Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
21f55dbb01cafd29d81ef7bcaf81748e_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
21f55dbb01cafd29d81ef7bcaf81748e_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
21f55dbb01cafd29d81ef7bcaf81748e_JaffaCakes118.html
-
Size
2KB
-
MD5
21f55dbb01cafd29d81ef7bcaf81748e
-
SHA1
815e61b76541fe4c994ba11b5e052d0ca313811b
-
SHA256
c89848238c1e919f24bda8252846dd90d0fa4fb59d8f938f8fc30e56d9e1248f
-
SHA512
ce937af3e9460c7c899e37006e971268cc3ee8e2393dad10da179321946513f6e71260b4e75fb9b656ae517b649dc23b3baf26b15e97ffefa8b2c7f8d7804d63
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426163008" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000002688c4782d4504c4e60ba4e09d5e8604da2696524a823e8c017d3bf55c63ef7d000000000e8000000002000020000000a94461efc5ba398a8ebd085c2cf231901d62beac88737727386f0b9194bfc9ba900000000d61c96f0d07cd5f1d7c2fee802d63599c777106fba151c1beb030703e7c0ee900928ac8b59cef9d6977529281bfbea5561153bd8c5308d04dcfa4135c1fcf4afe6613aea977fc1e8c67c7d869b93d8db918853f1011b5a080eb3fa659e3bfc8331a0854dd4ce24b4f7a869a4ba28cc28d31178bbfd4e729db248bb67f2538ba10fe60d353cdf12d069b94ca03ddf55c400000006250158833e7d591aedd1072da965f5bdc6fc03c3dbdca275a7c3f71c1b1218eb137cfc4c5dec418257347634be57e30a3af5ea2003018ec59928ba3e4e3697d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000033b97fbff6454e4cef4088e3d598125e9029ee443ef5c92552de919a66dd3f12000000000e800000000200002000000047ba61c248181f94ae931c51cfdd250c05ade06db14b3cf796f53116c7e9fbf020000000e474d484753649de001825721021bc0d45efbf7dd8de6e9e6a890c19040d4c59400000004c7fcf9df7c22c63fe227ca2182791f66715f75406cb2f96d6386c292eb384a491bce4851db14e634334e4486760d4c2c274a55ea789c04710a8e9bf7ae118e6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC26EB61-3923-11EF-AC4C-424EC277AA72} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e2e4a030cdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2592 2436 iexplore.exe 28 PID 2436 wrote to memory of 2592 2436 iexplore.exe 28 PID 2436 wrote to memory of 2592 2436 iexplore.exe 28 PID 2436 wrote to memory of 2592 2436 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21f55dbb01cafd29d81ef7bcaf81748e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50628f54927c3ed45b6b422cbcae28c21
SHA18f76cc1895e9da50146c66e647864968c0b426a1
SHA2569ceb5b8f39110397126707322cbfb6fa302b5d38d1951b0e30247c71bd30354a
SHA512d0834f7ef88f9e00e412c6353230143a709f15b1149cdac926230e9b362eb4bb7cf46bdb857379a03a9c7d732b72623753c633a5a8cda03ae67b67f0732e7b62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50472673e2bfa33740b70c15e90da9c60
SHA1a7995682fbb12fd14b6cfe1da02ab8ccdfdaff79
SHA256578644a10a3c35969a1f70c2ae6001679feee539c14820607d7e0ad8ca87de36
SHA51288de6db07ef20c29caf394137a4517aeff57affbbc196035d2d4b5666bf2be7abac3c44728ed188e51d0fead7a8c87631edd6d8abd268d955d2d689933df5190
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553bd5a09ca2a245fc15577ffb922c932
SHA17fd406e31c5453ea430af53d20eea0e6385ca524
SHA2569b6da1ce3274ebbc1aff9e8b637549629ff6d1d1587e183196f1b62097262638
SHA512dd3cf032aecad6e7a36cdc70a34d9a831ce358040d94bd42b687cb49728c3108556aba4741133126fbb021643be2473d210b0cac2addf0a218a96f7c6dbd903d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54129903428a3ae6fb029924b6a88bfe3
SHA1f4b4a630b80dae5eb60b4696e1b2fb0c195513e4
SHA256bdb85dd7ab1cbec4781bb2abe6a33d90fcc06062e90d16e5ac7df52ad3eb022c
SHA512ae37d6bff467b54a1d16564c954a37c1ca88ced79fe814164e08ed0735be58901b8415dce8edd9824437508801f8a53a172f0591329629a633f233fce1f39198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50824874fa9d210e5acf65eb3bc7e225e
SHA1bf70538972533d12aef14759c3d8ec97473c6765
SHA256e471b952061cd99a494c64e8ac49dbda464e783bc57db0adf2292326e9b10d5a
SHA5124c7feb4c9f9bb0d95d15b33735783dde6c370d9f3782fc06b97c48f4d1cd3b74266dde978d684c06ef5a6c5aec75547197a6698630de06a1a5398a6068db7614
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8305f244b44d40f4c043018d5910d6c
SHA1918ea466f39bfb109cb22dc317a5bbe621d0c622
SHA256c12faf31481df8d7d5802ecfe038c4954b22411bfd508842afbe4d610cfb4b4d
