Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
27c801561a1f1d66c923e1fbd400fb1c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27c801561a1f1d66c923e1fbd400fb1c_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27c801561a1f1d66c923e1fbd400fb1c_JaffaCakes118.html
-
Size
238KB
-
MD5
27c801561a1f1d66c923e1fbd400fb1c
-
SHA1
5325dbbf03dbf889660918207e9a8f89b6093dec
-
SHA256
ae1b4318c8b71504ef1e000e55d262222e6a17c0eb4985eaab4211f9d73da91e
-
SHA512
998bf9156d970e12ea9b479db75a1124e4d9eaae516480835f5f0b84bf6a1bd16dc78d3d212ccedaac14d6d36592ef347fdc2dbc2999287dbffd69f1c5c67a80
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcVNTHA9afLamw8llW6cZ5A4+4p:sG00LXlW6U
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000eaee560ff0e67128ca47c494c0ef6626367978f0df0886390d094c374b86acec000000000e800000000200002000000056308973b44a342379babb66cc7f3829749c03f5037d6aab9712c6ae3024ade1200000006d8d8ad5a8c34d2811ad99c4ab4bf8ac0b332ea24c99d6e0f604fddfc59cd81d40000000212712345f3215cc24452117f564fd8db84d77640f325f7ea1e4b8db126697bf333cb058d00e88d41fd0524331f8bc6a8a6092c445e21e489a303aaa87474cea iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000000c32eadee57e1881c2f010bef0cfb30ad8734f72aae29e9a21b849ef9a2aff0c000000000e8000000002000020000000b813918f368199a4e9ce723afaa257b2921dd2d41a62f160a78812b5424ea15a900000001b2f6041204d192a58e533ea403035a0d14570aa2b1b0869497c29b2efdfb1f97e25a87899fd40830a2ca1b4bd407b8b55c6e8ca80b59a8b35ea63e250967a7113ef1f859706ee89ea86fed0d039fc78e265ef83b20f3a4d55c8d99aa5cab7ba192ac59661ada99d6cfd996a5884ec9cd11cca18aa0d32e35f59a0caaefdc0dc31cfb457ce251e694b047ba0c19c200540000000e502e678109d149a62badd4d198b1f00bee2561ed72847df6f1231589b99d33aec364342b3467f0fd20a1fd8ebf884dfb7d296bbe6b72e4af1af67981f5ddd6b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E78ED621-3B6B-11EF-9CED-F296DB73ED53} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426413878" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07cadd678cfda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 772 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 772 iexplore.exe 772 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 772 wrote to memory of 2504 772 iexplore.exe 30 PID 772 wrote to memory of 2504 772 iexplore.exe 30 PID 772 wrote to memory of 2504 772 iexplore.exe 30 PID 772 wrote to memory of 2504 772 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27c801561a1f1d66c923e1fbd400fb1c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:772 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0d632deacf4921b15422a1a46e1812d
SHA181a8093693f4d2f063b18af449a664f4df83393e
SHA2564daf52fe0460a3b1e748384bdc7e26e9853a4d723660cfb98dfd92ab791e56a3
SHA512726b29524a30ab35ac7277ce4b6f078e4f2b85d0662724c2d141e050064fc218bcda6fc3fbcb76425453dec8eafb801e47f8b68054611f283679e6d085df79c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1919816d46f76febad6dc6df92ac66d
SHA1a9e404c9a1bcf8b41aaf9b5f5cd78d71eca9f0a1
SHA256a2ee30205427c596d182ce178bba11b90a9cdeaeb4b149f1fb1b9df707c0ddf8
SHA512e362e3331746f4159f0f7802dd1ad9c92a3cf3e405274075304c9c84af78377970ad8d1075dd95fb40cae0a3e79a8fd395b62d2ce3ad9190565d25570a32d6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de0dbc3bc1fcc39b9d9d5d9f0b48119c
SHA1b0eaa208183ef9259999aced239b3f807ee68aa7
SHA25683c8f417e5a9aafb2495a20c5d7d2178495d3a9773e45c300f07c48b3d1d1be7
SHA5125c007403724b942bb97e0232f762f3e649783bf1bb59aa08cb17c747b1a2f72d7575089445a1463c914bf4fc94c8af31bcf1ef7da6b0253d80aa65ad7e25b257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e48ec078a5295439ee967370381745e
SHA17495cc1f23cccdc3c1ab45058119f6ef4bc664ef
SHA25629185065600a9619684f73b7893eec1e81a3a1fa3198cea6fafe822e0e9dc264
SHA512efb62bddfced30eacef2ffb8d9fa539db9ea63fb654ae72c03fecd15959d4a2dc9dfcc9a9c203037cefa42a2a7aab3fb7da67bdefbd1a0e50f133766f2faa709
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f601320bc00bfc8c5bf906d387c7e9fe
SHA121e3651a7fdd08d3bfdea763aa55273804dc2473
SHA2566b1c413d07ac62f263d3fdfae509ed11b85095fc7372346dd27b0fb913566a38
SHA5121720f00778b41ee79ea785a8caaf6c99463e12718238bb274b473572aa46c89f5010c01d9f5dffb611781855cb718000fcb241a15f0958d058522fe2cd449928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529e323516e1a69daee0e4c3f785efb81
SHA17d217fea2162fe3853fedc655e244baa15a85a69
