Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
99e62ce744f78cec09e23d2abed1dca3_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
99e62ce744f78cec09e23d2abed1dca3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
99e62ce744f78cec09e23d2abed1dca3_JaffaCakes118.html
-
Size
101KB
-
MD5
99e62ce744f78cec09e23d2abed1dca3
-
SHA1
d56e12c1895c1fbb5432ff45ffaff0ca2876be08
-
SHA256
5ad5fe4255faaf4c4881cf00a6c980cf343c6c74792a2158f2e495eb1c5a3a28
-
SHA512
906993e14032d9af939f0e2fc27a1ade8214cbcf5149f0a5e89e74bfc437464479e416f522bc3b68ec82c131298839a4efc89cc6f1756cebdba68d9fa1b30706
-
SSDEEP
1536:r+HzrHoEBIVtgmlW1sTHdD0bUwHmE4U+ptfV:r+n2t3WwHdD0bUwHmE4U+ptfV
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26CCCF71-23B8-11EF-8B04-EAF6CDD7B231} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2248 2104 iexplore.exe 28 PID 2104 wrote to memory of 2248 2104 iexplore.exe 28 PID 2104 wrote to memory of 2248 2104 iexplore.exe 28 PID 2104 wrote to memory of 2248 2104 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99e62ce744f78cec09e23d2abed1dca3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD57a4e64606690acaf3cbfe5d20b934e3f
SHA1aa20e7bf71dd69d1afb7d4fcd789ea515dcc6ffc
SHA256dc1d1a8efb7dbfc02f39fc305f0f93085a991bf6b2d6a762e61496f908cf1845
SHA5128004f632008c2d4b514446c34f24fc6ff75652e7d9f3d129bfdd185b8d1b6ec802b8fa52043e30c8966d1389295e504ac69bb87e74ce20ea0da080bcd8ea24ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564a0a780a48bc66edb3e0d24a46c2bec
SHA1d7bf4471ef37d0e94985330b8b67a54197544da4
SHA2563bd2891e55f5419b1f965cae5c6779ce53ab60303817ca7cb2f3ef0ba497ed48
SHA512b2910f0c685fe69de7e087d76dff26422ae37bb8e7d463ad8b4599197222cc8b09c05754fb169cf770f73da1be986a1d089fa1b0a49e2c80bc1c236ad08149c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533eca6128135a77e3bd1b40a64958f93
SHA1d0ef3da593dfe2257b08364b6bc1fa71015073d1
SHA256535fb3843594e5ccb4b8122addefa38be663b543c0d8a9406ec59a84f2527041
SHA512c0404f5cfcebde7c7c79ff30db46171ec47cfc62777de66b0038a40af829696ddd0ccf0a21e6a7be0b2a0fcd4656ae6656a7c96b97480e26710ccb100dec420b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fcb5e8a710d8417d9414e75c179ae4d
SHA19597e28fe1081d6b6eb04bd165421b2a1b8db9a1
SHA256205d1e67abf26c156999b55b24e21340df3dae24d2252e69d203889a9f41724f
SHA5121750e2b78e8325b17810df3a5146797f9b0dbf019dace524ae91f57dd5f98bfac555a88323c8e3ec8fb74c9394ce85d3c24ec09b7b454b646bd1b0cb29f9dc1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52658a76fe42deb5a93f22a95a01624dd
SHA1884c0387980ca534e4e6acbb57e41c693a468b89
SHA256442b7cbf6297cba20a3d41e8c706debe06e76c00bbd3947b9aeec8f250feab98
SHA512694bc5df8bfd200f803dce94b4256e60d6ce7d3edef65b034661e2a10bd301b5b1254953c8bb7291a44d93ea43e72c0d0e9dd1edef6b112c0296bd8d55259a21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5641b11ad48e8ad7778cae117dc02f9dc
SHA1ad3e0f236e9365d37a167eff281fe1b0fe473314
SHA256125b83543acd729b6b915fe8322fbd13a418ca40b65bb2bd8f673b36c9e4dbcd
