Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 15:10
Static task
static1
Behavioral task
behavioral1
Sample
b4287aaca2d694e219cbc5c1f4571f06_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b4287aaca2d694e219cbc5c1f4571f06_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b4287aaca2d694e219cbc5c1f4571f06_JaffaCakes118.html
-
Size
68KB
-
MD5
b4287aaca2d694e219cbc5c1f4571f06
-
SHA1
d7b248570f571af3b1d57e00e2a2eb54532d850d
-
SHA256
450f84bdf178decbf8b22fab4e3f3dc82b879bbec912c9cc358668f87ec309d5
-
SHA512
ba036e0e67e4b304585a1edb67c7fe99d312a8dffffd3eab81b3d22bcb300a373e6beb38cc7c68b26c7133298805922dcb3d49f1aa7b5572d5ae40a8edcc3be6
-
SSDEEP
768:JiZgcMsSZ8tN99OIsqKak8LA8cNX2XKUrXv8PoT2fQCZkoTnMdtbBnfBgN8/oygd:J5WFTzuwT6Pec0tbrga6crNnz8PJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424712527" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000014dd6e7095abc34ea85dba6977b42b8000000000020000000000106600000001000020000000d215d2731dd98cbe36d755755c11e3ca4f8cab30553d561d48fbf0976cfc08b1000000000e8000000002000020000000e9a6f81045562179f16020d8a580908155e0fab6d09f1405a6d2e08bc982a817200000004107deaba1c943e714257d63a9ccd5047bf3f5f30e0d49fbc3c6174fc4eed6d24000000010d50c8dc930f2bb6ef76768c236ec420b8f84718711b722cb68cec7afc9425d8d6ac3f6d8f9063d26cfb05cc3b30695ae743d1c8c3a368bfd008785a39c67e6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000014dd6e7095abc34ea85dba6977b42b80000000000200000000001066000000010000200000002a50818db507e768f415b6f30c318f612fb00ca43ca4ff6fedbb3ee6bd643cec000000000e8000000002000020000000fb73ff1d9b4d14b51a437eafc38b5e8ef5614cc98464c87b4ca7849412888f0790000000ea74b8da99bbf0fde009ac5b469daef832bb39fc7ef3d6adca7d83455defe5eaad5e192bcb73f52341282170d9fb682dcc7dd95f6a04de10f431d160d1ce2028fb4b4826ad841f2bff240aa23b3ceeca4fc3c0a669b905df8483a4fb9aa7daf4f386cd8477eb7110592b3a80b2b67232cc5ba9cb1298cf2d549a8d357fd1de91b8315cd9e04c97160757c9823dd597de40000000d397405861e14575de1463cadf54368602f3eadfec2c2cd0c777bef9bc61a6b38e7f8794bfb2e3ff2b535d155d76f7ffadef99650c140014f50961249b2d87a3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98894661-2BF2-11EF-9591-6A83D32C515E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509a857bffbfda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 1580 2324 iexplore.exe 28 PID 2324 wrote to memory of 1580 2324 iexplore.exe 28 PID 2324 wrote to memory of 1580 2324 iexplore.exe 28 PID 2324 wrote to memory of 1580 2324 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4287aaca2d694e219cbc5c1f4571f06_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD54c13816241485698242e710387c58844
SHA10fe46fe8879431665492c30525e35eb83c3afa5c
SHA25639e32f49b0aeaa5772fb88ad1e626da1468a43ffa328ff0853b84151a6134939
SHA51248880b5cca8e929be07d4fbb61f3b472f9505c5b8fbaa5771bce0b484423e7d75c29a65391710f451bdd4ca4707985afe06f56560fe3c7166aafa99552eb730d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d92eef2fa4a92a1c18fa794997b1c1a
SHA1d993d854cf729039dd91050090c9f8ce2f53fa9f
SHA256ccb7828abff71a51d3313060e2df43bb967a6b02d5a6fe6e2a849dc5c18e06cc
SHA512227e0c665abdd78a62144762cb7d7c0bceef02948e1fb0d73fcd31dc5c51a1c129f62e336b33eb6791e23488ff6f3daff3efdb758520a1150c7d2a9661c3595f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cb45edd696d76fc6e2a7586b983e6d6
SHA19876ff2f6b813b0a2986e04e62a83b7c1cca7db8
SHA256a71395c4134635d59017db8bb18fc1a7e2c95dc8cdfc19fb34731a1a3fc933ca
