Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 09:59 UTC

General

  • Target

    4f72e2a1125ebfeb2958626424dd0c89_JaffaCakes118.html

  • Size

    218KB

  • MD5

    4f72e2a1125ebfeb2958626424dd0c89

  • SHA1

    db61122ef4a27763bef839515f0d398cb8fcdee1

  • SHA256

    193faec31e2a91fd58e57deb0465c81f8292a254b88c4dd08b1f0c26259c0344

  • SHA512

    aeb9970af06450432b5b4d8909000d4a7c17c54fe2512eea0d46d1fe32a4191deb0f19a1f9ca717e2265f17399452ace094ff586274c679a376cd33836982015

  • SSDEEP

    3072:SvdcN6FfnDOyfkMY+BES09JXAnyrZalI+YQ:SFcNSfDrsMYod+X3oI+YQ

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f72e2a1125ebfeb2958626424dd0c89_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:280

Network

  • flag-us
    DNS
    zlz.clftx.cn
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    zlz.clftx.cn
    IN A
    Response
  • flag-us
    DNS
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    push.zhanzhang.baidu.com
    IN A
    Response
    push.zhanzhang.baidu.com
    IN CNAME
    share.jomodns.com
    share.jomodns.com
    IN CNAME
    share.n.shifen.com
    share.n.shifen.com
    IN A
    39.156.68.163
    share.n.shifen.com
    IN A
    112.34.113.148
    share.n.shifen.com
    IN A
    163.177.17.97
    share.n.shifen.com
    IN A
    180.101.212.103
    share.n.shifen.com
    IN A
    182.61.201.93
    share.n.shifen.com
    IN A
    182.61.201.94
    share.n.shifen.com
    IN A
    182.61.244.229
    share.n.shifen.com
    IN A
    14.215.182.161
  • 39.156.68.163:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 39.156.68.163:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 112.34.113.148:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 112.34.113.148:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 163.177.17.97:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 163.177.17.97:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    747 B
    7.6kB
    9
    11
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    747 B
    7.6kB
    9
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    779 B
    7.6kB
    9
    12
  • 180.101.212.103:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 180.101.212.103:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 182.61.201.93:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 182.61.201.93:80
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    152 B
    3
  • 8.8.8.8:53
    zlz.clftx.cn
    dns
    IEXPLORE.EXE
    58 B
    111 B
    1
    1

    DNS Request

    zlz.clftx.cn

  • 8.8.8.8:53
    push.zhanzhang.baidu.com
    dns
    IEXPLORE.EXE
    70 B
    255 B
    1
    1

    DNS Request

    push.zhanzhang.baidu.com

    DNS Response

    39.156.68.163
    112.34.113.148
    163.177.17.97
    180.101.212.103
    182.61.201.93
    182.61.201.94
    182.61.244.229
    14.215.182.161

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8f1a27a44397363c194f89d00af14a4d

    SHA1

    2bc00726ca8326d57aad60725de05c584a421bf3

    SHA256

    d200691b122a376792e4681b634d5033e03d4750b417c65e75e7ec3cf03cbc1a

    SHA512

    418e12ba24ed84b2a14f5a485ad3196b93e4089b1aaf906099c934b125c833fac8214a9a97a8924ddaad3358bbddc23435db2976f782b64c45ba518170850996

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f130613fc85c065b9a470d4ee0f5191e

    SHA1

    5abc9a5d37db7864298434566e397c44925d3795

    SHA256

    74e646b0f70c4fd911885c5d1b5f55fb47cd19e677d3a566a007e09c0b39343e

    SHA512

    8ef22e8c109b75f3629f664552559b27ab836ac8ee3d883b11b9749fc31fce4942d31b0a1fa42eca97627f9d154a5634c75326c116f3583d390c00801366f2b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    05a85da3f5c4e865d210d8062ad9d888

