Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
2bac010ed38332da2e1df70c5a9e08fc_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2bac010ed38332da2e1df70c5a9e08fc_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2bac010ed38332da2e1df70c5a9e08fc_JaffaCakes118.html
-
Size
97B
-
MD5
2bac010ed38332da2e1df70c5a9e08fc
-
SHA1
f3288341dca4e4f185f8a9afa747920100dff0c6
-
SHA256
de577e97ced606242960ebba4acafd66bc420f07331323bf458b11a10ed17872
-
SHA512
643a9e39fa74ac5d1e4166550afc9e5482b04a1c11e628a7e56dabf05610f14202fc69a4a44e8f418a09c32effd9e31e1a9a819877d824075a2b11e5d0cdfd0b
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a07ada41d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05F70311-3D35-11EF-A5E3-DA219DA76A91} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000007469917a9ad1cd235d9f9f9d287b2b77be9c493dd2f4a62f37115a0598b6bd12000000000e80000000020000200000002e527524dcb9c6799cc19f1442816b7d88ccce227f39497204fc49e515d153b990000000fa3ac1f9e3e73b45aeb7935320e7a6d8d56aa9d96170bbfef94961b6468feb6d26d811e3e448f9d569cfe8f7bef1ad44c78fedaae006fa75b55ce1a98de1e33e2d5ca2b6b546ea8dac24726a77eecc8acb4e8b5517e9034c057eebd65be7b10a72e23a7a8a0a422fc33d6a490aea38997cb5c7d61928f1f3f13f5cfdf92ee44776986b94b06a90330cfe2a0b30b61b7540000000e2f476f83a16b794e8910a70d9e6eb5fe07edb335ca2907858c45915b8a04609e3b4c3d5d06246dc499d6eda23ff112a9627727015616d27c67d0f9c75888bcc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426610209" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000096a00c5a32264d79b5628cbf524165a97236189cbcfcfd079c22dca42d1fca2a000000000e80000000020000200000007b4dc871a56f92374d9881c2796615c4a22179858d7031f1d6f739746a611be0200000005a06f5b2ab4dfcfcb646ca40d221caa998de91728f40ad4ba29395ec9628b6b440000000ee35025ef2624704a004f6152b4a7ea81533576b1de52db8d7c016babe306eda9fc563a768ccd1574eda4b923c6b7f3e64cf6bc2a51c49418bbd7102568f12de iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1632 iexplore.exe 1632 iexplore.exe 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2984 1632 iexplore.exe 28 PID 1632 wrote to memory of 2984 1632 iexplore.exe 28 PID 1632 wrote to memory of 2984 1632 iexplore.exe 28 PID 1632 wrote to memory of 2984 1632 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bac010ed38332da2e1df70c5a9e08fc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f734ebe6864fcdc5c6ea302f3cb4090
SHA1738a330be462dda04d63bb695aebf5bf8b7845ca
SHA256bb443bab25b8c7504e2e0921f91f2532526c406787ed303835badf7f4cdb2e8a
SHA512fce2dbbcd5ad52788e7c9a1667efbb4bab14aa2952256799093b7213604e50b4597f512c86b2886f3da6f306780e597818c51d83f8e5340fb22ed16b97313685
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5353362e84e4f29f2a30f0cda3a168752
SHA1071a79a5243ae585e53b92a0ead32acff475f93a
SHA256957a2629bfa0c8e56e1137f3a8c5155a54ab9760e14f30c7d6741da18f48c89a
SHA512e6d64cad88cc796ff68704049af0067ca46e87b41ae539e9922fae06a64c44fdb6b5bdddb87daf3837c7cbe1f3d243d6333ad00d3f49847b632372795b25dc6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dda37c29ccd037594f85bfee3710a4c
SHA18b91cee9ba633db678da24e23ae381fae07d00a8
SHA2562d7f6fa50e411c30dcb8f21a1379d946753760fce0b60d7b96781ea2d847ec75
SHA51264d3134d80e662bab60322da03bff39b6ec82c7ea21f35dfc61981523618b2039534e4c559a760e09145a0a90fc8a7a89af7b4f148488651046797e05c1ce0e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ca91fa4343b20b51bc19370efbf4bc1
SHA1a7f0c5bdc8bf54fa378faa928dcdaafe6dd6bb60
SHA2565b23425a15240b9233fa2000980cbbcf77a2e48d0a1be498166893d9e50d7b7b
SHA512aaf1f3622bd768fc8efe490cae49d00827ccc08e87a3c4a0b2a0b6405e8c67176ededf66b543b6595b0713087d08db177ae5be5ac4c7b7c5538f7e0d96137f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dc76db6aa932f0033e1a173f0feb5e8
SHA1b1c93c96442b6746a2b6eacb0e560d4d79e45e2f
SHA256596ca1745b4b0c3d87a530b254d764d76dc4e7e949494a3f0b3ec8fad077d4c9
SHA5123331e840a777ec115321a9776d5c490867b43f1447514a9360882c4f7bf45a515ef9409935a496b6c7cc1c93e6c1e32f45f3415f418d68aedea70088b68f0a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1791eff4cde41ea570aed46189d0735
SHA1ca2f5ad4c8970b5844db42236d0b51771e3941eb
SHA256dea063a874f698d951909e0a9f1b94f12dc75a14d9c9f0343ecb277a5af647a5
SHA512a50f7f9de4360bb75407e9b0874d5a12619a22fd8b1e1b69d44f6da273db9c2bb3d41c17e9897bb33a3d73e09cf7a13f387853f6482843752e2e8c70666d6c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5758ec0ca44fb68e1592baf0805c70638
SHA1a6846458a82981ed04ff8ec828519f2ed72f1580
SHA256b7bbc55fc75423c31500f065a551eb7a0590c560857c1eb683a47dbe58224596
SHA512343ce1135a7b2b6b9704907c3f3a0f1d1395cf88317aca031be3955c5ada3f30a4d3d7c9559e486724f37829fcfb16d2a653cdadaa8f926e7297b833ff23fc89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518881e917d5d4329dd791dfaa4827041
SHA1d98ad4f3e3f081cc3aaa2eac18dfd6a7456c5646
SHA2562126647983972e20cdd87e3e5bb6f829c1d217cec7eed751d219f3d6cb68e4ca
SHA512d5040942923e276a49cfddd7951ab67a709faf45ef7d29a78a71d8397991aac2f89e2d2852ec1233e6369b4e592da4537b18a4ea612004c9b76d3180dba22116
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b67b1707d62a97e2eb2225ba4d74ed42
SHA168dd3360424d3b118f95b48e0441d3437656be5d
SHA256dcea7521e9cb87e53d6c7bfd4edbaf929eeeae04cab9705c9aac08583af9f48f
SHA5123858d6a82ea1f437ddad522be2db2a6ecf84b93e4164362ff5e30462bd7cd10b90113af6350332dad2642bc56df1d4ea1a829688fdb06798aa3fe061d5faa4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4adff383c52a077b6913614db9d0052
SHA104d2742e10713d85b7fc77d72e163063b5a5e429
SHA25643b1e20c1c6466857ea2551c09f1c826d972c643d21eddcaeef511bb72075957
SHA512ed970cedc7dc6ba00bdd3dbe07046727a7df4d6fdcb3c8ea7b322e8caae0d23efc9bda5d6c834ec9d03b9b21cc040518530b4d84f60cb4572fcf2bb62a9dd28f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b