Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
a27c8e27890c3f3c557890c2f1f0cd7f_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a27c8e27890c3f3c557890c2f1f0cd7f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a27c8e27890c3f3c557890c2f1f0cd7f_JaffaCakes118.html
-
Size
461KB
-
MD5
a27c8e27890c3f3c557890c2f1f0cd7f
-
SHA1
55a8a5f25c6849ec26ac828f842307b96b584261
-
SHA256
7afa7e8ef8fa1f7bdab1da3688a9353cbd647803bb250e37fb4b809bff6dd55e
-
SHA512
ef88e621b54f203c7e9e64f9454f4e6987597e80a6b42facebf6ab1dd70e0e335cfcca1e568bd2c01f041ecd7132fdf77951e60ab782505b63a0c76704d83bec
-
SSDEEP
6144:SgsMYod+X3oI+YGsMYod+X3oI+YKsMYod+X3oI+YLsMYod+X3oI+YQ:p5d+X3G5d+X3O5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91C36871-2903-11EF-8144-CE80800B5EC6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000007a359a7a497de9bc0c77e2268373c76d07a934a731ce2973c64e35f77c4b00e3000000000e8000000002000020000000cabdac16db0ea690d7d2e50fd6725f3cbf64372800c6866879f31c9f365ea1ae90000000bc6402be3a8837ec527bcd548806e4bc80de88a8c3ff0b1facc86cc0c94fef585ccd77bed09635992e9284e68105e4a05dde1a78622eb8ba1cdc32825dd9884538b93744265fcc61bcaec86094df991ad5bb6e861b440f246c313ac9fba353eaa99ef3022295300c8279b8c72096af6c756666dca981d7b252375a937f5e1d4f15ac54c005370ccacb1c3dfaa08a945c400000007aa84e4485cef761f4af91177f728379447c9e8eb14943ee107c1802de94ca72a16713a488d995c5fe715b9068ef575a6bed6c74966bcf4702fad7a812b08edc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1068aa6a10bdda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424389948" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003caf0d258246a5529cea59f856529c6a46462b04ab9146cb7c843f46430ffa1d000000000e8000000002000020000000d86fccf784aa88a9bde3b077f8cf550b13b1aa5fa441fe19e40afea40aef5c87200000003e3820e0da354a384f83eb5cca80e5153bcb65abd09128dce28227920a2a296a400000009db88a6e8c7d0a6089e593ae2dc5076375910f4d84fe295638c5fa87f8003c19ae275f39fa427c3ce0a3c16412cf4e7f85b5a3b11d41b9e985bfffd2e1a305f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1252 iexplore.exe 1252 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2632 1252 iexplore.exe 28 PID 1252 wrote to memory of 2632 1252 iexplore.exe 28 PID 1252 wrote to memory of 2632 1252 iexplore.exe 28 PID 1252 wrote to memory of 2632 1252 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a27c8e27890c3f3c557890c2f1f0cd7f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a56bd0f1ca5222c943b4e8227414917
SHA11a16540592a1767e08c97680699a77ad7974066d
SHA256e4c82d8895854cfd4af1519809b5e10ef16aca00b76fd0a33d4a125fcc055025
SHA512299e0fbd4f92117de54d5721ee4cadb019be292e54ab08ec866196b7188b3a65895ae0af8f663807ee9b22cf8f78b8010c4cd120903930e994332b2fe9fe3a34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8ac6c566165250b393122bdf246d530
SHA1ddff25e0672f9c5ca9ed367efc3f17c30d2a81a6
SHA2560ea2fa3b4a561b6e78b3d54a515db0c44d414b426598dbc0dda60538a47bc6f1
SHA512af3d51b6327c7726784b6fc03c44e45d396fefe821a059afa69d24fb58c5d85ce284f4deb06fe9fff2357d6943b7054d78c6bf9f645f8c7c5c91c53c6cb318d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597fe638a36b1739179fc56c85431a29a
SHA195e133823f55c1eaf5652243b3584ef838fc3fd6
SHA256af97fac89c5ecc058e7c83154c5470a7d566116e44fe347981e7cda48d80b315
SHA512ed15c3a4cf624aaa31ba9c3632fdbb828f33fb643da0ffdcc7fb81279cafaf5235f354ec6a164f0bef1d5387ea1a00ba6130283115838dcce2b9b09a1b50be88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51236d0c5dcbe45a8b1064da21b13919e
SHA114e6142519fd30f79fd3597f135e93c2f390f1ff
SHA256d527f23d6ab0fe581421d6f2441ede1583df9bf32577d88f8a8a4d0781832735
SHA5127f66747df6ada0f5d3ac7e036d7402e0981eeb618b675747140715abad967ee788a01ec552b4903987eb277928b6b6f5cb0ccbdc8520b11caefa3f43084be5f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a384bd4ad1539ca73e54cf4e0374e02f
SHA1897f498723cfa70cd6cf2401ec28da8ff830c3f3
SHA2563dc10dbd9267ebfa00b928206dcf068f5e3f61dbe9fddaed75486c25907fef45
SHA5123f29c759eda8a645c0b9fe6280674cb34f036006c9f3c0f44ea25a69a2e5ecf7f48eb894090bfa2718ed6c0d36d688962b41f0e0201361665089964454f6b36d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a176489de6a6db3e553917f3bf458df6
SHA18f34bac2cd2bb8e4610acc0eef0620e29b7945e3
SHA256743b626960936096f612a536a3d39b77b9e09e2e4487b1a5f8d9d99f2f2af48a