SHA512e06df8f77cf165ebe81c3b6b76369d435ee7b97da885f8236d5cfbfed3784c195a13e13669db28ac9684f366b694e31d0516ea43a8a2fe8a7b0661f1b45cc7d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4015164e40b08808825502b3d04b678
SHA18a9a43e408b0711c1aec21c7612425b6f7a05fa0
SHA256acad98284d7b21ac25a68a265aa9c47b6d4800771e1e7aa7d4835344e9f90a3a
SHA51247c76cd0c0b351aa310a5fb844eb1236050ca45440990b829c81eeaa22a313dd356ebed71880ef1b243d08cabd8e1ae1f9613d682d4eff932239bb0208954c05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b159dec71280226bc40af999e30a5e4c
SHA177804ec3e6b4e42a428d6b930d7b7d78a64780db
SHA256ae0fb5ee0fec878a0178b3342deebe39de8a1558ffa614da37c3c490ab369c8c
SHA512d106ca57915769e9de89aa70c8422fc64297a1e118cc47406f685b98fcccede192c1e9c2f2a24c3ec7d6fed754c6333bfd80d25226293c6fb1b84344bf53d63a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a33e060f6699c075843d0056c76b7623
SHA134fb760bb258c16ab1801c9cac3740419d28fbaa
SHA25692b5c17a85765ddd7753fffb1a33794243b57aa742a039e6876c8ea2006a0a2c
SHA512853120d12bc5db6d2a9c8e6ec759225d10f2e9ed8d2d170ebc4306dc3e9811fe236505f3d0e426ac9f4b14355dbe3e8919ca51b9d9e9f86497926d9c4e8aeca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547cd9e1f3216c95471e43d47c2cefc2a
SHA13a9562d1116e425cd00a6e0c44f64e43f5e98212
SHA256bff37c81874867dfe2d0335e9cfb9c96577babfd90eab56c7ab636f35541b7a2
SHA512a03417446cb3c313618fc388b1739735f72cef2652c9a4a4cc926fa594e9e9ba71ae84c8e441cb38e4f195c6f4616ba599d9d29d3fb282fe04af570284dc88db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51400d5064d02daf7268a259887cc8ce1
SHA14524351d62347d9dca34920bfca6bb2069d118ee
SHA256629c9ef33839bf9d4721180c9340ddd3b031f0416c7a77cd048ff3ab5ff44fe3
SHA5121f059cf5d5d6380f447489804d12d69f80b02580f92b0a5781a76e77509d7ad792840c89bdfabc1a5e8a553252cc331d36012bbcf986ce46e35cdf3ab3a39345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cf534c924309962f201aadd1710000d
SHA1a2e01cd0540bd268d80e7f8dd9dcb5b8a30307ee
SHA256c4ceed306db2b73560c48b7525e7f4a3f1a8e04827e3f86f53e4316a52e90de7
SHA512135d198afe0c4bac5c9204132cc058946f7fd336e826d4baf81b3ac1f7c0b17bc1256b8b8f388faea0c992f359229927e513f9b63667299de5563ffd32da7131
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58875cabaead1501de488e02805653a6d
SHA1597cec82bf868e5c130eeed2a82de6a789c8b2ba
SHA256c6eb1989ccbe8393f1a5fba37a142c0331da7f204f3e946f2cdd88c2d106105c
SHA5124bed481d00d18b593253856782d550c4dc98088021795919c7fa5f7e22afbf185febd51ea218333853b45ce87db2765b6f56ed044c358e071d8c5fbec6794e4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7a7367ce99ade7a5169a321e415c9f4
SHA1be62874fda6d642dbe437828acade044ff129d9e
SHA256108376f328479a1abc636988ed45e21dbebaaa96321613541ce46c89a82ce712
SHA512fccf07d47313f262f6b3088c14914ffac0c21a820154c5e04952c83aa382d5bc94ce2a4883006b4164e49316cc70741b5ae4b457e8047fb8594e4730aad910f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587465426cb1edc1cdb2ed5838b2fe288
SHA11ae16a019ba3de579c47926b426773cc42b0f0cd
