Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html
-
Size
57KB
-
MD5
27a7dcafcabf72cff047f4f46d9adae0
-
SHA1
d90dd1633f9477212cb91ffc6481a36da4e7f11e
-
SHA256
d67c7ca3ef64c85ebc78e3545d42454b3c708716904f2accfd37235dd78530f3
-
SHA512
05ed7202b226c825c73f3305e0cbd1a1d302bf652801af91064374db491c953dd87bca5c52b25a2a493935b497743c421d5806f431dfe2699224ec7a5d6a99c7
-
SSDEEP
1536:gQZBCCOdr0IxCCc6Mfwf7fCfHfCfYfifyfQfqfSfDfqf0f8fqfCfkfzfpfUfufIy:gk2V0IxOoT6PaQ6aYCarScUi6s7BcWgy
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D03318C1-3B65-11EF-A6B8-D6EBA8958965} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426411262" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c71fa772cfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000b7a9a168251e3bb704f600dfc699c1930c6aa2e8ac6f9baa951614bc8d42caa4000000000e80000000020000200000002a0e3f0db8ddbcc1f5795e11f28244b4462a5dba299eb2e892e21f33959a566590000000b725c55b05585705bcaa4635a4b299005aa5ec46868cda43337a361f81de9158957ef9d1bfd3b96e2200223e9670ec5e5515ce2afc4cbda0d37684ae9a791f342c9aa0025dcd7bb6c72d554c6f24e36728b48d498834edd02131ae6e565f6561b3cb5cdceacae461854527d694585bffa50b884fb16c7e0ee930e0823a84832b2d1f929013990126355ae706e4d23a83400000008c92633e6221eaa2b8af83c79a5db93a98fedbdc0d6b46e0d88e6ef19aef20bbbbd50aa47aec3c93644ae9864ef906aa0866af3713de71acad0dc1060ceb5eb8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000007c7702add7b314c653664efacaeac61444c53e094a7eca04963d67a0002f0dcf000000000e80000000020000200000005ec320c9c4f04f6d548df1bfc7a075e6bf43a3b4395c8b980c49edd61cccfbe0200000002a00444be81939ad5e7347d8a8618846603b6f766a29a29d056cc226c0b101cf40000000f602bc29452587c6cbaf177a88fc7e1b469c6500970c23025e16731bfee528289c110847be76dd624d539b766800a22a053898cee29410bf8f000566f0b3d007 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2420 2116 iexplore.exe 30 PID 2116 wrote to memory of 2420 2116 iexplore.exe 30 PID 2116 wrote to memory of 2420 2116 iexplore.exe 30 PID 2116 wrote to memory of 2420 2116 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5447d1012fc98aec71e82c21845924581
SHA1f530e40b08d6a6ddcb27847897cd46c7d13ae433
SHA2569878c4361178f7a9493d364a00464c048294f619b8df588b404545068bb4f3fe
SHA51231b25de30cf1d8eaa20d9593a26724b0f99486612bff70dbbf5691cf0fd5d8e3266a83b801db7c5bc6b6f35d0432d1f5e103ca01c2a87fbec61cbd1ce72ac0c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc48a11e07d663a87f1404c5887d1721
SHA184c765d88a4ea5995cc4e5d6e18cffc0db9351e4
SHA256f9c511414d1fe1ecbfefe05573b3bea7715b1fa0d13d0d6aef8716bdb88ce0d1
SHA5126580f7aa817ce12df76d68ed3acc5a33706d2a51baa843611234b2a432323752cee40619a96f3551df52f62ace00a6c126b26911dc7b73a018720d0a4ed2da1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524bbed832a680f87919f89c823394d7d
SHA19f4c6fa5388192596b0a85ffd181386a221637c0
SHA256e41ae26ea142b7535bad9cd3a69b371f078a5fa529d96d31b5b44d734857f8bc
SHA5128d95c45f0e0b58f659d5dec201ec5cd8a69afb894e652ed591bb1086fa32df9e2f3a6b9c7f5c1d4be1379766920fd8e3169002ea7ff8e05bd23f72012c6d037e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b730338692b75a5cc954d525dc364d78
SHA1db1b7cc44287b89846241a85ff4f6e044d78714f
SHA2569df5dc7eabeedeabb6df8a33d5335a6bdcc59b87b55d37af988a6fbb8adadcef
SHA512b148af16511e4ef4b477f20dfc12a7cc9cf5a83670dc9750fea0edabdd42f98a7ee1d11e366447826b7c6eee229ce22f1f3ae29835fc9636aadfc6833b0eec96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58960fb4150c3d6e8f50948de54dfb889
SHA15a5d1f32097e305e12dbe941a8eead32c6da3166
SHA25677d1d134aa9c172cfa6a8111d490aeffe50c43eba5babb89779ee7418fae7f75
SHA512c4ef8835d84248c7ebf378b9dabe6ddbca31316819483b3e8ba20dcd856e4ad0db73523f76711d7a55be52970bc61b51c5dcdfb592e646f2039f51d612848d5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528bd9a98c0cdf126f5d80b47a8516f40
SHA15bfe4cd399a461fa3bb908921c2d8cf9a07cb4bc
SHA25630cbff8465c0688f615d601961a76da643a7ef13927f71649f16a1a74a1ff24c
SHA512a3a641402ca245c840d78e0587839f4403d53d6eb9ab63115bb3de94c96732bc9ba62800bc54bd9f3df6b917f92e56190dafcc5aa00818ba65998d23ab34f32b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5242d097e6cbabd900daca3b0fe987374
