Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
5f65fc7dfaeb3e1dd6cf5265a9f649c5_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f65fc7dfaeb3e1dd6cf5265a9f649c5_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5f65fc7dfaeb3e1dd6cf5265a9f649c5_JaffaCakes118.html
-
Size
3KB
-
MD5
5f65fc7dfaeb3e1dd6cf5265a9f649c5
-
SHA1
4fb84163ddfbd1c3eacd4e554107c3385ef4f7c1
-
SHA256
3aca5f85e11660b07949de2910a683a9bdab64c8ac7ddaf550eb264ecbd6afa5
-
SHA512
ef8ca5b08beacf2987f0970947bf9f4d848ca619ca9263fc64b60edcaa73238a7baf92b9dea4628bf25da31abb7c739e574ff377520276b9d49ecc360cb16519
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c9f5fc6815c9cd38b2cc8c152388bf13d03f94ca153273e923c9c8db6a3b0e9b000000000e800000000200002000000070b5d86eb2824bc29159bb5f421ee5f41d113d7d02f46f063980074b0ed7029f900000008200067dfb94d23a49e1dd40f2ae08242abca3fb0bb8aaba85d5705d411b02279782c8b1cc1687d0207010e1eeb0fc8880d752314e14404802766857571f08daad942b2673a6c089f8e2cfc415dc2bed8205426edcaaae7b147c51dc07ba0c6ec6f375d3ddcb79577e947b27113eaffba1c8da990a85e003bbf4e86cc8e3d9eca73cee11d1e86ce673d0c085fb7eeff24000000008c308989f1bf16445c19556df34884f5529caadeee4fac363b35d783d1bd0da26ec55d99157616d333b513de270d3a8dc1de89eb9c76a496843c64f3b1e47f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427619207" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{478B75A1-4662-11EF-8EE0-F67F0CB12BFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007f09498e7ecd6233dc25880aef48cfde715ce2ab737655379dbbbd9cc06649d9000000000e80000000020000200000000c5d165c0a7c4753a4798ec123d7a7f160fb16ea7b2eea3932f9ac2c3921a855200000007a84ce7e6c05d474cc20925c934fbc7fb645575cb4aae47318efc7180a4fbb8740000000f93182fd2cfd49090539ead00ac2a8325eacf9b9274b360dd2013e7d0adf2e01ac6e2328ec943c846ca05a06d40fe8989ce94f93f120283bee7fe25045dd812f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005d5c206fdada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1612 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2568 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2568 iexplore.exe 2568 iexplore.exe 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2568 wrote to memory of 1612 2568 iexplore.exe 30 PID 2568 wrote to memory of 1612 2568 iexplore.exe 30 PID 2568 wrote to memory of 1612 2568 iexplore.exe 30 PID 2568 wrote to memory of 1612 2568 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5f65fc7dfaeb3e1dd6cf5265a9f649c5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3460954ef237b8d92b8c9f0364da95f
SHA14b7e86f653a09734590d0acfe6c1b70ced1760b2
SHA256bce85a332883bc217d29eaba07d2f485be7fef944d3a6681d32190cb94d534be
SHA512a42ba0e67eb96ae554b7c14a72a8cbff4b46ec742521a8167c5174de79121c6126c5c777d987e244eb0e3e78421833e38c64e18f4bf4cc0e7e104205f058a9b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c44007ed0185668829feddcddc86adc1
SHA158626f1f2013ee4be2d9e72870b82cb093447650
SHA2562cf6b4293228eb3f56826977e0101cfeedaa503eab45fabe03a9957997bfaccc
SHA5123ba40ff58ca8026efde83768de78cd5ea1545270ab2b5db794c035baa827b159bd3c877c4d5ce180fe01bcf222540b91549c86d379cf50177f660450e7d09369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555592eb24db897d4d74fa956307fc498
