Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe
-
Size
46KB
-
MD5
05ee8e353312c1567d551a400d2d9c1e
-
SHA1
539be79745a708ea59733684f1278a1b3a3361d6
-
SHA256
176fae2a1644bbee4712e57e780b1565f41f78022f87ec538764cf603f0904c1
-
SHA512
79211824c65a002ada9f29d0fafbb590df8867f6f8062467a1a7db0a35f25b6566152d95250729d005188463bedb7fc52bba62ccccc941ed6c78be4c2a6d09d5
-
SSDEEP
768:nJ2IUDRgwxMcl1UQof8LEB7uFUsybEk+6chKkWFX8xC4X:nr8gwxMcGkIg4EkYhKJsxx
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41072-b2b1-21c1-b5c1-0305f4155515} 05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2bf41072-b2b1-21c1-b5c1-0305f4155515}\StubPath = "c:\\temp\\install.pif" 05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8025DD31-2EFF-11EF-8875-5E4DB530A215} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425047905" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1540 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1540 IEXPLORE.EXE 1540 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1540 2056 05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe 28 PID 2056 wrote to memory of 1540 2056 05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe 28 PID 2056 wrote to memory of 1540 2056 05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe 28 PID 2056 wrote to memory of 1540 2056 05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe 28 PID 1540 wrote to memory of 2984 1540 IEXPLORE.EXE 29 PID 1540 wrote to memory of 2984 1540 IEXPLORE.EXE 29 PID 1540 wrote to memory of 2984 1540 IEXPLORE.EXE 29 PID 1540 wrote to memory of 2984 1540 IEXPLORE.EXE 29 PID 2056 wrote to memory of 1540 2056 05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05ee8e353312c1567d551a400d2d9c1e_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5079615f7a7e64838faeedd5945817314
SHA1a0004969d61aa004cc961f075fa2b6c8ceaa39b3
SHA256243b3ac1bf26d5a94b39e0d50d3ef03021c942625dd936860500521950797ab6
SHA512e6b62a90ec2e58e6c9deee0087416b816699b6262feed096741ecdbe1d3e8b68230679fe2851237605823306326c6c47479e14dfc3ca73a6b78ca320c3c7055b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac22d59cd264ff6f1563260c727c3cb4
SHA1cd3522bc5f29003343385fbee1ca0fc80313833e
SHA256f9a00f25f0a44114baf7d4422b41dfd792d2f1ddf89b593098873ed67f03bcf2
SHA512d0ef55ab1c0241a90a50518266125d9cdb4bcd87a79961d7a3869a3efb4523ace70c10e6a5978eff8a5379219011741d753661a10552ebbb31de1158b0c6baa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffd236cff54159ebdcade4a0075eb7f5
SHA1d90c314689c61935afdadf7ecf7e9d632c655ba3
SHA2567a43de59630b54d0ae6f12130009e1bbe4c8b853f50b4e86630adfa5608b774a
SHA5122725f9b349f8d5770f21fa9157caa1a888d3cf1b377ddb2fc3cc9315c4dc047eceba756eb687cf9a7351a73033fe51ac93edd1becc59291a3431a7152a5a1c99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a0991a9e5f1e2e299eef80be6f581fd
SHA1c6b5458fe9df4949dae76e43effb034a30f2b4fa
SHA256ca0423a604b28bc94d8a407fe20e5c402692a84a732203ba5f62dfad7bdd866e
SHA512cf2422aec292cd306beea9fd9517d3acc24bc819f36f919e0bd4e178e866d742b3ef37bcf1950c69835740946fc18102efaf849ebb41b80d5fc6b763fc627e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dde4ae59ece89de7401dc7c9078cd05
SHA14fb349ae13729063580368c8b741d7ab5692a8b9
SHA2564537d462a0de17706b5ba3829dcff96fdbd1def8be12250c293b0c29ac9dac9c
SHA5129b2ea1952e0a7f9d8eca4b5713dbb41eb54527baa13941714fdc7bdd0e61ff50f81d5adb6565cbaf00eeec7eff9d546919aeee39841304328c38d42dc87f60bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c72238d953c5b183864b276e9f9881a6
SHA11aee609cafd99309cdeb4a1af7ea98bb6e729b17
SHA256498b7748a1a4ad472152f3599a998a7e7c19f0b594da82b3fa7da88cdb21ab59
SHA5123b25a986ab26f50f8f47f1a53d788dd8c70beb10704f67784f30c0800e4db7d84e0e59d59e60256b7c7ddf7a2b1bed0cbea2614410cc5514e4452be6190ffd6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cdb3558bb7a348c339d7aff1937970e
SHA16906bcd71908181de5c2a9007c297b32425fe9da
SHA256afaf643ab8d1ad1366fdd509516bbd430db8ca8f968490588e7880f1370c52b1
SHA512534b26dece86742a86cdc9c5074ccf3541aedf963a16aedf1469971a155d9dc09bfe0204b8bdb5624915525c33e20958d7a2cd4f44519ca509e3809069db5ca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9d925e7d4c4c41f03739ea64f781564
