Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe
-
Size
16KB
-
MD5
2fbb1192373c4219baed34d251d1a532
-
SHA1
d660428452a4d95ca043df222fce28dfe234feaa
-
SHA256
0134cadf86b4631844975aa0b1a0cb90156381900f2dfea99e25c0b0c9e5d0ac
-
SHA512
aef0f3033af058f5d17817d1349a739272a0e5c3d4393ebac05a309f10c4f8851a6fce4da5629d11650fcc12f30f40869b9076726ee6af1c4d271e64b83316c7
-
SSDEEP
24:eFGSpNtdi9ym230J4w0Qb0EVM208hElHGSYpKV:iddGym2Aghr7YA
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCF24AD1-3DEB-11EF-A7E7-6EB28AAB65BF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000fa017d39da59e687806b4cc681df02c1f378c82d64ae16cd8583bc10c55e1899000000000e8000000002000020000000e713e3f72747aac7f99cda3a2004ec4f4bfca0cbc07fed6789bef6faea5f069820000000b44c18168180c7a13be342586b165c39e9b54d4cfafd9a3f7be9668f151af37040000000421b9903f53f15921232b5fa0c2baa9bde34e51d4029d6fd8d8669870d9b2ac23449ec5f56d78c5d9a58385982ed32dd194b2faf16c8972eba9e2be51a8927df iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426688738" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000008d26918c1c22e8ef15919fdc36ad73d8ee07c5d6bc4db0b54037a0f73c9fe5c7000000000e8000000002000020000000479f6c414c65b70fd9d275b1519839db74148d995c4274c5344bfb0abf23011b90000000c804c8cf6b4f6aa251057b1c00a76d5e0b2464402a8ddf32f0c5b35658a8d636a8861c26eaca7f4f8bf86c6756ae84beda47bde4c066199a42b74c873b26c3bfd3ee9c7d05a268a78485193822184367fa6b54dd701fb62ed18dce3b29b6e405a9916fca7bb64a73b100598b5ed92d0d97d1e9d7cef5a3ad9c2b3a1c4d1799a922235d11f3d70ce804b25c825279efb8400000000a720b0931ea35fcc9d1fddf72aae5bd2059a79d7335b6b719e74e49d57b12bcac8a5bcf29759bc590ed57a5ffa3924f54fcba177032c3f2e68b49cd62527e74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07c95caf8d1da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2652 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2652 iexplore.exe 2652 iexplore.exe 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2744 2200 2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe 30 PID 2200 wrote to memory of 2744 2200 2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe 30 PID 2200 wrote to memory of 2744 2200 2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe 30 PID 2200 wrote to memory of 2744 2200 2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe 30 PID 2820 wrote to memory of 2652 2820 explorer.exe 32 PID 2820 wrote to memory of 2652 2820 explorer.exe 32 PID 2820 wrote to memory of 2652 2820 explorer.exe 32 PID 2652 wrote to memory of 2708 2652 iexplore.exe 33 PID 2652 wrote to memory of 2708 2652 iexplore.exe 33 PID 2652 wrote to memory of 2708 2652 iexplore.exe 33 PID 2652 wrote to memory of 2708 2652 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" http://lapublichealth.net/a.html2⤵PID:2744
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://lapublichealth.net/a.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2708
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513b7be165948c361c1cd9a10cefa8db0
SHA139e06d6f40f36b6942106affc7f1887437d52359
SHA256595756d42ae8349f710ae286bfaf74bc4f6eebdb1579ce26fd96de5b7fe4497c
SHA5120d1777c8dc64acaf64aa6a7918d97ea725a5bf2abe58db6e5a6c9f9dbb556a84a6b4836baadce0714f0db6ccd41c4a4cc362e10d5265c03cb2afda56bfb713be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf7b044869c8fd462560c3673f145e14
SHA14dac320225e335e19dda5e3d5efa05ab627f7e12
SHA256d1cedd2f4233d30a4072f7b6856374f0119743e71a31d6d915ec3bfacc84c8a0
SHA512c4e1e0adb42f54d3f3f01748729b2f7b7a475595126a9dce76428ab536f3ed323bb77249c4c1b2c77b59192e0a282f07aac32436f27c9a9b255278364a68b9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f83a3422f2d06b7475273afccba453e9
SHA1f83714a56a6c67fceb993d471f477c8506884571
SHA2561f039ebd22ee3ec4ea5510b54c6877689cffd2c8fdd6dd5178931e64bf42aff7
SHA512e3867a7effe92fb7719fafb059a85d37a4ebdc6f126153c955c608ea43a63f3e7c5eb782a8c3d4507329dcadc4ff2422d2cb20877ccbd7dc035af2fa1dc04d4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b47ab58d64e55ba3f8bf6ae2ee19e777
SHA16eb78247900372ff9f6c54b29b014b1a382ed445
SHA2561605fe85242f454e12f1dcd417523a311c1e69c6b0a81bc658e0dee1c3c69120
SHA512a6bed49512880ede9fad1c222da7c2bbe2e4c32ceabbdfff11639ca9c91cf8cae1e0692c4c4140b5d850299775453efda5e885898c90ac3ebc424ade9a2e4d9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5448207c5ca057d1f1afd2b089e512afa
