Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
5e133a93eebdd6a04af5ac593dae0e58_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5e133a93eebdd6a04af5ac593dae0e58_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5e133a93eebdd6a04af5ac593dae0e58_JaffaCakes118.html
-
Size
10KB
-
MD5
5e133a93eebdd6a04af5ac593dae0e58
-
SHA1
3e7743b7339d936735fdaf9e619c92220a25d598
-
SHA256
6280ebfa11ce1d8412558bd90ddae46429c5163b4c95da4d8c6a7a5f28f814da
-
SHA512
0dc0ef6455acbad5fba9da7b4b92fff8492f0b476532a0b1a6ce14deae4dd23c084b24419491161bd445198307a84c559cbf6e8fc25f9f6b8f552d253f38b322
-
SSDEEP
192:Fohy15Mkz5GnOXwuhqvEm+DUX09qKeITgtpVMOs701CIgteSpOx7AcotQLcwux:6g15zAEQsHtQ1CIgUSpOsa41x
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000b0ec94f4c84bb6859850c16d5f490a31cabd56bc8b1ddb2c4745f539740a1065000000000e8000000002000020000000764fce403363993ba44e518b22d91c714973a0a97ff3a9246f111514444abb702000000093790290502b63598bb01e1ad0d8a8080edb073d7ae077bf83c01549c6fc53d34000000088f66acd8a81c5c1d4b503c4a509940df3c6f26d39fe7d7b215d96a276a3c789b003c91797c587c772f21bf03334df4df0a13fd6a4b42ce4703dc2d949cdc57f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000064ecff7a03356b68b0ef66c85b548205b053d028187e5a3a6260d54aa49e6807000000000e800000000200002000000048226b787540a3e08f201fdaea840cee7ae9295919567c6aa11a09618a511787900000007a1f2a97e6612e0d8d4054fcfff2340ea424ef1148cfcfdfac3317f817f66c57d34d73936ccdbf9dd5bd7e10b224f65fcca75fa46f27b9ff59109667bb64abbf17a396b04e22bc2cb790ebdd6aea137c1ea27b7f74e028230509fb16ed56ded1e346312a6ef212c690affd07d01a5f07658fe4dd158371ea23f80b8bd9339671a82c0f830148c696bf65abef723af0c6400000003557bf0a8d281c490477315c18c853b4d1df08628a847978989e95207ab9a6e0b0ae3456335e37634c0953434814b3e9f62c69186e1a6ed8df631e493e4ef421 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08ace6831dada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90C986A1-4624-11EF-8705-5AE8573B0ABD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427592715" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2772 2164 iexplore.exe 30 PID 2164 wrote to memory of 2772 2164 iexplore.exe 30 PID 2164 wrote to memory of 2772 2164 iexplore.exe 30 PID 2164 wrote to memory of 2772 2164 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5e133a93eebdd6a04af5ac593dae0e58_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580863e323abe2edecc3416aa90c125db
SHA107eca6ca5ee99e094f9032418a5786fefd11d19b
SHA2561cdad24eaba75a530b560f978bf22044b68e62a7ee1eee8147a8bad16e7cdf36
SHA5123d130e8c60d249a0d434831ffa0c2aea30dbe4276dae1fb204484f4072c8dc8da47e274bfce6a4d5e1051080422799d6fa3fa807945de0d04fcb47a0a1bbbf3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c1768fc58487da75f9fa1c494647a9b
SHA1b03691d10554cf19f4bfe0837fab64d7319fffac
SHA256177d713601275386a47b61ccd3477cf4003f3757333951c7d8a5af7526002a1f
SHA5128f78489dc00cb2837648696a50a302b78787f05e1fb5840fc9823f14356ea664fca82c5e2ab758d2682d15705da4b03330517d00711b7fb6b9e5365b46225853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547b9c573bb4ddee66b7151a4407e41ea
SHA1b80d02ea398f1e7571ad0b5ec9e402aebcae4252
SHA256190e93478b909b87972008cf1bde6d069b18909c1d076a00e4c4d2b66e21c39c
