84fa5200e752faae45975230c52e3c13ca68eb10ec644326c4814b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533b510eaea3a9cb87943ff24e7688334
SHA182145d79f8bfccfee20f0138005600a324a2e1bc
SHA25681dcc7af6b68cff2d78b8c071e565470c8cd361d27efd20adf5ae04f625664d7
SHA512a94f9acfe80f83a3a80e0e549f79834058b75dd1e5d9cf4daa2eda29786b8e8f47685375b080c632e82fe40b7f9fb86e5042d9f276c8ee88ac514c5077a2d5c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b94a1cfc98bed08eb6b6fe9c3ab08859
SHA1aa9ec94fe2db4eff898cc2a7c66f634f0ac90b4e
SHA2567e4aeba302fbfb447aa598382358c5b159dab4079060873ce764696522b5fbed
SHA51298d628ab1658f8d4b65953f98af6fe2ab766b0fd8ee294bdd670ea1147ee45b99a9dd03e213d5515e61d9454b3087fa1183dca219e92f2075ea7df382989e7db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52912def00c8acb8547bb5e634122fa36
SHA1309498579e5a2a789419dca02ab43a0a26b59346
SHA2561440fb0c68872a7728eb8ec6e92c8f289223bdb7f817836b512d8390694db34c
SHA512010865825753f0b3deacd3413e0778d2ad70c854a2ca10acdf0d491b26402b2a857ba3add19d85d7ad329875ab5321452ca218283e7fab6acdbfd7e3a5519dc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3cc7d114991721a45e0abc2ec5cea35
SHA159f069450a73c38fc1b694b7bbcc4993f4e43a90
SHA256954a15c2d3e310fc9b225b45f354caaf601a0160d51ac321c06bb1563d203b54
SHA512310402b9704c2d1d23ae6e1285825cad064531ad3ad44b14fbf0a89bd4a718112a0f287f6fa60adce4716ae7c06ed44baf0869a6a942d01476ed347c0974a032
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c34344cb0832bda4aa773a4dc28e47a
SHA102c3745a71590c1df1d7c82e2b7eaee604fe8664
SHA256126d62dda068b063519a0efb66eec13d777fe634ccf74dc79f8cec799794b5ba
SHA512a95718075a885e73b32ad91215a481fadc17779af9fc99a37833ef7d21767a933540d1b8eb62a894d19d9eb73c943dcc04bc8c3414810aee3842b53c4f114aff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b597b1f68e92ed31b2273962c6509ff
SHA1b1b033a6eba6576acf9b92db7a2049a2711934d6
SHA2564773a7c3483be5cc725fd13ea08e880ce93b299ca912637fec930aa19701f324
SHA512f4f5d948825af78024d00717f75b154038f25c8d8616b7af4b7eba9ac0492658a71ba6120c1cd02bcbd938cf31a48fed89b67092e23e468ce8754106f1df60f4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b