Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 07:26
Static task
static1
Behavioral task
behavioral1
Sample
23cf0e4e370559100259522689607dd4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23cf0e4e370559100259522689607dd4_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
23cf0e4e370559100259522689607dd4_JaffaCakes118.html
-
Size
19KB
-
MD5
23cf0e4e370559100259522689607dd4
-
SHA1
be9652f773ec3106c2d8bbd0996fe98b506404eb
-
SHA256
c2992a2dfe194b2264f9cfca0457411d75aa581cba63006bf7d10b9b11a98d2a
-
SHA512
09e6897a113b9c701ce2ca3f731f334105bd3a93cd3e93b8d4d853f587ae55df96ae89a89f9eeb3ce8cb38d9ab6391e3001c1c4adbf644ceb075dfb684baa36d
-
SSDEEP
192:uwb+b5nAbnQjxn5Q/fnQie2Nn6nQOkEntZdnQTbnFnQmSgHMBWqnYnQ57NnlnQVT:EQ/LqCN+l0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000055347a5778837f9d63e18221941fcadd6e94382e5998a7ee3da975287e87a723000000000e80000000020000200000009e41b2220d7f4a11643d8768a242fa6c2918afafca34b8d6f0b2cb75c89c017020000000ca0c0ecc00e2d3d86c3380595a1f401671bd6ad81264af078ba2d426710fcb3e400000001a53823e4859413b841002ab34de72468d4f12662736ec8b1df2c77ae3d637604409b1e9d62d6fb5b8bda6093c968c0c21c777029f176299098e1896bb26e636 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9056002319a1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000035b006d194970482e1b7e5a575a9e183e017b73615938ece716939fab7be59e2000000000e800000000200002000000063fff89bab2207d47142b95edd20335901a3224281242ea88e9720df8cfc8287900000006f53a22e0e44723a216ffc48996a3eb84eeee7bbd5de8093fd7c87f4b3e87fe503c2736f04ed1111a38cb94e9eb17470096bbdd1e6b9021a1cd85f10c3b126afb3d6f91bc4227ffccb2750e3c0f13c898952289c597f07a1277f7bed60e7dc76b7925589faa8b74c15efa99d3e4ff8e0dfdde166626831e3c532d70e208b574303cfe1b302328dfdd31d588c13d9cf3f4000000076e6b16f356ea0bf779cb14822fb8d13b66de769f7b3b3540ff4f03a27e23404a8f6aad15cf2f1534e6aa422712eac4d2f0f0db698f6512a02e7002008bfc803 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421315065" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DBECFB1-0D0C-11EF-97FB-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1808 iexplore.exe 1808 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1808 wrote to memory of 3016 1808 iexplore.exe 28 PID 1808 wrote to memory of 3016 1808 iexplore.exe 28 PID 1808 wrote to memory of 3016 1808 iexplore.exe 28 PID 1808 wrote to memory of 3016 1808 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\23cf0e4e370559100259522689607dd4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527d5cc771701128442229da0025d5b8e
SHA15daa5815be460be35f48c224e4eea780a95a5d53
SHA2566113f2a829165f970feafdfd56ff1c4bc74de7635d953daf77364f1e252e7fae
SHA5120555f0aa42c2ed7dcfa109d4b25570baaadcb3ccf16c0f3471d429e67ffcd7ab06dc87b517cac454d87a095aa4cf2bc89cee401a4d2aab029e49c751c04939e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffe5d903a3b16ef3291cc7f44daa0229
SHA15ab6f3b74d5c9fb43b869089e52d1842882563b3
SHA25684d9fada398b36379e52319118b1fb4103a08bdc42d96f7214f3c9a604be21a6
SHA512d932c0d48179993e3937b465bd7726539591050d0e602b15d40bdd2f281613dd258714f600931c89e10c78f0b475ec2619c1b6b99c2ace61eef51b70352552f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ac78d9ffb298e7418ec3adcb5a48d19
SHA1d659620676a870111cf4d6e76a9e723be103b9c6
SHA2565336061258073e020b3d2e6f00ed6f6acb6424f0f3e3866e2d4e3333ee8c0095
SHA51275a88a8491cdc66710c9d6df06dcefbcd5d1ef1215f3eb6c3841ab82166519eb75e10dc6ed0fa6a4198230d5ac4cef2f7c9c30f0ab9a2bb3ef43d2d07bdc7a98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530d7709a027358d2f255ec3da194255c
SHA1ece16f61d77e085b1f4383f4a87cf849d7065f8e
SHA2568bb471aa131d956d5228043a205d4066e09ce534194f95040d01614ec1b54c8a
SHA512ae4de3458062366ec01b07824fc4431a776c4a58f73a8a7f0a3b9e4cd1df270c6483b1cb3e8d1b1736f18da7c519f42ed71d038146f8565487445426b4c23146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539ee312fe2d2bee0bef929e1816dcbc0
SHA143d53e9b3d42935f53e886593fa10ddf68390dee
SHA2569c446fbe5c9ced040b3cdad2d1a0793001ef3278371ba58ceacd89cff8733501
SHA512bd6c2f3c059929e82d04636d36c160785bdca7db79bd28a05e2998ab31c70f6c6082371ae38c2a88a0c9cf151605e4f10c67b6ea0b92886731ca67f27143ca26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f9f2ed3fa99aa38ceaa0d925bcf1548
SHA112e65445f7108ab96a8fb30f6243129bf0e1679b
SHA256a53cb6c9ac135af9572e894f220d1fb3d72edc724c2e8f324759fbaa863e3e6a
SHA5120caf9083969a4d8362f7a7eda029541af888dff9ef1f57b771525f8a06db6b994f6eb9521e50324e8688633555e6d66ad530b0bb47fffb144678ffd69b09e67b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f4d7fc4596797ffbd11f4b5d9ee8d2d
SHA179290c9c1f5afed3c6f503379c7abf3764bab6f6
SHA25687f156939d838f944d8d3201c1219d8ff0ee8960bfdb786bc34eed8b2ca24194
SHA51273bd0a9d2e8718cde464719dc672cdb59e266007460714e3c5393e8231c114fbea554751e257d642085a25b6557c25e3ed39b518ffa6a1fa3c9aa7eee8b058d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f8949d1676d5aadee07f0540c6cc447
SHA19548dfefffa112878e6fe4bef92dc054756a70b4
SHA2569067e1873667a8d79dff49691fd547b40e38cd7d24088bb918747086dd30dabc
SHA5120f665f63c33bbad11c0e67f828be9e31dbc3cf344500b6192303434e21fee735f8e16b5f8ba36a80419f56ade49862cda07dbbc753f2ef62f04985503cf70ace
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a