    SHA1

    eaf18c3f6c660c85b684f833b7bbcbcb579eec40

    SHA256

    c1d4316e03e023fad30bb66764659a1a38178a8b3a1de1f98447054d2dedd66e

    SHA512

    43afb50009c46305d7c6879042a86fcfee642cd702293ae71da59e3ca122df56886d171686e4a14b4a7b48e293c11677ffb04ea2206d76ff3fa6d2a318a6dfdc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    45b2dd2c9b70104f50a3e6b10760493f

    SHA1

    6c08f4d732fd2a93f1a08302e5a149318c6512f0

    SHA256

    6f7d042da693c0afd0da3ae53718f04d60a7a6bc9e730cf72e34661e92faba0e

    SHA512

    b1eb9f8127979411c8f78ff54dd067c4e1af3789f19e4874b4998381a29cd902f499ced7f070a148a6ee301f2a5db5cd1d0c5333f1771b76ce7e66b84a77a286

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    42b2538d65c830b1f63587f07f652707

    SHA1

    f843abb774b454c3a56b9a86391d3a9fe03732bd

    SHA256

    584dd3f03a0f9accdeb726749ef8943ab8b0530504298cbdc671f60262be5cd2

    SHA512

    d63a1754ad9542d6a61d411115187042f9ef028c9328ab0f037ff643b3dbfb89880ba27dc981226b86bac2bccf69e3afdb2e6b9530938b62f6bae6249879e6db

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b00fac60c211e716574bf1f0cde2ac17

    SHA1

    5f044aaa2ae1fc03088ec2ad9d4774118299179a

    SHA256

    3e60be3f70f92277ee3e20f7561a0a1c873acce263c809762e6a279b14c1d81d

    SHA512

    6cc6fd2ac07a6d8674bd1136f71936d6ab84a23b705ba17ceab3ca89f380b4f54a40ef0107d099e4cf023bd7c1f6a557fe38330167c52da521a323d2d6d2bdb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    25776854146e412f88e9f4aae811f3b7

    SHA1

    452326b3169a69dabdab9f86afd074912063d7c4

    SHA256

    54689bc7e865851bd4fa5f85c8e6715b639b52449a980d5f698228cd979b1c36

    SHA512

    1157ee5b483462d7111e17873566e225e4f5bf73c8077ef7ae108eebcfe280ecd938439a84b1d3a08762ef6e35794bad85c34a3488107cce5cf1b432b5529054

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c5cecbf7a3a419baa5743d04cdad8242

    SHA1

    3e3bf4495234544d6660f06800513e005db30960

    SHA256

    04f969f0124a5df07b06abfdf6235723a51092ae9d8415de00e5c18520eb63f1

    SHA512

    e47eda4aceb400a04ced3c48936a71481bc8e3c5771b6233138647847afc2232a46f17e3d33db8aa4d3052ec175860620aab8b253c996458eb09f10e0a5d582b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d2ef4907d6e3dbe33f05a2800226ccb6

    SHA1

    66568fdfb6a7660461fcbede9245ce4e282695b2

    SHA256

    f098afa962a270642add874f1e35e8db746b4c482764f3622d9d2ae7813cfd1a

    SHA512

    c60d2f671809a70324f2092fe02803ee541cf2e80e81d78526a7c66fd91b9eb4df97f60801114c6f31bde94bd623594821674486477b6b8812dc5007fb7d99ce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1847c13225c50482ffc42a14a59a9847

    SHA1

    be3074e8646d5bf079a900bc2efe1ad95b25ebee

    SHA256

    3b8de3a5cd64a6389e691691ddba368e96942c9fede5ed41d3175300994acd8d

    SHA512

    7b1c363da552be1f5c267a15e565c570d9cab2a7680dc122bf01a61edce910e4b2e1f87f4ab67278e4f599de23481296530c61cfca2ac0c1af1e5171f6fd5f8f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bd784e8eb54024d8e6af8540c9a64ae8