SHA191d26e0748778aa23cae4c255fb163edb1dbba47
SHA256ab17791387fe6a14e39e4dbd9d25977d091ba3e4be7d5791d4f7059eea6858e8
SHA5123f00c00d967a18abf2c53f6c6f58c56e9496dbb943857a5f3220210ae12f778105225bb7affad999cf30846054f7bf08f471b5ed86c178cef4826d7f7ebd5c45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5153f460e205ad72d4cabb472314089db
SHA1a30c4872ed8e2db8dc2e75d38dc0cef82553caba
SHA25629fa87d2a49c8770490bca588a38ef7a13c6e7b5afc024cc7a0da46e9e8aff30
SHA512e440ccf5f7cdd39cd673a81b8d957b0f8f0271a33a5cf599d7cac358f943d11293c055583667de802ab333228b70d84baa9e7dbc14ab50c7f007591f3ef36342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502888cec96a18096a20b44fcf5384310
SHA1a0299af089bbb21afdddc2c4ecc5e3cb2214f959
SHA256ecc0a906568387afdee75c90acce6f0eaad2f32314b13d38e6411b3b4b0e5c0d
SHA5128983c6d6cd276b96a668c6172ceaf118993b9d9112ec174f036d984d516c9cb3bd9807029ac024a95add9b5898fc8cb91a18022894ca062a494f5538f240435c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa2f26160e0fd1621ab6fe4cc9a5348a
SHA17b476e488190149e93a4637f59c86b35b8744728
SHA256faf2ad43a3c9ec3a599bd425bf252a2701092d9f01ce10aee682faa6830cb8f3
SHA5127dd1acf8ce6cdbda5196abd8348d536fba249ea4be683e75bc555a6a104ca0b2e6472183bcd961fdbf5c3f6d01e7627b1ee28af2c14be4b585afc46c4baf1003
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55632a4ddc92669ff29a92f44e7902ff5
SHA19be71840cde21e075f7a42e08f5c147824ab5718
SHA25665c029b5510a920e91e82cb9b9c7e4716ac5d607dbf5972027cb70dc81850315
SHA512cf7461c5d7952053c6a8a1fcd712529c014fdf7a2428750bf08c572da27a27c4f7cb59fa6e50c7a576b431a72f156de694a5752821f50db44dd7466f02f4e42c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54867d65a0d61dbe377738b6d377e4630
SHA1376000ff3e8a8d655b075aed4fad7ca82ac78f98
SHA256a796ab00f2ab0c9af9a77af6cbd46f9653b9ef22c1d5c236ac28a245f2f459ef
SHA512322be716cbca0eec3e072b410b7a770436feb0b68c50950f69a58f36e2154f7f1b18a16853ba32ebbcfb10d3a9df597c857bffa1e8806680a7ef899f2cf8fa06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bd23ce1dbb11b260eb1b2b762c738a1
SHA1eb88f02c3098cb62120253a1bc8c435a70a87408
SHA256ef4d6d3fa922acdbad06a251ebed991f8db780a46a8686a52bd60bdf9650cb08
SHA5120987cbc8a91388299d4691bf30c4ce85f9445c7c99083d39135bae73023473af8f87dd51c25acc3a3e70773739bfbabf6f1992238bf32347dd7aabdb13b94c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5beb21894e2035108efb001629a40380f
SHA18c310899c469ce7bef1d779d5752f472f0f54d4a
SHA2560db18ed4ec9905ddfc6d4530f2520911094aff45c3717e1b3dd608e4b39f8f17
SHA512c630d709d3ceeaa88ead260e51c5cc57fd0b5af3b6ecf041190ab3ef23fb87704b267e74e2acf38876f1bdaddd149751fcdc996ae18a60ff120f155b4557cb9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547fca8448628447f89b1ec5c83c85c5d
SHA1cb2fa5705385b92858cc2c6288eb87d2bb477248
SHA2568db0c687c0f53945188e4e1e51899864856166e4456f1685322959452e8af2f4
SHA512c0a6ef6ce62d2c1ce79041705bb2a2be926f579aa229aebee28358c7f2516308846aef24968ced3d52342efa7f191aa41c0f07ffc6bf1f9ce811353b182aa779
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528bc36857cc7cd46235449b08b1b5cd9
SHA189a0d7c8b85c99b08e9304c1230c3aad8574c2d2
SHA256fdfa141c8bfd5ffa29c30903703eb737e32adb1b069587bee37a6dfa7c715254
SHA512f29b0a6e34100bae14ec9e70f7e15e5e7b2d05d934ac20a06d03d098ac589b93a0d0ecc8b1bc409a68d12addc0919008af7a177d9e77a36c248656f7672ca381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2b3479527329a4882f6a8ce14ffd29d
SHA12521c2c8053213a7822942ca3c5bf55cbc2dd797
SHA25651d62335e07d09dbbe8d2718ee6152e97e402edfe93bc7ef3bc2372c6dd1ca9b
SHA512bdc2243366382f97a93fb73672d56029c78e1304c00af0bea25cda86ae89dd97bf61bb3db953141f92081e42ca54c74b0d52aeec16f0789da69985b87fe8cee4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3e899ecbb9d5877b44c61798829d27e
SHA113893b2e04262ed3552e87392ca863ea65670cbc
SHA256edc184c16174b78a823401d54f9994298ff59cd04a045b36dc499ec50797e1dc
SHA512ac75662e5f7df431f96b6fdef9c37d161f5877ef53933283696203db82e2e04ee7a701edcd4b51a9694aa88008c12b2e24eae477746fd7588217ec1bd7d4a2b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5446acc548e1d0789809123ddaea41956
SHA184371e30a951f6dd3fb843cee505109e446b6ff5
SHA2569601168dbd2156b13488cc1330eea42895b64db24024ab3dbeb6abfc607c962b
SHA512f0fdaf86a7c3ae7af0d50531ed59e8b72be00c980657523ad9576e78b66a8cb3f46a4c7548f8bcc91e3702bafc3ca808f9b67fd7f3c1472ecbb1b8f98dd8e0ba
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b