Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
8ee745069fc5cc6af8786b6533a7a1a2_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8ee745069fc5cc6af8786b6533a7a1a2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8ee745069fc5cc6af8786b6533a7a1a2_JaffaCakes118.html
-
Size
60KB
-
MD5
8ee745069fc5cc6af8786b6533a7a1a2
-
SHA1
a796b9054b9bc6c6bef77a26c46b726812f1cd1f
-
SHA256
3c7c3a0ea0f6b84a342d7bd22bba255de1a08e09f3ce07f756785f6711f49e27
-
SHA512
5eeca0a290e6e62983983f883e10f36cfb50087df21b51e2a1ec7a908e9211c5588a6889d13cfcdcb3c02c9458f514b7a6f0cccda2258a95dd54e650bd51d2ea
-
SSDEEP
768:JiDgcMwUc9GeCSXuhjrAH+oTyWhCZkoTnMdtbBnfBgN8/uQcc8QFVG8sP/Ijkk5t:JtiRHPTRgec0tbrgamchNnWC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423512329" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000aa641f7b69bc580f86fcb1fb7637d750ad14017c38c415baeecda5a55c24b5b8000000000e8000000002000020000000507e4109be62689fff9446bd851a0cbdd68a30fdaa5828a14575175bd1edb28d900000004ed5bc05528f934b557b4b4ebde081493619319c5d5e41e14a7cc4d7ca1198647b9d5bf9048c3539e6c2d2fb82bb5bd7a2fa2282e9ff5d1f0057a033a5646911d8790ac896fd1352b3c26bdb52a52abb3ffb8104b56addad6982c6c628ca317e859b2612a3c51a090b1dd4b5ebe7e671b8e816d6f55ffea6ea197cd3a4bec2c9ac138091eb33aefeb515b5e42d0c16764000000086330789a7d9d360ad3b258d278ee8800f2d4522bec7da74a2b04d56e56b182441d16631f3d742e26230aa1739647dbfa90eda4b479c2900e38b441acfaf6812 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3450D3B1-2108-11EF-97A3-C6E8F1D2B27D} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a070f70a15b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000526f79e6e6551e116dd2e575961122832979854b07a3bc16bcef07ba462c3a98000000000e800000000200002000000039e79a88a8e00824bd3dc170d186d58e0c992798d53c4ae700e8584764c6203220000000445a02d213b7513926ae56f573973aafcccdaaf1c551a9c6590c3122f003068c40000000f7d34102f10fd9d644858409b0e4dd95117faab42166fb41933822fda2dfdc7c87648ce70ad97b830b1371db971cc03de76492a501b26e135039b2708758e023 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2428 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2428 iexplore.exe 2428 iexplore.exe 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE 2024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28 PID 2428 wrote to memory of 2024 2428 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ee745069fc5cc6af8786b6533a7a1a2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562e9580d4bcd15b244992e63edf3ce3a
SHA11aa07a2b9bc9bb6000caad7dbf016758c0f04e96
SHA2561609713e135a65aed2e36fabb4e102e80e21c2451aa0e909b6d6779fa17c13ea
SHA5129e79ba588edd4d668229dab42d6c7a31f8cfe84d051a9f27e100df59a1698c663bd146c117b0b2fcdb53b0133efd3885a005630f49da9a8f8b0ccf7d6088039a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fd6c3f35ebf6d752544616648c51ec8
SHA1154c2fc128f98a81e3867ee2596e9b9b8f322377
SHA256aabba693a48294c10083967b0341c88adaf5c8242739d52c36bf24be375cb717
SHA512d09decbb82ac2eac81aa1fd21ddf132cd0d7b03140f82dbac31af54070667f9e96c062271758c3baeca69aeb9524ebccd40f2e2065b2b9ecaa4bf815c940fec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fe0ee1d6b05a1c1fe72b0c553fde48a
SHA156a7116e5f33fd3a4a30a921645f419d75ae74f3
SHA2565704a5e83e99fdd2b7523bdb0ed2a8a5f6f0de3b6bd8cbdabd2ce34fd275a3bd
SHA512741bec84ffc6eeb5c224a999f01591c22fb0c403fa29cd1a36e0dabc1152df988e2e387663a9b52dde6b072f3f182224b2c88d3613c5af660105f5627965c06c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c289e7682634e3f2cbd71ccd0d2c15a
SHA1d0def6d63369219c4ca8d174a73c9a07ab98ed7d
SHA256f3b5cb35cbf5571f39390d478f702f78d4513991c127821b7718776a71feee54
SHA512eff763c7905ef7ba4a4c24b36edf0bfb66ca2cda0d16961c8000426fd81bb3edd4cf2279d5009db92ea7e12f6b61886cd51d88e965400431b1919ffa854080b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54204d47c9b2097e0e7d668c2bef53239