SHA5128009ac18b84d6ecfb7089fa0f1fe82066344ec5da07bb6a36cfa260edbecf595d4fb4a54f60bebc9f989c12dc6effb4792ac9861ce20856790d8eb55a37805b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3d988a0a820b96b4b138eb2553a191d
SHA1c277834ea4b30517a13b80bd7efd1f67f3d2fba3
SHA25602538468a9092d316a1687e9d5975121a502f1cb37615258af96bcdfc2606370
SHA5123ff0b63965aca8410e051ba55357f4bf3dfc53e47c3b32f09439fd4ea27e7ced8d5ecb69138364476ad510fea9652ee6e7ed805e3dd27460260e7503ede9f9fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569440632acf26c5b60d6e9b1e87e2eec
SHA1531d9f698dbac9dca63acb211db2d87cae0ebc2f
SHA256104976ab8609f8a920bf3c969f418a6768404e0d63b02f2f6a638c72415ef2fb
SHA512e442de381204fc8daf3cb3e23ada22a29896d5a8d3d46b3b67c321b3078320df7a3df01b65829eff0cc0b39b6afe5e4ba9be9a30cea3ef7c6af9bcdfe1a06339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9bb6620140f6c3fa287e524db9d722b
SHA1c7d5f08f945628cacecc20f2f43d414b00fd0cd8
SHA25628f987a4caf5f92b4c631e184965d552446208810f0fd6411d44d50fd120dd53
SHA5120b8eacba0be592a7373844b62a9c9a06a58f9009984814d5884b7132c3dca17f186d870a313a23f2877bcf1a39cc5f38e86ca1d2f5e06ed26d8c70a3b4186a8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598b6656c3103ddf7769b7dd7ed8a07a5
SHA100859073006773dd8033ccd0e443f2d212d3b519
SHA256bbcb9224bc94f812a979543c9196a94ea73bf4d1adf6eb2f0e9d54ac80bc3a3c
SHA512f88631ffcb2df74fa521932f51c7743a7612d7bffb9d77d3f2f6d9b15aae0402470ebcc970a1a286d59d6ca13ce6872f4ed8eca80219bda53b5e731b5fc95043
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea9c0e9fa89375c0b5d14745175070a5
SHA1fcd1ec6d1e8cad209fac2145d4914780961022fa
SHA25625a0b467ab868cf59c6be412e8ab1c6a18293350d53f86c08bf93f6030a43cda
SHA5128dc09312d564a98051779244932bd820e801b1952eca891faac69e96dee830572af4242288b4244191fdd068f76d2a00f7b4d1d3d1a4bdcdeb0c80021d7be641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580f37b5a95f48f6abc3b67ad352253c9
SHA151d3cd3d9961ae17d8d89c8de357bd7d5e225e0f
SHA2565f5915d0d794f7f03a936eac4931fbe59767402f316e108043bb9bf0577e29ec
SHA5129f20ffbcde2bd9f26430dd686aa68fa73acaf4288e961db3af660b35a7fb29a12ffbd4d68293fb5d4e813c62cf53f405bd521e5e6b7f9c5598604d2bd5578920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504bbbee4e057fd49d2394382ff6ed841
SHA1720b8d2ff4f5ce7912d127020c5418403ec5851a
SHA25699a63ff9f23b97529c52acca39155022c0b15bda70072c00cd9bafc2df0c481e
SHA512cc7450b153a2bfe8eedd627d8d5d668b44d77a0a25a5678e2ba80656e36515fdfae3d86d48b767eefec6d3b1ede3e3097bd9b12e3e703d648f7056eadf774b61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aa5b0650c14354c1237a48bd9305af7
SHA198d913d0d37ecbb9150a0eedeb2e1e5027a30021
SHA25663531c2a263fbaed0e284facb92fa531d52304fc5ac8aa191c70f4c8bce79093
SHA51285988b0a27fc59061efc125e23c7277a72a6da2d938c56baaa4a37270481d82d66c2f4fccd7e57739e056eeef83c079349d3fe4a7e42d21cc9cb4c01181aef5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52c471b563f4cded642295cc230930a9b
SHA1e00f37148b351789fda0c4a8d7de3d23e7eafbb9
SHA2564c311bd57b7f20105ff5ea15e40798a1f3eadef118e3c53981d3383770ddaad6
SHA512eff1a1e06a2a1848f8c84cbbb6c108d3307fd277dbebc71a9ad24ccbb2904c891056987e02cedaf88d8effd35b79a8dbe7b8d8958883d0e5f6defe6717957ed5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59f40c1029cf57ac2325dcc282a37b857
SHA1fee4f03fcd3de53af0a4f803217a43d462d9d0ff
SHA25637148df97c93b66997223aca2b98c91871a363c11e9db0e6476aa61836905600
SHA512f18e3f77070d13a01cda47f6cb11b01125a927c80920aa91e8791647de1320ad22b980bdbe30a60729ffe6a290ad29bbcf0a44ad2f011ee798e79264f4b8805e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b