SHA15c540c801ca46d576ceaf4dd8aab674fe25330f5
SHA256aefa500af1b94ddc54706600c7d9c450448684f32fda4b8ee5ab63fd5a4d01f1
SHA512161827d0b937f9c8de1ce7baa18f761cbf0659bb430d81d5bb631c45591a54524a762184d46cd10da2d5d1bd389b5fe2dcb9c2003cad2aff528ac89a30547631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5d39380f368fc3e10550ffa776a33f1
SHA114bd15d6ee8443668f0483de5a4b0fed2868f225
SHA256a45a1f14a878e7869c3e1e413c65fea2218e476edd2703da2761f9fe9bcb8ac5
SHA512f19131ff6c69cc392e4220055f5c4c294243b27014b36ac73b389b7a3d95aafc8571c55d191b16fccf11243a4b041fe946f9d9eadb743ed97ef7339300999e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a16e85f8614cd9d9ac8d57665c33746
SHA11712a73bcf260f958a822e210418c37bd1f20f68
SHA25613c6e84df8ad6b406441a4dc5ff97abdd1cfd10ce68a1131fdd28087c707c360
SHA512930a5f14b982893dde6c33a97f6cc3fbce558297ecc51f61ab35bde7b4d623f75b7655e43471e1f39ebf1449651ee2dd8c2499ea07b83b57592965b19c5d96f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53339ecced3b3dd04a0c932afe92bf0a3
SHA1653470d2bfffdc9912a81b1779818d7604cb5a0c
SHA25679b7ac941cae34454b6fc2817c319471911f33971979a906f347bf7c6f2163a5
SHA51246d8e3e375adc73e33ce8b9ae5e64c8a3cef60614ce90928cb6ce992e9c4de62dec37e3f3001adbac5bbf092fc3be963df8de6d312cb57c2d2143305013b593f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e5229d6fcd35e4c8a647bd259922ad1
SHA1d28877ad34ba9c3c0951e17bf9628aabb9cdce0b
SHA2569ee8b3a85f68de168d71e1e3c428f40214aa8cc405bc25a530b958d15d1fc766
SHA5125e04d614aedbca9bbcf3a25c0e0bcac1ab9fbb75cf55bea1c0559c692a6c44aee63885204253d7185827134378ddb6922d2bd2ade964c51dd158dc6b6444acf8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd8bc55d999ea8163ce2355951000a47
SHA165d4790d1f8a2b9ea83666974a766e2b7c3b9215
SHA256a1d1028b28c7199003b1ece9623bbededb4eb3ef3a57b3f53cca7d3c64a0cc05
SHA512323ad306636f0f6e55225c8853ac44b7a143eab667c516239f7ee78dea79c686bb3178c4441c922b2d8786917c63229a654ef6323725365f9252139aaf735839
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58efa7d2ab6775b39e0daa1f1aad2e296
SHA17de07941af2b3ba961f6bdeb2d3974480b7adf4d
SHA2569729c748d09eece1c473b7b85845a3199a108bd0b5c5c5132e00e2265e10ecec
SHA512c0c7f7b5b17346b748813b8cfd1f914880b5577c8d7c923cd8e6abe5a0669c4faf9be6e70103dd7defc3249a8ead46f3f1520fb65e1f3c8ad6079086562b2c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd3c10fd8d95ce687e31998679b73ea2
SHA117ad0786a9e7623c9729d84f57aa7b592558b105
SHA2564cc27d1bd27eed5679c97d03ff68bd64072fd99f5f761abc378658ab19588bfa
SHA51265b960cd6a2aedad98eb799784bacc9d48ea081b6295b6960ff01a28eda8ea9a631ee402ddc7c854ab661b31ec6497711de6e379ab70570067285f51418f6238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5439d2bd0a32d592d041ff5afd3020ac6
SHA1940eb6e55b1ca3acc4a395bf3926a17875c7e38d
SHA256b540960da3d5ef5ee3587148bd46609fc5d22de9170c3c32c982c542282e56f0
SHA512a72cc2b5649ba588f1ffe1e483a3c273745c0f0e83ad64dd89c6db7934ae1631f629316ee0656f01927098e968569facb5492e9f13b56bb7b8f867219234de1e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b