SHA512a2e73df064b54521049a183a66267a5438689a8e01646bc39e1250993f4d833cd72ef6f60594ee56185e0b169a86423c916a351ed7e8b897472f94ac9c3729bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561d4784ffc5f7601f71d72210c0aea8b
SHA1a7a22562af95c8d8c91653ec10b0dc3528a29d5c
SHA25694f71134df46a556c3050a8ec222538c64942d4325976f327dd42f94b7a12a32
SHA512b6b2b048598894e18d9697e7d3bbdf825ef4bde9f5a26c984d083ba4850af2089adc226b1b060bc285dad9136059193644339157f69bfd57ec78b5a2a73f2d6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b897649d01fc1029ab1d63157b0d3deb
SHA1619d916bfaaeb92ceffa63d1e7514c6cc24d90db
SHA256004b9c2b10bd493a2593474e23d2356ae52f0a391259cd6a5e160c74fe8a29a5
SHA51248a20ec027d4363db1a338c6279953c9e9588082e679f1ddd007241e4a0de59a5ff55921358ff08905b9edda1c76318f65e3862bccd3c8e7e2e20ca671e29eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d18e28c1512f334264d3bf6a126b193
SHA1dda20e56e3bd5df8b494ae44a91b7be9a736cc05
SHA2567f7500db40e286fec6dbd310aef72c52393235135a71ed90bbd7c639d6909bb1
SHA51253a3c2f317305fd4675451e16c06926e6c0f60e55a6586723d5123cf356645e99fd8df6b2f9d8d69e0800e1163601b480d1bb5b751509360ede38aef5f7c7976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0c4604756a841df46b033e2241e4702
SHA134b8d45d92187317cc879f87f25c71af54cd7be6
SHA256b4ac88ad002863db9d000e3627ada38d064deb999d5b7906f31c9879ae51faf5
SHA512d530fd50dc409f34c319765721cc6c613b425a5d37c225c001d8d6242f19f280463892cd462a2aad188b5e7a7242da006f133c1fc9c590aaac666069e11a82d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a766b98274c61ff169a699fc8936e457
SHA1a5716b1e3cb26b0b5984ac2de1ed5ece96c5958b
SHA2565f107cdbfd7e085668b5fbb9a2e6fb0de2b941bd2f1e25b23960b80cb0ffc9ed
SHA5124c30e2ef37184799470072b23f3e4175d114b761911fa2cb4dbd631f1e84f6701522e8ee79441f6e36b301fdebcff5bf2cd82a6610337a3594c9c1e1a7fd69c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb3dd4779ab7d8c2800533abc431d021
SHA1bb305cc714317dd079ee8e10bea2f035f5497ad8
SHA256d7a28f6c6f4a488beaaf7286d01027b8a1ace34caaf70eaff4c710ab7b5ad46e
SHA512c9f2df82c52607368452b18fc1db8d62a7b9af8daafd13272ce525d0dcd80502af7cc33455fcd0ec117f24b43ddb25697cd24e329b1c6e4907e95d964262953f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578492c0c3fb12f4f0c87c940eb7a82db
SHA10b593435d9494cdb5380b04e460da0b69ac7f097
SHA2568157e7fec225a7fe743ff1b6741dfba6752d6f9c5a7180673d43f2f97d8b412e
SHA51227fa093ca85b3f44e545b6dd6e26cc6227f5530fab4a6a7b8a4d381f74b8995cea8f6edf4be4575480dd9a2ba70822ccb649086d8f7f10891fc0fd5ad32eb1b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57876ed40e7bd7a79ebb6ae011790dc5b
SHA109f933b1fd6ee81806646c09102f33f71b54c516
SHA2565bff1a888b4da861e2e7846b01af8b6fef7c44f538af649a0cc3e96ed32e4949
SHA5120dacc2a6d634dd0bdbad4a258f529c4befd38db69a42c6ec05ea8a12134a5c1c80d0eb9c7c8ad3f9e20b1bf0c311e583f40c3864d90e9423d8e13d2cd7d77b10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1eeabd1f5f726da0321be3311834b41
SHA1ee3cf19b524d3b5a21d264d2171761fad5553708
SHA2567b16af04f6c3f0df5a5f3f863c76cefe731d19cbb8ee8b80d7c946b6260cc33d
SHA5128a494bf16d75f2628a83ff18931188fa7db3a0e6ee1fe7a7eac0d94cf569856c3fb9b7812bd2b7080ee3375a678ba7fa7f010c555a3e9cd5f4a608b9b60b4f30
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b