    SHA1

    ac018418fc0a3534a253ccf229937675d44a13fd

    SHA256

    c7940e8bba291a2d4a4b8599f5e2bf981281caddcd1f6c4265a5d7a21bc5a6c8

    SHA512

    d11c222cd2cf6c459985f6126b4031f0ffdd54f3b6dd5a9fa3e162787332b165ec1dd4cdb81903b3295299c02e808ea9749ddf800564c79fda74990f55c0ad8a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ee7f969f4d2cdbd34008c929a52b0829

    SHA1

    9ea8c2780778fe061c67e244eafb8c011ebbac05

    SHA256

    eea04adb315f3c38954052e5649cd49ea1a79ad030563c562c74bf9490ce24b4

    SHA512

    96dd29541abcb4df1830e4d9e341c628e964fca2b9f8cc2ccdd83f9acca66503d62376f83424a014c53b86c14dc60df3bf9ecf3ab34da2cb240d6d90af9aaf1f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9b413443cd66fa5b68f04cd13676ff2b

    SHA1

    236cbda367193ef0d3b689810edf7affd4e747cd

    SHA256

    702ce5241a7b95973a59499925ea397d744875d1f0d24eb3f0ec1f349a885975

    SHA512

    95c6ea0d074e293b9cd3958632fb84919f84361565d2b4cbadeeef314d9192531b37615145e1a97417faa458bd19bc0447de1ae2fc7a3a643d3b26acc86c13ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ea84c5728d13da6b00550de2302daf01

    SHA1

    b2acf8d950fd0ab475d360237eaa90a328497b08

    SHA256

    9ec5c3327f425d39cf4ae5ed8dc7f2bc101947c59671b3e7079642e88a2ac9ee

    SHA512

    98ceafcad23eab5950a756b5a625c04f59511b7c8f703b92889a0eadb8d7e42d77c58630cf1474f16e891cb785d1cfd8409b3efe98ba7771806b10b4f4497b96

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5f967a0a622e1557048a056caaeeb010

    SHA1

    0f975b5e2240dee5a3ce1ceb28d428da17637534

    SHA256

    0b73136f9dc16f09462f03b7c96c8978e36ab34eae0b731e2d9f4c77cd0e4513

    SHA512

    1e1bb227d56e976a9b25599372bab218794eed5d1b414439aad0b4119bf1195dc3ec5ae12cdc98d1f644c715030498fec819b7535f409ddf60ad5c93e942822d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    28ce49a7d0d9d4f0d4409c248f3d0c6e

    SHA1

    649feb8cb722c70d9bdfb7a537eab31c96c8e149

    SHA256

    434effc8e2ae3c7af58b421cdd0b359a7c44f1fd0519d650e6ff6bc3bce9f011

    SHA512

    e0aefd5c57afbf53cac89497b8d6d2bce04981bcce8734ffd41dedd52089e240ec1db2d135cd2ebc7099a7ad8b38ea5b4116f0de60b4daf3090b1a70ac880257

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1df340f2201f88bf0a64bb62fe117446

    SHA1

    454e2fef995b764097ed61557c36492ea9cccba3

    SHA256

    653c80e909a5daf533dca572728a13f4aed392b7bbcbb07d31fcfee8f4ada634

    SHA512

    34951f60476e1180f367ad108b4566d7636d13fce5bc0a34bf64661ad66c6a04456270e2bfd24d40bf4694c19f8e86adcf8e29dd14dae01f16bf2699ef36ca38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c34591204ec0539823812b2d346e80d8

    SHA1

    3252664baab0cbf8047102da050f520e655cc332

    SHA256

    8e14cef2a56d64a026533a8af9fe66fceca92ca8bf3dbda768888ad0f17dbb0d

    SHA512

    395770935ef36b7fd93b0b738494fb7cc6d933e5ea558e553c88f47d8a9bc8c888a55b5cc6c4f818e106a4f595a2ec19ce57be56767081eab8967f38571cc6c3

  • C:\Users\Admin\AppData\Local\Temp\CabBA6.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\CabC64.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\TarC78.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.