SHA256395326596e6ca87529658d6efef4cc39099b7fd66f21a06aed7013499e06f968
SHA5120cb8a76d7c146fec7b4c0be53f9845c472e7ecd749e86d421ba5de24128b003bff35ddb2871ba82a15ccfcaadffd7598c0f0e10f89d68f98d65e997b7ff117f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd8939a879e0ead766b863ceeb7e3f15
SHA1a41b325802c366b7740ad1a877c3aed6941521a2
SHA2568ec5d5bdf5d6077d389812f1de2f9e2d2a0d3dce802bc83083d719b2a12c9bd6
SHA51218ed5a01072fff8484333091a72126204636464aba6f976310017a09e2abcc0465012ada75f3f6e41d74cfd5b62bf9bc84bfd66a2b33bf3e7c39864bf4a30fff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5285a2a7664bb7a6988592572cb9f790a
SHA192fa28be638b766a44b6620f4483b48013664e5c
SHA2564def1693d125f7b6c33e937695ccab42e52c6c063b5a7b5f7e01b120cea90ea8
SHA51293df0d7b19b3f84dc3062af30a51f03ee9c5a960a5fd5e22414e30103daa8436c7f9afbde7981891723694b743078e3065e46ab832999ed877033d007dcde856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8e0eab3fa4e0042ecc25678738cd280
SHA149a28a4705b62c0d747f53eee7c3bf42c1150d92
SHA2562a8368bc195adebb26e0e24af79ab0ab5e3af8ec4d603e17cac62a9e549da753
SHA5129ad022644dc6935bdfecd4ac07fdf521483ca8c0f9a72a8c59c9187bfa489095f8b2ea7ae964da0be46c9714b6daf2d910be1d262350825677243b2bee7fc88d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5656513410cc47d6b07d67ac591a2dfb0
SHA1c0c6f05ee23dec98f63d4e597a904afd521b5ab6
SHA256739e149681531a40933f50197c91f89a32176988ea2e6bc79dd3db63b6a0be44
SHA51214b86ac14ba942a8d687498e8df4114d99be97983a1d9e00782bb49ceb96e5ff69fd8d6220aec204139f994c6287e107740d31930b093b7dd776c3175b3fd027
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d36aab99cdabb11f929324a427e64c31
SHA1734a1747e97806734aecce3ff685fd992ac776fb
SHA2562ca5963656751888e3a4fb5d92cee43a4aec8024343db89d69423b1ff97b5682
SHA51268ac31967314e5102f51a361a4422ae157df19cde645d56b915bec16117462abe8c15d70eb3b4f4c71002ea61fa3647fb29b757506a6c3248ab54e78574ed241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfb09e287bbedc02ea99a7ec3eab22f5
SHA1219965c4097ebb0949bca3ccbbbbbfe6bfefedc0
SHA256e75430d4502aa885334c834b8e0b0fe55e94d91d70629ce6eba935f4228f3755
SHA512efabd0f0e1764640d48cf3ad13670d4af7b985dd04aa3bff3c2958e06cd90d6b59580f6104af65be522ed015518433f8d979fc6055262f88beb969814cfad313
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5289c72f2f0f08fd450b307945883137c
SHA133a689f93024c36d529b2c48392d34a1f9061299
SHA256e8162f8eec49e4077bb8047ff7836bab9f17bb382c5c9127d5bead1ca27b36e0
SHA51259c773f75afa646415b6fabb9a8c2df911661099e842451b5854d9362eb277bad9cf278a3d696ca52085852bc7be6479bbccc5bf8a98eb8fdb78bb7ddc512a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563598dcc06c52ebdc186d7fb09604b6b
SHA13afe1982e92e8d50171d18ba042cce548550d1d5
SHA256d535ad2d7e265d05a0e75966c9f41cffffda0acadcec1a6a9c7c1c20433af141
SHA512774ce6ddaf32929572a81d45685f9f994555a5f09b56c2324b3fa251d025071cd71b451ba9a9665d7f3a4993ce90d5da491053a97860cc5f453c426087eec2a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500a40e7c5678c577bf966c89abc828f3
SHA15bcf14dc20eb590e59fd32ce8719dfa6b444165f
SHA256f5e93807d22757ea6a4e48e075fecee6a4d493921614f89a2a667632385aaa1c
SHA5128bdd56521db9540ba2f25b99824ed836807651ac43a60689a3d9250878008dff4404ed8828b17e62896944db551004b88001b68499e0401db55473c0f58347ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6cf6d7d4a0507c5086e6b28456db093
SHA17766ecefb9bd557e976694d336267ea911511b8c
SHA256af98462d250642b9de773e98bed95b33d89aefec97c594bc4f602b478a149624
SHA512e134e9f1f86709ef2222d5a0c595b9024faa646d5ef8d64adc84404f3949540f57c605b3e67c8d3d5bc7fd55e4dc1934d1a35ed7501b6ba040331e7b13037ffc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fda110a63460991658ed4ba12f70f6f
SHA1012d11316c11915e85fa0b00c34b2634b7dc8dcc
SHA25689403f8201438bd58b55243f0d66037740a78d00a3f353274a32dda89d94facc
SHA512110b773abe05284cdfc42915767471fa26474273921d22d5f2b07d99de09372d932ffc9b9da7bd945714fad88caf501a177b2c9cf80e9144918396fede8ed7f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db44f0f94ba7f5ea84b943631b00f9f7
SHA13520f4fda3abde066d31dbb148fcd900c575e326
SHA25680ace88d08a3eddabc47d376046441d890268bc9a6bd456613bc6a2ec2027670
SHA512db36bc11424676a6d7558be29f932f5ad63e5212a61367763b21e7c80dbe4e31328f3b66a040778a4a90ef59eba1ca139e572b1eb903104a70abf5fd46b971f8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b