Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 21:49
Static task
static1
Behavioral task
behavioral1
Sample
8f8c91f6a4a980435c7301ced40f0a16_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8f8c91f6a4a980435c7301ced40f0a16_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8f8c91f6a4a980435c7301ced40f0a16_JaffaCakes118.html
-
Size
4KB
-
MD5
8f8c91f6a4a980435c7301ced40f0a16
-
SHA1
56945b1b9c3f323ef2e927c38e67000ec9bd9679
-
SHA256
4a6b475e39d1ea155a9e7b9da7b27c30f3ba6576ead4005ba2c100e47ef9f711
-
SHA512
fc0ea35016002b0c18aa25e349b00c3e83d17c045281e7630f1d9bdf7a15bb931bc1e5883b2b0c04ea115e8ead8e0c7481d5c4cf10b007da72c1b30b8c430500
-
SSDEEP
96:ziERZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqhAKiEs1dtFcE:zigwV4GD8/h/KiZwQn/qSKxytFcE
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423526822" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2CEBED1-2129-11EF-AC06-EEF45767FDFF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e38ce3a7e80045bd9eda52e83ff72b00000000020000000000106600000001000020000000584eb651d8d2af7da9d411f52c78153baf6950d45cf7e1a4f9baae63356844d8000000000e80000000020000200000007e3f2c349c68538b0f81a752c169bdecf52e52d95ee190cea01eabb4ca195a9890000000b989a1f93b5daf21aa7f1cff406c9ee836fbd957761ad3fdad02530f8af708769062517fd54ee8201bb1cf968eff2118ac70241276bdd59727dcf0f90b8cf3642cf1eaa8a3a3bb9cebbe7058a5e1182bf80d09744ab00549f85c4b266b22114636049b5380ebd6e7a817225f9b31f4f48d0c8e9b68532177f6488b16f5efb81df4ce4310a50483f08df94de01601168440000000d2654fce9dec8a375dc42bb9d712d71c701dfc588bf6368ae56ba18d25110f688e550d5b6b817a98ac95ad631a5ff8ba16aa1915e4f22ace0431b4f33beb0fd1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e38ce3a7e80045bd9eda52e83ff72b000000000200000000001066000000010000200000002b7816e96a1fcc66e11d2a36e03e305b68d5b5a253318868f44ab27bae9a27b3000000000e800000000200002000000016b58d281dbffdb9a01517ca4f3fbe43d248bf5a541c3ce4b67dcfaeb6d6357520000000d72412a1b9fa94afb9fdc4093602ae4df4b8c5a1a685186924ee58a736d30d15400000003d8ef9cff4af5de9f3d76dc115172a44d0e80668226f4a318511eb8e79e23749093aa45d1d7ec291af65869c08945401db2a3b2e2165f5adea2b8e05d3fa67f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a006b636b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2872 1740 iexplore.exe 28 PID 1740 wrote to memory of 2872 1740 iexplore.exe 28 PID 1740 wrote to memory of 2872 1740 iexplore.exe 28 PID 1740 wrote to memory of 2872 1740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f8c91f6a4a980435c7301ced40f0a16_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b29c4ec6c245d80d84f6747adaa4333
SHA11e4884ed548c838752fd580b0bc1d33eed0d4500
SHA256596091dd0b5ddf0860d378f4f719b5630915697c01e394547b6d26c9fc35f863
SHA5123b1e97abed597b7c8cacbe749015a0e439ac4505d7be287bde12248eff30448da2f46c1f88b60436486f93dfdf556164ac631908abbf89165a0fcda79dfacc21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ca912bf1cec49a5a3937a217f1f0be6
SHA125fc4948664361cb7e1740a8e4752de4ec0fe6ae
SHA256a20d6457daa5a29c0cdcb7f9817feafebb010270aca3c7dee37d7f16106735c4
SHA51207a60e8a935ca961dad6b0d48b3793fe335e6ce3c200f5743b44349869bbaf79163f9a45679ac1fe891680a8bf886e3c429f70a7fa74351416c8aedb0cda67cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570df00eb8012ed9966bf3e9be2e20e12
SHA1abd6b8b1b49b9a509475f28afd8f0c13aedb4cf7
SHA256cc459c844eab75399a64f5366fb4f7d97f1ffeb919f2df34b828689de6f8b957
SHA51216e5f91c11ee8af8c343d9d4d9cd1d464e814f321fa01518b2427520b740331de8f1c23b02df7dd6c5cdbca39185e056f58865af34523edec6fdb1feeaa4e1dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537b423e7e88354a6d2bde78141c96b2c
SHA1b3e6076038a62f9d8ff60c76d400754370827836
SHA256ac86e61718d6a5800dfa1d2d414cb03cce0908a17ed8d3f9730378bbc209823b
SHA5128e989fa99140024d29ed8f0c9c2d03e6a040d19ab6e5c29a71e22f31ce80a0d9359536a94e54a94560b7311e19b629d71830459a21508eb6633615b4ef0c3b95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b2b979365788cb3feed8ec3284efe34
SHA1d227bc0fb068fef9e767ba4b1148157d874c0f06