SHA1334826c4a84cf555fc4eeacfe48c09bd0c556ea8
SHA25630f480ef812d65d225203f9bd73e14b6da7e55cce74483a35807f17135f0564a
SHA5120a5308c689074c3678cd2075dd2040b0935bebc276bfc02b80b6ba7fc95e07c7c31b743d9c51bf59518f563020c71c41529a305d0be9161cadeed57596163cef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4122b1eb755546aac6fc0cf170b93ad
SHA137e38bbdf8527693822066f46b5447434af47f2e
SHA25698a6ae99c6e5a09acc5ade5ca42b390e460709781f20931f1e611774887724a5
SHA5125bb7a142f4f788480905b8c921dfe91ba3c75f30b9be5f979e59a6c0a4295fb546be51bee691686953503f1a34c1ff8901f4e26a4acb6763ade37f5221532bce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552f28308dabef78cba87b74188bf86ed
SHA1e342075bfcf1eeb0e7967e17471b84b517be9e8a
SHA2560be4729cf311f33d6fc3b6732b269e4d73c6a4dd00689b84cf8ce93ae089c9e0
SHA512c8e3d8aeeb8d90cb33b6766f066a811c0ef03b7713b00875ba58a516059c67871a336fbcc704f3c7e9d3bca143ca9478b1e65977f54d40483dbb6ed39b44cfa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f74f79b7d659ac6e01ec930b3c916546
SHA1ca52f9b0c46fdb68e95fb164f5ce249c76cbee3d
SHA25619b8b1f32525035d7fab7d5e56a567187392405c0ba993f9e06da49758e4487a
SHA5125d4bfd4ee6ceecacf687679e31c3804034970d5b6e38882ccadf62d8d75d3a4c9b26a967a83319c237288f13a2a0e3d9d8fb569c1e48c01cc7a3b7d50a32b294
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56496f709c080bfef32589ef026a7097d
SHA1795b2f3b4502bbc347dda3c348b2f4e8ca287f07
SHA256d436609ebf74486b7011b717e7515f61f7797471eaf3c5c02842fcdf01a03e1e
SHA51263c374c5a99435cd33617537004a5bc19936c7e6c3e769028eb8096cb6e96c2eb16761f81c9d962353353540f06baf216ebba74626a52c4e7956e0078cbc5d8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b362e3a660f7a2cb7a127954ab060e9
SHA1038589466668e730d24ea90597597c16660a9346
SHA256953f5595e9dad08161fc0b45849bafee1c7c36f9f990d47360b8b33d8b351afd
SHA512ec0bf233c4100fb885c2cd8db93d849caa6e5b4f1458155236cb43dd799105d31658b3591a1aacbc252cfae32ce75ece6d3a6af0fa3989344388cca3a2c6b2a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b82cfc68099a2aa197195cebb6909293
SHA1c02679604891174951860164d2397565bfe1ce6d
SHA25688a5fce4235448e96df2472cfdc49325d3be0f3b2ffc7021f37ab70523abab66
SHA512758a90d3d07c6d87b9b338c1cfc42b0feaceb87dd40027c65dd56ef9d5265915df50bafa8cd20146b4ccb7168ba0ef640ac10a359fc8a4c1e09e00c2efe7330b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b6db6d07d9df71357af693dd9bd7792
SHA10dd34943221c3ba3916f0da7269208873862f305
SHA25658f19d16dcd59aeafc5e4f3cd02179a16e2c0bdbfcdad511178eab280f8257ed
SHA51254a6cc138b753dbac7efec8fd73fe87999b678d26a742e3c34210d2ae427df80cf739aecc3fac96ec0b95ca7cb8ad4876b43e939c7d21afd5dbec81fa64abd96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f91610f7631d0426929c7d3b7c2f0c30
SHA1198219ca4db341d0683cb92b80ee76dedc0e1481
SHA2560b22975fb58902001b0e126c61e5ca22ea24d00fe2efe91209f632e3954ea37a
SHA512b770320dd0b63ddb31b161c2058b140ab21008caaac81b3b9703e5f7de4c25081aa2b50fadba92e053e84a50803a75914d06312f4e9fd7a5ffddbded3d9ea9f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54994962833520f8e33b8dc25cff92cc3
SHA1cf730bfdde2c896424a08fbfa1700632da20d8ce
SHA256cd3199a1d3d74a2f5df3934ee045cd3513f46ad2f4de899be10989ba5884ca61
SHA512880a4af66db562c3aacd80c2f8d5072c39e4af9b01604e2610d9128fa3044075b9d404d15df9f784072ce353ef551e8eee040bc09c95c56d136b59f3769c9450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5638c0f64be379958815a2985ec3fff0c
SHA17cc3cd4951ed2d38dd09369d60f7e63c3c142941
SHA2561ceed4c2404fc5b534aa6aa1240d01f6a63c317fb22e4cd6323cc7b994033a54
SHA5127306609a283807567ac40365991c53cf1077b4e836c7e5dd0cfad4385f61181c148a8a53fe0d201821f64e659582645ea43e688c30b82c2b4feedea246a35179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55273666fcd5b1f9b376ea92972b11826
SHA1423bf92a58f46ebe6a24fea0fe3b035b798d2109
SHA25601d48b4f211b3ecee4c3f5af310924de687d2157eb90b20ed2a59e64dc8a4a46
SHA51265bcfccd2f811a50e37f2e8f4ee07554bd7fe14237b0bbafcafc1b5a2c1ab4b4fbd2e58ebca336e10ce58b8d052837af12f707366fb726523fa9c4bfdcb8434f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b