Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
5edd7326d182ffdd6d1f5d9312c3d4f9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5edd7326d182ffdd6d1f5d9312c3d4f9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5edd7326d182ffdd6d1f5d9312c3d4f9_JaffaCakes118.html
-
Size
747B
-
MD5
5edd7326d182ffdd6d1f5d9312c3d4f9
-
SHA1
45948582022bae0ef0c3f0b0459479198a0eadd0
-
SHA256
839bb7bc664aede20dcde0cb815417b87c99d903d85b7ec984912857e311264d
-
SHA512
365145e681925fbccfc46634c4b756da49cf7de2ad87d92477dd33881f32a14ae0a3dfd505c8ecf510156b220092644b0c6f7f7d2ad5756f4fd1f95c961acc5c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000008f2d6cd5fd37d5ef129404785f17f7f43566983586713c6d1bb4177baca9416b000000000e8000000002000020000000444cc475029d11607b7b982598c1cc9f1461ddaefe64408e7d4cdc3eb67ac77320000000ce571a2538af19ec892266108f1b89f767838e38e30191c103322bb188e3839f400000000b3e9b2fe348ee20aced51c887204d2334f84476a4c7c4ceabf2a5e56a911265f8e645de063f0ccd5e6e560bab06677cd454eee1d1e7bab3f3ac13e2ef9a72d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0272e0455dada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000080f85a003374624d54bf77f9a7a4d59f03d13e2acb1c130b2a81f6558c8057ac000000000e80000000020000200000009db6980b53da9f2999d5d0a792e5c30e50153c6b5bd5ea7163cc5aeee39276cb900000008e1e7d54525b3ef967aaac6d60cf6e4287dbef52aea714daa96e714bbc4545b6ccba080f6864b2b73646bdba12ceab5284dd3e9cbe404645480ccc2d0d89cc4cd684247613df668424fb57f99a5fa36d15e29900b54fb993928799f37635739e7447ff719665a381da0243b34260a4ed6e332ebc6b47fcc552052117b512a05fbf5a9d2e1d059e3cede3bbaeaa12b376400000006d2b5a90d0e46a2b38fb677f2c1d62f6419da465979b82586c8483fd1e32d4cb48eadc82598ba9da08700e3627cc266f4fb96d163eeaff48443da2c7a84ebce5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427608026" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F298511-4648-11EF-BB9C-566676D6F1CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3036 2268 iexplore.exe 30 PID 2268 wrote to memory of 3036 2268 iexplore.exe 30 PID 2268 wrote to memory of 3036 2268 iexplore.exe 30 PID 2268 wrote to memory of 3036 2268 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5edd7326d182ffdd6d1f5d9312c3d4f9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD550919bee4c28c664fb0e6c40b8ae66d6
SHA13aaeefdf04b70bc37ec62a6b09190523a2540c18
SHA25604779712f3d1770348921f5e39ba211b6f8b64ce341307dca5d29d0429a1ddcb
SHA512cac41e87f2337ec1edad775ff33876f3be5c54f191e22145bd32ea6692c0f1392b004925145831dd852a63f38e1f1aacb122f43f9ebae10eeee67da4f036d46e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ed5df83b9df034e3abb8cdd56d253411
SHA108b7d3f282959ec5e9e7312a74ea0f85e458ae19
SHA2563064239a2fec167a2b109b1a6b3fc211b97e3c6111385c0ffa15de8e34b23c5b
SHA512f014b6bdbd526a79b3b3a4b2b2757ecd076e1ebc737b43120666c02ff83833356873ce94043432c521a8e235fc3750bbe440d56bf556b334865d7d2f275e1b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD579beee3490d5926f4f6154fde9fee2c6
SHA109f1c437dada4838d729309dcf510426215199f5
SHA256d52aa6c2aeb2de7134f63aa16ba70a802c922368527988a2be38db499c1051c7
SHA51213408ecfe9d65441b18de4f4f856507022ab0bf2d4a0b7f7edceadd97dbe83496fe07ae49b5a6c25e5ab242739af3c0ee0c1aecdac3846df1bb3adb5f5dab63f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5695f4ff0ff553f05af803e99e3f5885e
SHA1a8eb696abe5edca9e32331b9d2c967cc9ca9d7d0
SHA256ef087bd03ab0b8e53d2e47259a285ceeca36266a291c030418168388be6dc1f7
SHA512e44d0dd2f9c01c9cd6ceaa55825b05dae700d1e5df2f5b947d1130bbd5a0421b1a62c7cce6377484baa16b7bf71714f187fa9fcc867180b4007c6310c06fd565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5939ade772be4c0c4db2ae0d520988509
SHA1237c12fa02e1b25eb32b49534e7e9b61bded38ae
SHA25688ba9fbaeb97667439c12a724a42eedc54e41b522604b1a624e8451287805e61
SHA5124da7b3d9fb1b8ac297c9a3e435ad09f8571cb4e502419108ed717cec252534fbeb70c0f23170758838cc782ad2a51c6881f99fbbb855f7038d1fc8eb5140d54f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51a0de500f5dfa8270a4a6feadafe21f3
SHA13c95880452279c355dfbfb46a5a67a56d72ab170
SHA256f88973ae398f5abf1d327ffaf6e7092d412f49e3eabb6b45209b852edcb03524