SHA25656f811279830d98b7d0045ccc49513252ca8326d9d772a97cc6bb5454a443ef1
SHA5125f814c84629ad1471203e2829f389110501d816585b6a54c29b7712ce5dde8fee602a4ccf29b4b08f0103c8f57077c893138a1829b35c106c69d5eff8f585889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7119a946b4b622168a36c7597d5b17a
SHA1b88ee2f239c34057c0ebfd1c7baafdd0848930e0
SHA256b04e3e481b92e8f0244c782fe4b4aefd6acc72cc86bdd68a9de3bcb59854db63
SHA512ff6dba2c3090eb9a4c1b904dca779ae9b8192d7bec66b1ed0551c46c47e76a923c56ce2526f1d9b0a2894544686bc86137ba21a78e8191715d676392321bc75b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca8877f9b5f61a899d3dbb986060e2ad
SHA11bac3ebb6658191fed529607545469d2ce30ddce
SHA256c3b65667a8f06e6c5c20574dd15361593031ea5b9bbea7997ce2383f7d302590
SHA51243aea1672e6c6206c90caf9aecc314cd87759139660598fe4f242c8fdd01a4469969ee07dcb24c89c927e8a714384f37b9b8f694611c57ec3457780024e6e57e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cd59ebf857e2d1f482c79937bffb19a
SHA1618f18f983b3ff83cfc76b90341e6e645b168206
SHA256b89b5aa449ae4f7b5c9acdeda79e630d895a9c72d33adab2047eb05863c74b0e
SHA51245619e2cde8fcbf20680a1bca71f05a95a36bf32111132071ea3aee5981ad54465cb19c3b3ed8bed55e7ccc809e711f7e89fc109b2e3b81b5e934c36224dfc2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b585d143c5da70f08080c27748ead4e0
SHA12866598204a4e71fe4e5b511e32d89667c6e92a5
SHA2569d8ec93ff06302814fc96c4b31f57c2bc685028d883bf02818cf7c59b20ae48e
SHA512db054db4ce2084c380152efa64dc891dfc8466230fecacb278645deecbedd47fe8bf8d28b301f2bb16b6b37daeedda6e12fb5294e7d3102ca1791c331fad8344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56817ea21241002d0c010b6198ef803aa
SHA17c745593197349ac69cb926921f3ddffcf9a8731
SHA256a93208371cbe7bc827f779c7c6aafe9945a502eef870a68edc79129b0ba7c471
SHA51251b01fb86963c5e93935ac5f3e0fb4d6ce1d1b4c929ab9358984e87519416683389fe55a138d6ffc4cd90ba2ed2c71908faec218d553ed7650db194612540eec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f64c08cb9d0222af040e650fcfce4eae
SHA1ad136f8fe9e638bd1e687c114ae0235364ec7ec7
SHA256ccb2c889e21170cd0a0472be371c73ae720801d8592ca56f647bd0a154d69a9e
SHA512da8cd31262ca9e07e0fba5e47153729a5e3dc772883024921a966c7894b3f787b842bbbe0709dd22eb3cf39d2747fbf95d8b6cbf8a52ec299c83a17534fb4de1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5e0dd533c73139312af68510e710e29
SHA1752117a2ab75793d45ac921b8adab5f8b1bdb44c
SHA256e87f686b20c45b21defa52bab34dfb6aad101991fea22660d3681606669f0220
SHA512de164d8ec39591d86a3f7decfa6c8524c18c8419101aaac676aabe89ea44ba5b42dec1fff98968c3c0fb07fd66ad096e5b2c4fef869648366163003321961937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5778c91ea9d519c79ed1b740ff3f928d4
SHA1f2ac5a688c840a2eb684aed69473f910051e41b6
SHA256ded29447cf05d2b4d7c8915e99a9f2292f4ced8ded191390844e0ce403cc1f5d
SHA5122f40eb117d4e020d5910f2fb4c8a807fd48ed1f2428985a76c26152793b0a38216259ca63f6bc423ed9e8f37fde4903f9df19812b58ebdd9bc5f9dec92e6aae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f615c817d054b22d4a149e7505b5dba2
SHA149d2ee15f086f2fed91b7a670ecd2b54f60dda2c
SHA256ca046077d0f64a67b77e4c2488dd53aa59db27f48e46090a4944c858604dbf6c
SHA51248a77f2583b912be3c658b0434ab2e692bad9ca5fc9a4e3babe56a4f0e141fde6ff591a34eec7a5f5d0d710dec2f60308be861e48f8ddd2ca6986ef9cbd13add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a63d7d9cc3b9d994ae174b00257990c5
SHA123d4edbceb7d7ee425b5790d56ae416eec2b477f
SHA256586f2c9bd32ee879cd93ec21dee612bd0dfa7621f15966923b7152e65fb76319
SHA512dd8b8b4821038225c807028953d0f03fb6e7f4dfaeca6c06effa62b3084f3d2ba7c28179b1acd83b2861afc1e89150e093b776ffe49fe419ccbd8f8a73162060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f160082ca5cb49da9a63c0ce78fe893e
SHA1b7ac7c907b3eaa076af3cf7c44773865054bf2dc
SHA2568980ccaff9d6b2370c6808a1b80d9e1e65298804b371d70c3e5154a6c9839912
SHA512cd2fefa6f8d1808d5fd4b61592796dee58851c4ee27118e538b7e441291718fcb928880c4728197603c5671761cb1a6c55a7874cbfaf635aae550151cf7f7837
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b