Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
984d9bd1f9b02a71da9720d01aa0a0bd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
984d9bd1f9b02a71da9720d01aa0a0bd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
984d9bd1f9b02a71da9720d01aa0a0bd_JaffaCakes118.html
-
Size
66KB
-
MD5
984d9bd1f9b02a71da9720d01aa0a0bd
-
SHA1
731cef70104e534fa250739bec9573c447b04c40
-
SHA256
6b77010cff910cda95df774f82c1324126f4a82f3ae9066b3bdff86364164ecf
-
SHA512
51af0a24a4590eed3f2f4b1c841f9b94c615ce09419858e066ada1ab4024658d00a981446b86aba33539a710593caf36e947ebc3b570b622061e5dd752f119bf
-
SSDEEP
1536:3nzMpjFqryJw4UesOyYN+PMeD+Y6q6XBtrW:3zMpjFquJFyY5Y16XBtq
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9526401-2341-11EF-83C2-E25BC60B6402} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2524 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2524 iexplore.exe 2524 iexplore.exe 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2624 2524 iexplore.exe 28 PID 2524 wrote to memory of 2624 2524 iexplore.exe 28 PID 2524 wrote to memory of 2624 2524 iexplore.exe 28 PID 2524 wrote to memory of 2624 2524 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\984d9bd1f9b02a71da9720d01aa0a0bd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD57357fa5c905c3d2772e5e992523203bb
SHA17fe955c95b9a93bbabb4aae0c81ad201b3e09130
SHA25653c909e9d2a2cd0414ab8d6552c28fb6a2e1e425f38dbd11307aff4c8ed1c04e
SHA512c7303f7be59538b6f26143da757d50f35c5ab973f401fec8ac4d1a9d9e3d30116c0b155674c9e84b41fb14e7adea88a52c8675c9c79e9e840828a35320143760
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1
Filesize472B
MD5d3042a35046bb4d63a48bf05f5b2fc06
SHA1f42bf93ec69e6c2aeddb14c6dc1b763f5856f5e6
SHA2564decccc6335581b2e49eadba96af85bc37e3e1a71f39108bc2d5aadf5812c3cf
SHA5128c05f88aba6f5c141da88b47fcc1aeb90582d92f63d2c1a9582710dd967684518c3303386ed31978686db416691384b736081fdc482a530c2204f08795f54d0c
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5ba7eb2fb5882a5e171cf2093ff83d7c1
SHA1a916b379567206510684327085eef485ce8384d8
SHA256a58071a2fbc7f3f781dbc748fd39022c9142c9e9b5c0120a327a4f5ddaf8f271
SHA51258f2cc5baa525b8f5386e941159172e1b5f76bbdcaef06bd92243f0e83e59ce893710d01ac3f13ffc45df5a5126bc8229354e22c8f06229a6db2d0f7670233f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD522ce3c5bbab92c1b59eeaf243cfa5d51
SHA19814b5ae889eaac949fe786b7f00dbf325b2ee39
SHA256cb831ca822fb883355f5de459acc0c00c8668f8a87f6e587545bbdec71161550
SHA5128bfb4bd60a41987e4724cb31b0ad421261c278a2934da95ffadac3dd9583ef0a8cf27920af25028ba2c640ba6d73dd4ef530a35de600d0021379f1bb6a4b87bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5bcf9557b69f004af013ee4addead8d26
SHA19bc8e703593d5406aaa43be13f3b5a42128396cd
SHA256b4153f872346fb2e8f15feaac2066b2e263d299fbd353edb4993f1828493ad5f
SHA512e20894faa519bcdd2c4bc84f3b011b3eff4798ef073ffe73fcb44f8a4bd26efd1f34652f2bb0faf72092f5b49b31cdfd3dcfdaa69d84321fef71a73fd966c62d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58255e1ef0ffe5756e1a6f85bf23b9f48
SHA1d558e6e0ee501a787d1802493fc3b041f9addd25
SHA256683e18fe9f9d866119b0a28ee2b27f613f6736f8e7aa3495ede24c1a38664a36
SHA512bac3838ede4ecd15cf89e006e247bc4207286b0d4073d5d6f31b27880885acd779969a0190019c380e3709247f4db63616401e4ff299f3173de4a9fb807cc54a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f830735c62b8fe68a460e4c0d1426bdc
SHA1bda6e0da32176be36318625b5d8605dece8a2cf6
SHA25670749ebb2788d80d593ad70ce2550a27c2af1e6c8ad33a40553e820fb12ee1b1
SHA51259fdc8134f65ca080e723f20edfd36d739ead6ac3fdf25374beee2d51c61334255288743aaabce8fc2ba3b0cd4d507a705316ce44f6018a8c50e6c8bc989ae13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d9216564675f2e8899fd6b81328b390