SHA5123a9dd8a3b4b33a926bf6fa4776f2048dcc77802045c65e5a2bac5842e372a019d41124ab9f41b649a5c0e147ea314d61c2e7d847b581ab66ebb44929c635762d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5726519153b27353fd941207098412196
SHA14959ccbcf7e5e53002e70f15fac81af7d5cede31
SHA2562504d67733a818ab34e12c7d8db835ca6d5c23768ab6cd558e6d4f6153d4c538
SHA512fe267ac2759cf1519c766781da1855c357598b60eb29e7bdbeeb30705a1490664d7eae9474c351202c18bd6416d9d740da23a9c6b417b95f0bc23eee48d8f23f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ae42dcb68e3500a504c27620aada5d2e
SHA1c801820a3c85dc8ac7cb08a98ed22ed5e9b76ad5
SHA256f006cd2b2386d33c979a05d7077fafd3e8c7c09710a60bd7ef1564ca1ada4dd5
SHA512c9037875185290080f784dc472b9f4022696e69d1a6192e78a76e48365e2a3479cf5c2db56e8b022e559c0054335be14ee75b3ca632b71390091fdf0ad3ff492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55ace50f8b661e74f90f49c37cbc1865b
SHA1591cde6167a66436246144aaa611c23d270c4203
SHA256797764949c0873eebe9e862edf984bfd6fb03e3f39098797ebbe56cc7017fedc
SHA5128474f737a3002afe5dfa6b29438191c69ecb36ad9ff012145833cb8ec7ae7e2b3498c68f9315266eaaffbb3458822543cb99386cace6dbc644498babeea794da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57bebc0a39ff83274ef331fd52cc63cf3
SHA1e74979438b533394df983155b43cce568067c740
SHA25657425884c591586f3a06ff921b37336780296560802023a36932f74cb5a5a0f3
SHA512869d1db6c458a7b06513fdac4fa7cee323baf09cb4d3e7b96e22aed35c3e085577ebeaf5bc5e415cc28e1b63da4d1f6af6ecb4835173c90043b6589ed60393e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD509d4fc05935f7e2e598ee87cdafa3b64
SHA12247564d183a2b768a24cadfc9a54edf42068199
SHA25649c54cbbdb6472a2f6d3297c3550a03a9608b53bf5a85147a5594e216b96a4a4
SHA512166c8df1eb9eb64599aecd9d09ef51033b9464bb490a272af6222e7e3d18d8923548ff0562942687cc5d083150b3c8714f6e77ae592aab667bb661c6f851184a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD579f72633fcc5e58eed9a564d43f3835f
SHA1ac290ef510ae9e0807a303701849cf0a699ab38b
SHA25630a182f0cd0804021957c775bafe69ebf1facd96b32ac0be2168d39ff7fabef5
SHA5120b1da020ff069551116774dfd910f4e0b1b58f674356ed32d7e58039e4b437417232d8e073a202efde247354721c2f9104895214f4cac859215768078ca4af86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b77fddec43947d5f085133303c2134b7
SHA1b71190c8ce7878a728558cd9fef73fea0b87ec3a
SHA256d5681ec35458162a42277258f16b1f741953612edd4ec50a139575c2080fd725
SHA512881918c955d17a609950d19ef6e93db44c270e3fe4ec4a04f33f6b5eac310c1bda7b5b53247a1679abec9ac8f722c4d6769861a8f8cd38b6142a6f36a231e4da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD524fb6c53d95c533fa4ee539cdbff265b
SHA15fe44d62d0c396d2c5b81fefb71e970863557872
SHA2566480081889691d09fb3e3518ae3b088084e1d8bd5b7fec7b9e5f6066dbcfa0ac
SHA512c2ebbe7da82e97569877fab3af65ad9ea88d611cb642c95ee90e8cb011b5103ef955783d6658283e717fb14d98a3091683e0d12bc02b67497b20507d09db1c68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5857b20f7943e512aecd0b4aa81a3111a
SHA1903f12695bfc479d6090b9d35745e656297287a4
SHA256458c01cc7282cb993232c8375fb98274464822337073ce067c5074f35754f3bc
SHA512339712438b6d199c256844cc465f994919a651deed6e0b1154e2d5ba9921bdd5f6571616a1b98511f72bfeab1329354313459ed303d5b0c408eb8b21331d1991
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD541ea2f10ab8b20180927c48473600cdf
SHA1b495cf50a446bc88835ca9e23a2b79b480a3a30e
SHA256f7a2225822bf1595271c5c1d087732e13a946b73b6264c9886b063bf3e1cde56
SHA512d863cd60b0a0480888e9c52926e56e8dc51e60b9bd6185f687dd721431af62d4f119a4a0a3be81f5f8576a0b1edbf4ccd0b0aa692b3e1cff38dc4c60262d6f2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59dcf8775130b05f8a45ec524d28f7449
SHA1077b9d34b9d5ca7682a069eff8e57a93666e3e8b
SHA256173f22cf6332e37f91219fc2cc3fa08498dfc854ea5811c7b333134f877f9ec4
SHA512d84c416239fa8a0858b425b05442456d2103f37b06e41d7112105c83e4c2fff47a3a9682c96ad9f71b41bccc99211282b6c191d4214e399ea8d211bd39033d48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51d264cee15bbc07968dd9846fd59948e
SHA1c03558de742742054d58d9bf0d7ceb83c214c1b5
SHA2567a43321d455ddbd8ed1bfed97565b6db42a2440f3c01dd3340d387c58cd9f740
SHA5124b82cf8927e0dc9c5ea5bc101c2c93526ad4c5990bf541848066d593d2db28c3b4ce0690888b6886973b3175f4b2381535c3563f3336b0e0c42707d16c773778
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b