SHA1d6f3fdd720447a36f4f5ae3e962b91dea848c362
SHA256a507fe30c4557f33d71bed0623db135dc38aacfdabb5031df695f585d1840059
SHA51260ae6aebd44b093cc89a55feb3c184401695057a16124573768134178bd3724b262a06d17c33b2684613b1cda3180e80e096cd32a48d80e350f3a7a8048dfd80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec74c68d942931711bf2a5d5dc1ce459
SHA157206041d8f9483ba6287dc5b25c40649972cfe0
SHA25662a4c00b32c2b9ae1fde433181b6acd8308f84ba2c214e0bfc4a0ef6ed96e049
SHA512f9b499302f0644cc13a28bcafe76098fae5229d6aeea67df01c45a2a165e4632f55e949c11589cd1547eef096e0431af6ef3a8df0bed32fdd65e70261d8c1a9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568eea7496e8963a84316211e083da014
SHA1e86a01603232ac4078a7717a4269016f6203e74c
SHA25672c4f25c0957de5175abb8ab460d2709f103112f465757a9e0e0de89de6f2b4d
SHA51280f52652c0ef919980c84f6dbd7ff941f5fd40821ac411bb52d4a17116b30d4d2bd87b9ba288da16c0ce3e3bc43e2072f6811f835c6ca00379ea791e9859f99d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9e25492e1b1adf2c44a90302b621e95
SHA1152334d03c8310035b66598d86f327ea604f7f3b
SHA256cdb9bd74fcfecf3043c4ebe45365b7ed637d5c7dc1db8b0226ea437275b080f2
SHA512659118e0ddb278dd1a71a3fbc6fc1d59274a4d7b614a7412e634486a072738b116042ac4246c57046319009cd2ae0c281f8b242bb5289138b0fd8b9e11d99ee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534447e070219691760ce23f2b27531d2
SHA1bc6db8b08d715f0315159990d63394adaec90b07
SHA256e4303fb2141c5f3e5ce9cfb0f966d06ccf17762b609e462896530baafc3e9f39
SHA512eda5b6df2873c4ec0282e4b9b5e05389c0f85e3ff2e32fcc0ebaa0961ecefba5e8e325b6a4488c16a7fb607a256192e1585ee9dfbe0bcb4ad0f3c89401ff78ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e77d298c75b71f3e57e2c571a999585
SHA15bad4b579b1a598ff0eea6e4e8e3795cf759febc
SHA256a5d3a85ad6492bf8692d76397e5145dcdd53d2d27671be08595839932ab688e0
SHA51213eecb5b1552305d4af5f4f31a3fd6944d3fcab72417da5770515491c462e53d98ae6a44b599aa4c16839867f3abb8bb276e7f3cc0ec0ad86ac8ae1bbcb006b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58509a7b43b4d20c70d42ed4480fbcc56
SHA1494989967f886f705e521466dd2b86942a271dc1
SHA256e27a9409b8522ae903b39167d48bdc28cb7c88ac0814b8f909bbdd4cdd727b0f
SHA512abf637a60621fc67b96efdc45273dc573ed715faa26504e1fa3c3d7e45b76981913372f3b1c9df53c2e5e744bdbe5314fe469897e26ace96a5349324f529ebfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5951b3d003a0391a3f1fbdd520321693e
SHA135527043c5aa790f064d716482be79ea9ff8eba2
SHA2566e3a9ed15ce117ad71777f4acad9a263c2c5b5cd01300ff95ef9312dcc1a6c18
SHA512522a75efa1216e94678dc88f1e93e3236beb24136e41df734a6092fd53c3478a7e923d1bade56ec3cd4c03518144036a26b5fc13bdb99768a00e6fb7078f7cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586451704b3cb626cd0d08301ae6fccee
SHA124f712b4e95189bb979706488873ad7bad09f38f
SHA256ae0311b564102eb7fb4692d78f96c156338132a96c81aef48287619b838be682
SHA5127c3a979493e110bccd47ac5de18ebd0f03a9dc798e814589e75aa0c6c316c0318de914f8cb7e8ba13a4166dbdee22824e513625bb98e907d11eff35bbfd3288f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cce83e3e792c9a171f486689ef5977d
SHA14a979bf5817fc50d813390670e6375d3dd47830e
SHA2564bf7ce8b74b2222764f627cb640ecb0f980dceb57a6ba5bb632f2416117a0489
SHA51227edca75defe3e43049f71ed09d82bdac850c0b3651caee62148844e25123d540cb0b4e076e2e426cdde5bf510d59e2d0314fcb3eb2c370e5667d8280e43b075
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58de9a09d51bc017dc682fae9bf67319e
SHA14ac928a41e21e07ac88443ca350e1723d5a49bc7
SHA2562b81c44328e79fa2a71bbe5a50cfa340e5bfc1557d65893dc2d546bd4e27ecca
SHA5120d16626d53873c56aa834a1795e4439ab4f23b9283c0625ba53da0ea1b712a4602a127e0f2a25e28b20cd6249357cba8573451d93696dbea7a97f7b11427d064
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b