SHA113366096daac0627e24b02c878190c0bc624744b
SHA256de0cf91e9c2d866cd951f8e05e8a111c5a1d1c3f0e4d72c0ee6ce2b471837096
SHA5126cfbd23e44dfa1727af1c9f90d2fd63615fe1d7be4004888c1811348135824b0571731ee5fc9aec89070939ee3f9da445e74d390b766affde4f835d824d3404e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a3688ba1d081dc3da6cb2dccb2c01c
SHA1ebac9ad22519fd534db95b00ec49052936313d96
SHA2560f787b5ca9b5e29c1345a81c7ad9259ed419f1366b3f80323a78309de45f1051
SHA51215cb24d45454c6859618b6dc831b620c30b5510a0e260e958a663dc9814c3361cb22980560049cbb67d36f45314221449fe0e0c6ed5edc64d7a5a12ebb1d3d9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d030acb2201111c35b52492f50dd48c7
SHA1819430b8210703512f4591ce928a704b6d829e25
SHA256499271505fd763ee38060dfc3c99b70e2241b9d66247f4800f066c79a6536bc2
SHA512339448bb7912599a99ffb8c292f94fc7fe24c3c0ca397e79e126c2e52d4a3de0fb4e52424413f96531c04d62c0b831c9f0b6f2282d0472dfa1eb4c5f2b5ae202
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e96fdce834d22225f40d503ec9431f6c
SHA1e971d127677f02bf039f4020241164477876f4c4
SHA256aac47d1e32fce5666c72e3ea754c715fa743bae199286005b1afd20393a3cc3c
SHA512079b9240b9e13a6558ab165692291f9bcffd35cd0e455e9a4b0d15dcb392aadcf976e8debe095a5a2ec14c48eb84ae115ed52063c06587994d08d93189962ed5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d52375728cd8901ed8d1405823148e4b
SHA14643a6a34964fe49058145a4879085b0494c1dc8
SHA2561d08fe8a7b2a3a5d380464c543e4fc767451534026a742213ec915d9346866fe
SHA5129976ab617ff7f4247a52241dfb2e8b800f9da856e600d8c904f1c658746bef726636c8244be58e2189fed88de0e6e25899675d206ede07b873cc3a4cf16de80a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55162c8075a8f14c734e204057be73059
SHA1520d80bd115b506a71e7448f686eaa428473a99b
SHA256bc5127f4e140395b39fa6d440c4e75ee375ed2b8aed938a1252e87af900046d2
SHA512ef75c7458171b4c385a3004da382e84acd5483ab36cc0213ccefe14725d039187cab99d244ba7650dbd7fb5ae7a7f556592b093a575923512543ebf3fdaae3fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f9a760e0fc61b0d81f4858ca3db5350
SHA11cb61f1fd48f5273af9b7b28011e6b78bd0762ec
SHA2568b2bf3adb3bf48204d1e8cfe07db7cb3b1283c6d200cf03476dc68eebc5e24db
SHA512bbc717b36218f7e23e3ec2b72643b8bed306efc79fc111f372152b875b024542ec061a19db8830905d07c81fa99d288234b4b0df812246cf383022bc3252b986
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5609ea7c6e44fe265915b44d3f039cd81
SHA101373cd35116da31f7d508d445dc74c39b516e2a
SHA25652ae4ac12fc806cd8e54f16e2326191f5cdbd5c0c21313b6b897d70e757f1e3a
SHA512fb029d3a0bcefc4a6952c1a229d8dd3d85ff90976260b571ac61874006f91a67e0093b29f39e8fb540e55851bd4819e879b393828da9d9fb0b4deb5f82fc66b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c904bb2fd66c35f190ec78af6a876295
SHA169874d0f8a2373d1809d2117b672eecffdf28f8f
SHA2566491f245325a948f42def01c03b2a2f58ac97152d2065c8b7d2b4c88cac834ce
SHA51201f37bc9c4b937bb86d2e53fb0d42e1e38af5e25ee4a5f86daabd4578d8f144515a5d814edf1d992a4fd70feab6c1cb4429920a90398bea66c3bcf0c0bbd896a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509cfb93d4ced6771fa89326222a9c42d
SHA1c1ca442e3637f0bf9f7130a6f96e83952338a0c3
SHA2561f528f980f43689239f21450fccd817179331afc4dab31dfd73015650b85def5
SHA5128fcee27c78c23ee3974fd554f384a27ae866b2d674c91bcb094852624f47715a1b28de76f48f744574e911af46fef8e90d095536034326c457a9ea77147f4ace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9c0540d14c9725fcb7a367b987f15fa
SHA11070210af3e607a4e6ba9644ce9199cf477d1081
SHA2566de6ab208666f7a06ac270b1f2b6ca8d1c61432b36ec72fd3aec2ad1bd8c64da
SHA5121f66a2540c30410116fc7d446c1c5945bec8a08c9c84aafba71b6f5fdcc7959be342c4fb5df7744b358073e4aad4eb67f5caabfa0e6e763e9fc2d79c4fdd80d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50927be73432d88202d109a3226185288
SHA1c671fbc9424ecd652d44b49fac47758ed6226d91
SHA256c2a593cebf21e11d603754de667751ec5b9c0bc5edd97b93b1eb11f64aa57b3c
SHA512cab34608baf8ad5978be00fe0f27f7df7e2ce37d0194efa28fe776f2ce187eeec7840a77ca485b4e20d2a2d94958ee952d7828e47c24d9b795b4a35d63c925fe
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b