SHA512c3211ae4d2ccaf24fb58fc89f41cc9236053e33331b4732479382cc8c2581cf986c41756e25148b46f8e7017464d874e21f68e13c5a2c10e9eb78885c281045c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3bd0066c93ba834e233cf855680c846
SHA12e13e3832c59d7638604192b2aa19806b10c3ae2
SHA256e6493725d48e7edbfffed2acf994d2cce6da127b4d62f84e855f165cd53af5cc
SHA51299f2f793f95b9d75d121b83c325701814df022d957082f9c9de28340334bbb782c93b139079bf4dc04aaef5e93ab4d48544833a74f6de3224d5af919d1c61fb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506e16f81b42311967d3a6a412f64b172
SHA1c485ffb8cf819d7bbdd115f5597e895c2af493d0
SHA25606acb92d1458914a13a8e0b95136bdfeb096cccce6660e3427416aad9ffb189d
SHA5128be9ad7f9185166ab8ba5691a3a6cc56cc34e785ae6427d741db7dbe649b8997b53f34a2e7178cee2879c8b4e02c244609f8ac26642f0d59dd766b3b8bba7f7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50417d77353679c03565b5d6424d9e8e2
SHA1a8baa17d55cfa88ac142d3dc3fec8c3b757dfcc8
SHA256d163bf163e9104ffe20c14be8dff53fdcbd767a6e05f2ca558c714cfb681b340
SHA512049989efb40638a8d2fadf7408ce66915f5f501a4e762085a13f3103791b9c23b3a8e5c2d249a2926e0de32201d4e1c79d3c5583a7de446abaf1bfbed489c79f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500097bd2cb4f688cfb0ce25e14ef1edc
SHA1a4ac1313f00470416c5839d101f9979db6754c1e
SHA25660291a4c499f2ff4ab0493a9c06681316c19568075d1f2acc6012f5c4ff5e678
SHA5120266bf9b06bca9c357e3886b9bc38283e8f2bed59438991fe1ad4f1c8ec77865228ddd8504c4a0c82a27fd757221902f97129997ec433566b9b14e48f1108ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5181def6e7a3d16e962f7343e11f937cb
SHA1362ada244d00d7e716bde1211259bfa8de11aeae
SHA256b38500ca229767a4ca330e1a4832092fff139f128d227106da3acaec74e4e7c1
SHA5123cd5d59b06badad5762b84893d96ca531b2867c53000e08a14c78654774d969335b72e71b580c0f09034fc30a3e50fb6beff3398164375d96efe9e69c1e7ed2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528502cc647f515b4cd69044071987b9b
SHA10f5efe71c0c6b27599c4916ecd82e72431f7ac8a
SHA256b59ca8f8a386bbe2a1c4a50fdda782a61b5b9019ac4b3f665fed187bf0f59f1d
SHA512babde7daaf40271d5ed27eb99644bec084e08fa9efce860ef05713f6be0477102d4b4e9a2a614eb7be24b55821b41b0e0e27f68b37ca2ba3c3ccbf05ee8c18fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587803d6977691a7032b4921039dd184d
SHA1c6c543c1b9d63b4d29cfe7f50e3f0494b9ce4d2e
SHA256f3872520d032cc4b6519360389454df416cfde6996406e80692c2c7a7845b9ee
SHA5120d8f156c32844b5cd76623d2a7b14a7c063ae4c225345c613c2b372d8228364b04d76d9104fc2f2f192e1320b6f0dda63f43b9c2b220811b420bc6f0846f83ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f11bc176635409c28dbcc20ff72aeccd
SHA11e8570935eeeff8c50acebd0a75f365343a03b85
SHA256a6bb7ebfd8854d4ae3522a857dacdd6bdfe8d350709d7ef31cf9f8b5b8e8766e
SHA512877ab33fa009e3dbe1c37407ddd0d84cca2eee226a2eb9cfbca77aecc497cf426637ac89c2f4234b34fe5b0fafeadb02a6b05351263b45cb8be168e5606f3729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b4f80ed0fba05ec8dc9019b41658641
SHA1e2b090e0f8b629f28d588b38eeb6da019a665a9c
SHA256d9486ab30fafd5051d87d342e43451fc10470a40bc35ef3841117b6c2eaafeaf
SHA512ac15526173ddf1176395f5c43f706cb8fecc8a498ab13917ee066d79fa22431ca5f0f85dda358e2fb49c961760cc0b77e20310e7eec2f8b9f214ee732b9036c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d43544cd4e12325cec8de934b0b051be
SHA13dcb23dcf941c6b059b9d630bcb06cc00f43f4e2
SHA25693e97e092d8e1a1913dea036473fa7bef09ffd5736f685145d7e67cfce01a92e
SHA5128aabfe5e0a8fd5560cae543189ec1f5c6a3331dd0fd304af357cb9429fc66b522cb9fe4a8f7c3e133ff616d14cdde2cfd1049e38625c096529c6f3cef9c89e75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577ca0c631bbd5432ae00c0fbc7fb1c26
SHA18e171bd46e45c98f15c6a606d29f2037d32ef0df
SHA25617590d2953d9793fc67847ebc40ce070a00443d61ea6806aef0553d59937db66
SHA51298366fd0122ef291ace8fa8cf19360a760a6e38a19c7d12d852ebfcd216d78766d68c4529c5c42982b1dbb6f8085c5d11ea1f16c25121e9f0b35e8f9277d6fbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d21a4ba0f4cf285b012e768d9ab5ec15
SHA1521aa1ce1dacc3793f6a773d67cd05a252feaa21
SHA2568a17592805547bb3dcb8ad0822be692a031acf7aae7a23cf2fd23da6b1672704
SHA512385ac67f3085bfb58e3ec802903cf401280460f0cea18e5a346258156e5a1ac1efbf264bb6a7ce32920b5742dd7705714cd415b4b9853506a371036f1d8a4b41
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b