Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
358b5d0e3e7f4b35a2d0df5689b10c88_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
358b5d0e3e7f4b35a2d0df5689b10c88_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
358b5d0e3e7f4b35a2d0df5689b10c88_JaffaCakes118.html
-
Size
91KB
-
MD5
358b5d0e3e7f4b35a2d0df5689b10c88
-
SHA1
25e283f7c465a332d626afa4a230a813581505a7
-
SHA256
91c6672b0aa627ab228d54a9cf107b65fb861739007d5c82014f5183b9c084f2
-
SHA512
b9027d24ca67365e80d9debf8d4ca4f5059cf6a0706c10c0e3a51de14d067bb3715e9f0df500b6c8e21e553c53006369e658f1c9af38e7085267778cc0d7d093
-
SSDEEP
1536:gQZBCCOdJ0IxCi8kU3piYQstxrYnJuT3XQ5nEayiyKKVpnKTcaiTKr0YryJUX7RS:gk2P0IxSPd
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000009e580b913893140902d08b36b77dcbd3473ed1e263f5a9893ca73f8137058e44000000000e800000000200002000000030f3351dcd4f4d96d0d73e4dac694ceee81e136b72ac02758638877dad9d669190000000b80dba07dcb2af8a4e1e26cb408e0bef821e8fa556a64023d22bb99252d838f0e9c234302d0dc47e6acd789c05abb54b167981ae80a431b29da55d45f33495c1d4e8ae0bf3ca461cb8b15183bc59db58434bf4687a250a93b041ca06597569fbb1d64573cbf3fc99fb91dfabd3fb93d348dc8c287381463c0234285a4540f90c8b34b5344679814f35036ecbfadc35e340000000e7c64a4daf3eaab8dcd9bedf18098fec1d6dfde2c7edf7421c4ba274a36dcf18140b0af212c90440e7a2897327856df8bbb42d1693057f4697a2c2e45157fe40 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A71CB01-3EDB-11EF-AAD0-E29800E22076} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000b0ea64f8d0edec76726cdb6620b0a44f94936fc1496c9ea02b3e1023029e1dba000000000e8000000002000020000000f05bc01dc01e1e0397bc05dda2f73e776696dc17e9a3731f80fdd54ea382dc5b20000000972777f76c5cf7f7a951f8287559165b3092eb80830b5848ee993c7c36b0adb640000000c41ada15d66e0deea679ba4f025f3aa655db02251b06ae2a375c56a3f211cda292fb73b1b3337c0d494658d0180ff0e76310e400b7b076966b5f12b1cce929e6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426791679" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e80260e8d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2644 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2644 iexplore.exe 2644 iexplore.exe 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2664 2644 iexplore.exe 30 PID 2644 wrote to memory of 2664 2644 iexplore.exe 30 PID 2644 wrote to memory of 2664 2644 iexplore.exe 30 PID 2644 wrote to memory of 2664 2644 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\358b5d0e3e7f4b35a2d0df5689b10c88_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d65aecb2e9c2590a9539e4baa10212a1
SHA13bea1e007e37fef7f900f2888aaff2668b85db46
SHA25677898aaaab82350d6c17840b50b5d68c00d6b017f7c9335d69871784fb74cb4c
SHA512cfb6b8b0ea3c830996f6496781f038d29936f7156b406b0679c6a98ccb302ccc2d696c3768c82a4daa55a4f94131e10560e674764cf74fdb276a09f13d278fcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56730269798d226df3264ee0214ff17d1
SHA130b6166d566255b8372ade89415f38a335cd5bed
SHA256b514d2fe3e749a28b7dc2923c2934b6bf511f69e4a88ffd6a2f0bc88623381e8
SHA512ae8ba352de44844a5b22f9ae90dc6f6a165c17d85642b8d3ee3bd71fd811b2b5abb9267444623e5feccffb640ff324d62a055195e2f422da2aa2a83b3440a254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cbc4be1e6992452960c496e6deec020
SHA10760e8c639e4a9169ed2f8f4892a7dce643f07b2
SHA256481bdaa434cff42b4a804e7ca21275503ab9e16388b16c37a75519ddf162e71b
SHA512902925613fe4834565d902b28d2a1e1a3639c59327339d4d3d5c53d8f3cc48e9286f230b175aecd42bd5e5e20ce4ab99dc2d858b7bcb76e3e9e62b8c565062d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bac0410fb0585cc123f99f86d83adc8
SHA11f1c64dc3c0515d529194d790f722e681c8874b3
SHA25664a7f49e0debfe1be8afc31426d297929ca7c915fcd39ec108a15c15fdff36a4
SHA51234957a0b18b82880fba15333307cfc49286f3b5a087ec76dc955280829683ecdc1508112bfcaa2d760dcb5293decd10b44fca7018a1d54b82af41e6c4e5af544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d740db64309338b1861d4785e020b193
SHA12621c43fc245adff202f92d5df23948be118c87a