SHA5126ba21799aa03d82f2b8b6f4ead206d85309a7eb269013c2460da63a66e004488d5c17f1f1831cf9d3e31cdf0377513ab6cc29dd1b729058cd9c25caff9413d66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbf499d6c48b245ca7c386552210ac00
SHA15e8bf84b1128b4725f2c89497baf164060b1ddde
SHA2566a709edda0d397b232a8e3a02c3785dc1f0c5cbe74a77c8799a5f93aca416895
SHA51213a5a0848fe4d0ad6d5224ba765717aec738558da7f8565b575b5f105f5c67d3e042334935fea4ccac203f4281ad2dc050eaa4ccffd55385b7eda4d574eeb595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e9dc4e12950588733272d2ab5e96052
SHA1cbc81b8ab7cf469c0054ffe35676e3f4c14b67b1
SHA2560c822ba7149c25d8b9ed51f1c4c481ea2f3b1f3e44a85f85e5295d990bfef22b
SHA5120c753bd66f3f080b3a401e5f5389cfcfcf70c317e12895b9c0f79418bae64b071761084978146b832f3a74d51ba0bc26b4dab94134d1618223a5f43619b1e993
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a62fd7ebae3a32585d371a80293d9b1
SHA1df54a0eb3755124bc7f2cd64a60687059b0b9641
SHA2563c2f510664700b1bf6292f15aa15b2a665b6ad208dfc1e0cebaf55290fc1e830
SHA5122ffed7f2be9bd4c3b8f7d2aae54a27f54f12294d9d27ac8b49f8f560e6541f9aa1941464f8382a4c9bbe026fcbbbab6b773f4ed4b2c75935e4335bf0f815b9f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a2b78b044b2426732e56849e3e8a4db
SHA14eff8bceb3fbd40f78826ec62ac848919e42311f
SHA256656c9079679124477b9603f379bc795db1650835b7ed4b55e94e6ab71834a1cc
SHA512fefa1f8b58630b9cd76f0ad3cd33d29a03de590ce2ae19f8b5f8122aad0346905ce9316d4c8e0fda81a3c8e1f2a3929f3bc56c16f77592099c04e08613b8632e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad0809b964b0c6734a20f26d7aba09c1
SHA18b34600ffa71badd83dd654911e0aabf62aad953
SHA25679e73ab729a9f7806ff7c4acd64f6eb27c5c2d9d3393699b9ba6c1a5aed4806b
SHA512819f448740d0616b94667ee4d41f5b43f13479d2272a4adf5a7c43ccd15ad436b8f943c8d3a7e07dc8ea52914d2887061a3385328a9da02aa90d02ae5ad9ab0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfcbdac11bddaad25be622bf4b8866fa
SHA1c7c48a6fb7795d123abed50ffb4f017ef1021edc
SHA256f732772826f795eb52cd52c4078955073fe16755b6169b7af5a215653952df31
SHA5128b853f02d6617ec33485949076103984b7b29773b479267d5216956ae1791de1df070b0dcf2e1c90fd96c19da88fac2e0e18cadc69c62b5f8155c72f601712c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d5c9b01cfede0136f3f36941139b833
SHA189c5a63188599a72226d7e1c67b11bda2f21be26
SHA25646608f9c9add53b3892bc17548b90012d8c1e62ed8e8d22219e4b6c502c25765
SHA5120249c36a24efaa55a8e83e07601eacd294d2bc5607e7d9186feba558c511ffdebe1e8cc9d28f44f1cacd0e7b388252aae1a4032d8e76bf9ebffcce9f515a2c0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c284332619235b796117dc8b9a9c6855
SHA144ba098f3881732e757ebc3a9c1225a9e5bd4442
SHA256725ae8bdff8e9dc4fb1d9153bb008b72d38cf3c43e2068a74b9ce14a842d6adc
SHA512f3aa6385ec965b0a1f9dd0253dd7e3138cd8b47a3aa32208d91816d8e8499b7800d81c9033463079c38912cd73add957586c3eb013a0280a170637b7e9077bbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524b5db38ce453dc66feebc583176239c
SHA1b38679dd9ddb0e26f45c34deb6520ea215d475e6
SHA2561831f8e81478ce3c26a05230e17ddb9583ab3b61f7b525da6b6963c4a978faf1
SHA512cdde51a773acf30eae9778fdccd2eff09e5b995793168d01f15d5bdf2ec5262273b5f1b4f94e70d9678e64c6c50c6e07e876e29120d173314f715a528b9ba18c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df11e1c63c31ad6db7b1d4c8e404707c
SHA1b311d5f195966ec2bee757a13771b8e354ba3865
SHA2565ffa33a437fcbc2843c01997b55469486d53ba5763efb324c7fee6acafc76eb3
SHA512255bcff7bdb29af315d2ae2504bc4d38e93d1834f9387ff4488901c1beae21ddbcce2b6585b5445b11babbfb87359f24d1818cc8cb87810f6c4cfdf9690df954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1ae2cae21457094eecf76f8584818e1
SHA172341a25e5acf0373868d0759f18b3c7ad95df9d
SHA2562a5ea584652f54774ee5c93b933f5d5ef2d91d726ab6be2dfa49b0c97239d817
SHA5120e3cd0a03382e7a55a8c6372af29b35ce5050beb0ab7ee017f83414a5e48e19f9c811cf08057cd27202dbb384ebf2f2a5e10c0e72d8a8510767f669149da8bec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5441e589fd3d5074d4a04e22cc29cfda2
SHA14e5e2db44006f37ee8ae890d6293ade1de74caba
SHA2565511cdfc2525cf54451d2b05e5806ed0b2d7d993c432389af56c25f4e58683cc
SHA51283dca7ae19fd2d2f2fbac47798b8102d9cf7097a3c8dc852f6dce3a0eb06bc5cf5e824f29a6005a98b636c97f838d1f4645159f6c47a3a1f342775dc1b0330e5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b