SHA2560e482eed1374a6586a787fc7b9e5a98c3f85f5d4f6c6a87e77e21a1a82b4fed5
SHA512830fae5b3290eeeacf7a10e94a7bdd4d5a09c1b21bcb901e64dddece50c0a7fca95e9fe0466bf0d3cce8522864b31d34214c6e13bcfae74da246d64419a9b3cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8cdb2fa24d0de360734209120d68c4d
SHA1c633cbc1fbc7f7e89634a01ce6a3ae4363b41adb
SHA2565061a8f6cf472a2a8a6478dcaff10702db93a86567e47b4602a330b58efff008
SHA512b10bff313ef9990df97bedbe8e3e77c9a2379a2c278db5bf7c6173a2542e63253888616edf1b121a8c0d47a8f1150ac3227fed9ca62866280320f6b80848a4f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ad73631d703bacd7782e0ad6c892903
SHA1854c19d3976c80c75a45a2658699d5c46366d123
SHA2564a6cf9f605b34a315595ed5a5f078af43d91d7bd49e7cdb7a742473c27c8996e
SHA512a5707d7443f952596f77a4ce90d0aaf794066373024d7d5e49292ec959ae93a66c500af85a6970c108cc33034c1b4c507c92a84c9e19c6572ed7af2aab0e0dc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ccff513ac54a0dc5c9295513b24bed4
SHA1d374f4b67988e4079b144e7d083b26ec29456c89
SHA256e645910dbdbba9570bd5dfcb6a90acb2ac5cc2816d1a9245f12a2707b8b4f0f7
SHA51295b12088c2ce580fbb8f368c5ecce44a364298d57d445d427a07f448a2ad5f17b3f86bdec2add3d3e8d838b69a6c063ee4bb11df114afcf1828354ec8a75507c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eaf387cb0aebd09f70dfac4bddfff1bd
SHA1ccf37602282843a568f12e233466fe0b12a5cfb4
SHA2563f951d5baa612e5180b417fd3783f63752f444a66fc2923b93572f6636614066
SHA512b5f8da54d6528b5f82d65901bca72e8fe044b819a2771c948ed5a56544d067040d9580962a856ddd742af9f9a09b666907d1d5ceb4f5175ed0e7292b963ca343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c738bfaa81eeca357891987c76864369
SHA1aed1fbcf63924c135a8689c3b7783bec0d84f601
SHA256ed4fa060cde6c237846c6d7feb481b4c5ca1c8d57c2186cde85abd7c91b6391e
SHA512f146d6b03ff49a3b070add6930d854dd654f2e085e139f5fbe98422339a9f0325198334be5aa9450259f0c284d4f0d8a53da0c875ac9166b109ab28e02a74211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1b0f741494cfc141c92ca5454edf569
SHA10ed97814c2af9ce7bb646b7f8e9422ee92ddabd5
SHA2561d1353818c78303f88c1588286d2ce935930270446fa5d612782adcc3d069118
SHA5126c277d0791714b50410e93a9b76fd9a3abdfad985905745bd536693eab267e09ffb6cd852345cbb22ee16bb8e50ebc92379e460f7d9e121f4c22de4d04848361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD55fa78b97c75f0010eb996ceb19d34b48
SHA130356e2bcfdf2d4729af2346acf59e6db06a0790
SHA256c107c3aef22c1c83533373de9ec837ce1e6f89c13f812c9770534cdec83fd5fe
SHA512c7acace5015c789e0e5ce7ffe4ac675e43aa0e4a82a2d1150b2bcd4b687cdb284bc2f2cfddeb28bb9f28331f4d9f8efba00e1adc6d87d9b5a79215eaf4f8b58c
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
128KB
MD59cd0e33f7e8f7a47a54d6669e83fecca
SHA18a27729acd20c7406f7af338899b1fb845f15e7a
SHA256c266acde18406dd5dbe79e5b78321f33dc8ae9c46267dfa706a405a2b5d51a43
SHA51249c10df167c4fab49778b4b498f8021a294a4ff6b45d8ac8e1c365629e6ba6b40d048422216f34f3c30a0a9c2e9f702b015e673c5ca8be5336acccce4b0fea6a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b