Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe
-
Size
32KB
-
MD5
148a8cd865b54241d583f26b48bb9552
-
SHA1
5d531a3078d4e04171707786c02599169ab28f20
-
SHA256
39d805139a7ebf2895530ec68e9ca26b5990977f9e385a168ba0c97de39e8c13
-
SHA512
39fc33a0a117a3fc97c57f83f4de5018c7b73e52a7a574a9f58e0af81c200a39c76c962e5bee63c1f5165b29d155d37938d1af6a32582d55121470ac1a975246
-
SSDEEP
768:CAOmZDPYEQxiO0srYc3Esedh/SPyNGfXsa:CoZDPo30IYc3EsYYXsa
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\240640187.dat 148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086451f2560778c4babfdde5aaf2f9ab200000000020000000000106600000001000020000000a3f9615df9a07352de7628e89fff8748f454bf0f3f75c41627c9bc2364a0bb60000000000e80000000020000200000009314ae7e332f9dfd84846970d75839aba1215eae3bdc7374d4dc947e125ca27e20000000cf67cf857b0a179433a4a571952614f97755978bae4ce46913c77746f0111dad400000009005d164d1ae11a92d91492986a23a0068d110a3f37e1749b71f958db825c64b47bff1c6463f249be77720175f142424b95a83e71f2fd45c41f02f23f62d76ca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8BA888AF-3436-11EF-B9F7-7AD2C9E555B0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115331" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06d4c5443c8da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086451f2560778c4babfdde5aaf2f9ab200000000020000000000106600000001000020000000f9f0d53439a47820c023bb810cff086db2aeb516144f7293d6e00ad7dc479a77000000000e8000000002000020000000874eff785dd53509cea90a64ca4aa1caa01409939d24fbf2d5d68d3491e5a3292000000020189de08701ac3b0e103e2066e633c83eef379022d1c25faa3b9c0e9e9d9407400000002b868746097a26dc7938b15dc9b2c1efb951b5da065728569593ea3d53f2b72d3696969efbb9b59042d3367301cea393e5a4b3b2ef81264e9e8336c170e0d164 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086451f2560778c4babfdde5aaf2f9ab20000000002000000000010660000000100002000000060645bac741a63ce7a117672bd53a4dd353f4c49f989cef2c45e8932d7f694d7000000000e8000000002000020000000ebb97a946eefde6a54c491ad4d1313a2649d0cbe08479a1ecef7f23bfe489aef200000003571572a9a4feacdf95bb048ef418936f9a2f444eeb62bd711d4c1d733455512400000006351fe25cb280552dd7ba950c9942761f94359af338c6d0d3cb33898ee9e9d6956c8bdf64e63eec980be140990bc6a6df73aece6a392c2af8c5e1a7483adae3a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6049505543c8da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3004a75a43c8da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1620859648" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "no" 148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115331" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1621016191" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10765d6143c8da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000086451f2560778c4babfdde5aaf2f9ab2000000000200000000001066000000010000200000001cb65f9f7d34e3c089e4b1014282f7d7c6f319e430b2cd31fd510c4ee1944fc5000000000e8000000002000020000000083c5aee29e6d4784c9f6016d4fac809dc65379e52607fa88c1e2e47aa4e1def20000000b581a857ec65c57b2c0f1582512efcb52a996448ef5e7cdd2affc73c948a265140000000e2e4e495006af3fa7e45b7eb48582ffadbecdea1e5325a9641283397b34f76c6d8cb3bbf71ffe8499b27ce868d8770cde4addb7dbb3df23260a91192c84b8d22 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4436 148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1636 iexplore.exe 1636 iexplore.exe 1636 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1636 iexplore.exe 1636 iexplore.exe 4280 IEXPLORE.EXE 4280 IEXPLORE.EXE 1636 iexplore.exe 1636 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 1636 iexplore.exe 1636 iexplore.exe 4264 IEXPLORE.EXE 4264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1636 wrote to memory of 4280 1636 iexplore.exe 101 PID 1636 wrote to memory of 4280 1636 iexplore.exe 101 PID 1636 wrote to memory of 4280 1636 iexplore.exe 101 PID 1636 wrote to memory of 2372 1636 iexplore.exe 103 PID 1636 wrote to memory of 2372 1636 iexplore.exe 103 PID 1636 wrote to memory of 2372 1636 iexplore.exe 103 PID 1636 wrote to memory of 4264 1636 iexplore.exe 105 PID 1636 wrote to memory of 4264 1636 iexplore.exe 105 PID 1636 wrote to memory of 4264 1636 iexplore.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\148a8cd865b54241d583f26b48bb9552_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3536
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4280
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:82950 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:17414 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3868 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:2632