SHA1e36b32c79ae8c4f6a038da11c7ea76b05d881924
SHA25651a01d17fdda1e89bbd09294d69437dc92c55b16f499439fd9dfb9f21c3c3653
SHA5122ef871bf35a32f337fa46e6ab9dbb2bd49fb9be8c00ddce5c56e5aacf84b764bc9510ef1ef6193ce114376aee6b4e45c2ccea70595982627e7628bce5e9e4c87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d379c502a55102bcd5987ffffde101f1
SHA1baa8c9c2454b617b69d4765c2efa5071e6c2ca72
SHA25606885b83c67f5137cc4f67aa8f93b34a015bb73143ebf697399ce58b2148e837
SHA5125e0e6de1ae99930a6440f6e217c24021ad00a504969b5c8e6f99e9fabeb3256fdba08d9af85c8cbb46a662d91881cb691c5555af79536167341719e2ff3a4cf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537ead00755fde7fc83d2cd02f4bb041b
SHA169af3fa5b75680bf005eae7d88e19b0137653458
SHA256620c1648b1bf3bc5db0f077be37cf7639ff4288bfb1b90da5f55d89f6d64f55a
SHA512a096591a2876824cf764cde18d4bb43dfc93e8d521a62cca5be4d2f723be3dab1eee1c340a39c006f75d67fe83e0df49aea7900ef33c48cba9255454701bdae2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e7bd3b51d7ae510e5f59485258211f6
SHA130f1fadbca8c2154b758dbbd73f50e84a88f2cb1
SHA25613a9a5410cad8a01b59e6bee8ae2c0d9bfc112f59d5643539e9182e9fd2f8017
SHA512c98e4cb52398d45cc78efe79de8d5b124eed9fee69b25ccd821386c781c599774fe0881386ae733594fabc8e1433c7d062ae3cbb68da24fa0c97a1d5803de511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501fcd48f769ec79e9b38ecaaf3105d26
SHA1a585fd75229bdec71dd9cb249ef7aecc21d20f6d
SHA2568280f1e340bcb984a6fc5462c2e3c278d3351c299caa1fdaa3f69d3e8bd3a686
SHA512712de6e1f79b7bd09386c633d8ba62d27a32a7d2cf930c07b14d2269e47279d6468c9e9f38644e2ba3594a9c67292b1a7ea9523eec794cfa2ebd84611d6dbbb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d7bbd8769361e8505af2cfba07f55b7
SHA11b7168346f02aeca65c3eeb0ec52260758fac57c
SHA25650f31cbc6cabe13d4811dc7247178af2389b2386fff1d0b85d7d424aa039c0b3
SHA5123255ca8b60a40c320bb481b82fa2d6c9a21a288b463f1f7aaf9ac1838428b1d1ddf7ed1790a2168841f304d752760082d45d64677ac8087a2768f474f40b428d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5d53667440e2c363adc2eb0993924b29d
SHA15fd08fed6e2ad8386a23ec21220380644d945dcd
SHA2568eb0bf98a45babf0cd19a51e81229765c24c33437962a3e9b6aaa73d5fdd78bd
SHA512126e635f48a1973e9401f625662fb6d300602a5fc7c84cfa6d17374c567edda39f9e4dc69b0e9ac648dbaf199ef76f083b3de804402645a2684c4747a6ef2931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD534beda17b8451115efba17fd30e1b4af
SHA11c527e4233f0e08ff6ace3bd5750e3a262c33e73
SHA25642b4adea4e3ef12b16eacbff2db5ad3a88991efafb2eebc7e460b7cd367056d4
SHA5121b6d259d0d508dab5de5ee19ff058ee1ad91c9736d8a6e65840e5a53560b3c8bd1b8d5cadc0777aee7d26d165e75cec7d5ef0b412a7ee3f272e1d7b645053c20
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\3604799710-postmessagerelay[1].js
Filesize11KB
MD540aaadf2a7451d276b940cddefb2d0ed
SHA1b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA2564b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA5126f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\cb=gapi[2].js
Filesize134KB
MD5f9255a0dec7524a9a3e867a9f878a68b
SHA1813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\plusone[1].js
Filesize54KB
MD553e032294d7b74dc7c3e47b03a045d1a
SHA1f462da8a8f40b78d570a665668ba8d1a834960c2
SHA2568076b082eadf0cab4a8823dbd7628a0b44f174c17b3221221c0e31e7c60307a2
SHA512fe263fe86aea2ba1b86d86305650cdeee45cd1f7b4339f9d4fb81db776b78abedccd0ae77262f45d579751daa26f81385354b3d126fdb5577036e9dd1db33276
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\rpc_shindig_random[1].js
Filesize14KB
MD56a90a8e611705b6e5953757cc549ce8c
SHA13e7416db7afe4cfdf3980daba308df560b4bede6
SHA25651fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06