Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 00:14
Static task
static1
Behavioral task
behavioral1
Sample
053a47dcbcd0dcc7f746f8ed29f86b55_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
053a47dcbcd0dcc7f746f8ed29f86b55_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
053a47dcbcd0dcc7f746f8ed29f86b55_JaffaCakes118.html
-
Size
6KB
-
MD5
053a47dcbcd0dcc7f746f8ed29f86b55
-
SHA1
a4d2d0121cf3e7a52ede4049890a5ee0a3caa255
-
SHA256
d6e38f56fb73dd80f5d145dc8fc73b28349caa708bbcc654c825c9042748a8c0
-
SHA512
310e7b02cb04561445ad1f65da09f7db67eb2ceb7926d43e5537633485a9e55aa568c4e0bd9da44d2c95a5aca920b006b570399cd10a8c1b4d7f56b58752324a
-
SSDEEP
96:uzVs+ux7LjLLY1k9o84d12ef7CSTUpZcEZ7ru7f:csz7LjAYS/0b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0093c89acbc5da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425349958" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002fd70de1983b114b9aede1de5fd121570000000002000000000010660000000100002000000069cf8c7d4c203b3cd44238fc907fe92dd05a59bde90772a158416d2522246917000000000e8000000002000020000000a97fcd43170426538fce90a96742c8f63d246945f34368c827940cc19618a7139000000051a25d1c5b5ca79d64171417fc5f33f0c538550cdb0c019302947308b41d518d1492b8b5aab938be42020c376ba518a2f446237d8e4c5ffc8c82259e802c645777012dcc2c39b90f5a40e1227d8ec737cd76d535d4ce1d1ba2fd74f4c2be230488d2e47a294216f1830d9fd5192ab258a1c10f25d220617b11feffb0f0dc2d8bb62088e91c7b2755afe8a2fb5907adef40000000a264d22439991b87c5846beeadc85bf460e078c8f2eca49e9e51274884d4c27bd1f6737dbee7f17097341f57019d6688444560776103b303c162146eef28d8e9 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002fd70de1983b114b9aede1de5fd121570000000002000000000010660000000100002000000048b688e4cbea92760048035b939c1b2692212c04e90662630a57eeea018d5a5e000000000e80000000020000200000001d33875d3aad7b50699724637317aa5522382283788dad5617c48b4189c44971200000007fad3230671bc79934d985a903be001903a6de47cbfa7bfdaf17cefa802183db4000000062ada989b74a5a8ed1bdf97427fd2076656dae2f397b862afe6e978fbb5e894b1f64b97729d976f9c3b1ec40438a87fcc2b98e12b5a5297c417a760c821bdd94 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5C58C21-31BE-11EF-917A-EA263619F6CB} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2732 iexplore.exe 2732 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2776 2732 iexplore.exe 28 PID 2732 wrote to memory of 2776 2732 iexplore.exe 28 PID 2732 wrote to memory of 2776 2732 iexplore.exe 28 PID 2732 wrote to memory of 2776 2732 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\053a47dcbcd0dcc7f746f8ed29f86b55_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbc4177cb1cebf6e36f356f9f06e614a
SHA1070499ab096bf3c28bd987446952079edb05c1ab
SHA256b4bde09b45865c04ec8fc613da06bf6783682208dc3b0ce6aecccbbe8a9df125
SHA51210d72f52e6de3c8fa3912c836e11175c691b5ee00b7f4a30afee3a92ccff61efd2b9046e44aceb734d0c4c52b66577c53759ed9e3168d4faa060fbc97ce92e63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59aa821824f231e9b4b9d60bf0dc47ca1
SHA1d98fa19aff09cab94186862979d6f597e8baeff3
SHA256174353a3e89bc39ed5eb3f835c4be52f372c0e5afe0934145c2a071866f6e3dd
SHA512936214048163eccc3476aee7493fe32fb592836106ec3ac9857d189eba551def48a366a674f8ea3c60d07c8ab4715ac8a38421dab6f8236878754690059a3b9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf9e7accc9089c65d49a67af0e2cd020
SHA1ce53f4aa9dcbe61102d953c63938419f74f6373b
SHA25617ac45fa0178cd780e74875fbb28a48f41153201edaf4abccbfcbd76272494f0
SHA512962895831b8e4011e252a4f01373e5176eb37f31be0f46e4d540df11a4f15a55d959efb81e75f496888ad3c11156f6ada6276a5c54d104f017abd1584c07a4b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584a638482f4905b043daf886388f5fb0
SHA17c06743ddb8c6f4ba5f66c3af363aa3d17ad7918
SHA256a058591ec4aee19cfa2cdaa7c39d8f12b65443f70f97c5a0e9fbf3219c5c0284
SHA512ff031bf8defa8afd3f1ba15955ce26e28dbcd58d023e998984c748fdde94bf84c4044076f98d89e22785ca61e68e954c2fae79607f734956d4a4856536bc32bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cea8159231aeabb04749e82f1a1af26
SHA126af9a6c09a10ea95f11756e98b012d67a72ab19
SHA2569bfdd75eb41140cd01534d108fddb38211511cb1a655a7e62667cd5a05587897
SHA512cff569c4d3cfa2c7f2285c6ba6a25bffe6f1f7bfc7400800133bc40e20a2125f76834fc52640c5a5a48767adb0a216e504379ab6ebbebb2bf63f588b7380fe80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9df92be51d8b253ffd8829344fafb31