SHA256827438c9c8cf9c3779e1e8e164ef008c9bbe92568eecd324f7bbf5bb6bb5434a
SHA5128ad4b5140c5a6dfb87af2ea8e1b70a35d7e42c9c744c1498aaff81cf8d69ffdebcf066d91cf2b1a1cb074daabe4059ee835c9560ec2b392111bf11de19464912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596146810ce4ad64651a73c0aa0d06725
SHA12d0472b1fe5a1f051965b2c3aa2dced1e7e76b19
SHA256ca2ab06631dad42252c01671da10b506ba4e4cac53918788b46542af333cc445
SHA512c004eff7a4e7e7cfcce6c8258c1b1ab7ea1b53750854c1a77085d7cd645ed2e333f359ea24996983faf701a4ec1c8eff7f67a7d183fc77f94c6a0d5515a96018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7813907ba454b6ef0b4730a240eac2a
SHA10bd3642380e8eb0cb485a9ca4aaf688f76948dea
SHA256b38c11e7a3a9f251d45c24c98c9697e7502db0a04106fd9aec806c929ffabd1c
SHA512cff23a710b7e796c11da2f7ea858167e6572bd7532df7133b182931fbdeb5f0c8de1e3b2d048d49d4275fae0f239e6f8fc1f49a7ab85e5e3d11c1a3355dff92f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9d12ead8e1dc740f1aecc0bf9d94607
SHA1d7cfb597d98282cf8358f4ae95a2af2743587c50
SHA2564c76c7d4f77f5ba1f6abaef04374179e22d594f2ffdf5e87a662411067fdcb4c
SHA5125b55c7c0ab8dffd245f004457eaf21d805eaab3640168d24fb42f8450bed31f65edf3b5d6cd076af935d5ba3efc41d6340db3fae795376d1f87bc87b5bb832f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5ea2438b430b3d90431ae315063ddb1
SHA15d5826f0658ece0d0f9d72a5b21023674f50addb
SHA256f5666788860199358709e582cab9f49c99e859924db258eaaadd753c6fb2ad59
SHA5127a71d9bb8caf5fe3f01a1997bde28cb9e9ea359912202c245b952716ebc1f2a108fbc83bb83b73ef57d6f2b549290063609b8cf0687a629fb15bccfa9ef35965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5676a57fb784268b6287a394aa66470d8
SHA119fb71eed1e767888b7d2293ec167904d9354212
SHA25612a953e8c6d78648afca600ebe9cfc897352cf98adaa887b654c61e88d28d283
SHA51252edfaa6597ca7f111e8d0c86930e9707bbc209290344f2cd582b859c1cbf4a9d3500e1a6f7ab6078d48c862f06da86371e575ca41a0d80468da71bb8af3e47d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575396a6ac96936526da4715621b30da1
SHA1e5724da8ac1afe534d8443869c85e7f6b96afa42
SHA256b523e810e95e6b935c1a1b3b0e1f0f86bc0e1f755990d756327af7319f1d4140
SHA5127fae5ccca1e1ee88ade67bcff3790db3967fe27e81b854de6b852a7be436ea466b4775aac41b82a518af6c7d20bc6329ccbd4333312d4870c5586a37548b536b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54836aa975eb5bdd04103952763f290f2
SHA158f4bd1446113e470565d535f0222de98c371afc
SHA2566c95aa7f6339af910b6880f11de8c5ec05dd687836d3eaf590423941410e9abb
SHA512f43a590afddc5be40c1e037c273311b68f7c637bbcba5d65527ce3e0092ce83229ba09bf5919ef0178475f9d0d248bf78d6f190f9792f2bdf19bd8b277d7446c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599731835dc9af3d65b1781d0a3f6b09e
SHA189d1d8f11f0f2babfb534e41d784cd1f6a6e06eb
SHA25676d77b502ae917810a88c58aafe1013f87b3e60b1e21c17c085f226bf528f0b1
SHA51235df63f806b9f3404b4393d31c4a5d9c7ce699b6ff35a931a76a77e56ff5f16ccf20094eca95709604fc0ff717899fd30b148dd32cdd5a93b7ee2ce90abc2053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e648eb7ce1d49ad4720203fc95ce9ab
SHA123b661013ddb43c260c9eec5b437dc402572ce36
SHA2568aa89cf0e22a325525bd0c92d0e35d6d67c1d494f6a5d020c0b5c64397f06c6c
SHA5125431646ca3189f32474f4baf3718cd9d36b927590986c350aefa54db74281d9a65c26720a12ceea8b4d83311f5c6e4ca8599147719760ea13456f990a954ba97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b133057046d337ac56bc976a972f47e6
SHA1266a9d185bfcc03bc0801170c13960057151112f
SHA256d97344291aed12a5a8f0f7c11be45fcbb44ba9b4ed28aefdf6b41ed7e7ebc05d
SHA512fcf62f30a3e33649db8b14d178ca83cd1e7c1fcc83e45536098ca55d344e184245f992f1b1b6286864c0ed7376351511a303ca4d2ca7015980af42d2ae8b8720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1a3b3f380d85272996c02a526408754
SHA1dd9a25609c1a83c32322faf245208a7a961d42fe
SHA2569050dd0b43131ac21a5a6ecf9484f2c60c25aaa08f88a3642245c2eb3fc37698
SHA51285480725bf47284e0f932e0c03846c3ba3ccae8d17a68d04395bdf57ada9f001b0763f30b74facd8b979bf4e1b71d9008b10377940d50abaa45a18f97b792f71
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b