SHA185ce29510a4d6d43ced83c7cad24b2438d20eeed
SHA25608c11276f569557ea080ad8379623febe663245317b2f00af1f51a9cc9c8e3c4
SHA5129b561e978006cf8ffdd427d55abad0e0b005b0d3718ec739da42dc8f167397dc1c2316ba6bec092905654c8039d5281bb8c2a03fbbd5562d09c853842a3b9166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55980680b38bc461522633145c11dc24e
SHA190653f23b99877e4ee5eda28c9d0948e70bdccf8
SHA256d737d662fa898d9b17a923ca96aa891a0a5cdd4c382719f4050fa3062728f07a
SHA512c3fb63efa0f13f037f8aa95ec875ff69ba70dbcc68ab8b6280fb1d6eb1116d3036a9269272e766bb86c6f1fda780c24cb374c56a6bc21c3a95e7ff1047940ed4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d746a9e6ed6d47027961c97e4bf14c5
SHA15cf56a4bdb9308a9869cc0bd07061453a76032c5
SHA2564766a8f986b94144044f42cd607cbf77d451b681cc3febf30014c05be82704d2
SHA5128b56c1f92bc2d744e091ad709eeaac5043450efc3f3d5d81e452936aa84e32dd72c04c5c9643efec962b91af1d0d6c050d69f1c7c7fee79f00ee703337366609
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6d3898a2f8fbbc0bef1595153d08da8
SHA10bb881c370a56224412ac0cb1db9a8e8895d14e3
SHA256ef496936d6aea04b560c99631c4856152c19c504c3369ed93fd262f2357eb878
SHA512d9d31bac7a62dbab20c9782fff990fab1d6e5a3674c61e546a9379733eb4dcf3051e9e98f5d43d5ed742fb489cf5d5aecbc9fe73470ba7f53d28e2dc4048bae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55479cb30ec83af09d3493ef9fe2c90b2
SHA180ec5e8caac2e62a62a9eda03a8b3985372780cf
SHA2569f4707274b7bc50a723e48a1d6f16173297af8bb64099fbef37143aed8771a03
SHA512419c7d2a38e6e9e8e4dee2103471e4576dabb0a6b98a3b8712e68681832587fb03008cc9edacc34a1de0a4597bdcf1d334644771ffbe0151db1db3f0c38a78d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536b6b49d64f38f12080e411b6fcf3f47
SHA176701269a0aba64e5836285cad52001dc4e5438a
SHA256f7ee6a662b82a56bf3d5fbc1331bac2a1b1c59eb26e31dff1ea82299ce0a28ce
SHA51236be4f3213721b759ffb8af141176633f451fadabb6f03af48604cd9c6e90b9e4c7e76c2fc6ca7cac62f68099afd45b2bc99056affcd985fceb581e900467426
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b23351e9e4ca28a3fda86b5d43c29a4
SHA14ada38c0cf92e38d6151b97dd102f838b1341cf0
SHA2566dc32db5f806dc3c2737c66cef12d8798226360ed88d98bbd73f1a41130519cf
SHA512d08b445329f62fdd970bdb48330fa4730e562384d45fead1ab5927cf17737e41b6b778359d6f9f0c0a8536973ebbe145ed7f4fbaa3cbaccff51d8c50fe125e6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1dcd95a1a8c798b4b0f961dfcad4f5a
SHA13753482343b7d42aeb34c15d30fef6236bd63dd2
SHA25685a95250f608b1a5e1bedf88c7db200ee58aceab75250c32e19cb472294c5490
SHA512cf51d9459ac24b96872ff876e303e22f0bf01035ae880b2928fcad749ede33d7afbe2d15e865f5ad907bc7323212c87b366a0712a7b5b523440620f82a514a51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c171da121a3c214339644f39443391f0
SHA1e620c47bb56103df4402f70eea063ff9e451edd7
SHA256acffd6ed141ccd40c0fc9c0e723e402cd9aa3a66a41ae3c34fa7b0e55e975028
SHA51227a2e1bffb533af859482e58aad74914be8c3da35ab9e976efb800c63ec832178e24f9c51d55c6a82e643e5aa5a87a753a4db461bbbf6f3859fc8d6e6d4d2034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c397364b74a6b640f04b590edfd73be4
SHA125e8388ac2a063dab9352b1d60d281f20f77799d
SHA25635e12175b340380ced49139a96977bf2e3aefee396f1ffcb8f0308e98e352c49
SHA512f712f533f4c615c31b3a184e4264db4344e48163f1dece58c09de40c61ccc8ea0a2fbaa59fe2ede01af74bd6e726b88112842fabf45d29f232b2a440654df06a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c3b8908eb0df8d733e78f6637d9562d
SHA1417edf455d90775d919679e6c8cc0fb0c8c85009
SHA256b95e58570492c358f4fb01e04558d56fb9b4cbafbf720db8f775853d5c660dde
SHA512d121e55eb6d7fd6b76364fa1c4e37964c5bc03ef055716fb9a8efb641c4d3f23e06c2bfce5f1c31044adac1f630fec959b24e2a00595123464a3c0a5550d9e3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d48858753f42a4c7d2a9d1b99c00030
SHA10fa880311c249f117d02ae73c10faf5790c675f1
SHA25636360f791230f692a7c58ea151a49dcbd9a5cbdf18bd1167f2fffefaa48baa9a
SHA512b6f03e2ca0255b9ec3eddf771d73b2787a41c639988e820c94fa40374e6ddbaafea12007500e05c467aaacf1bc9df0e49f557560c1805484e6a98cd00678bcc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58482707c13d9f0d1d18f9c833524187a
SHA1611998aac9443677ddccc569f79b9bb43b4c24fd
SHA256f6d89a2dcdab9eb5796eb41b39dd474d7b8b10913d2ce057cfa393b28ba95b93
SHA5127fc31257d9968f3a9536c82953e5a2acb10a55c0d8de30bdad6b9d289ca80994205800d3d1444e442dffc9dfeee8e9e68c302e688415c499b4b2e562b85cf4d8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b