Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

b2b8b08588...8.html

windows7-x64

1

b2b8b08588...8.html

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 09:11 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2b8b085882fca5135102bad520fab87_JaffaCakes118.html

  • Size

    26KB

  • MD5

    b2b8b085882fca5135102bad520fab87

  • SHA1

    2376dc58799a3525cd3cf41cec29c01d18015f63

  • SHA256

    54c71e4c3bb40ae25346761728a822bba6f18dd4d8142b53e67214bea250f279

  • SHA512

    df9ceb0ff209ac73ced1dbd2aba721ffe1cc4ecbfec0eb9cba9a237a824344b3aa36da05fb68764683c5d21a77f5fe818f14d5ac2e63f2dce92c3c5e393af6b5

  • SSDEEP

    192:SIM3t0I5fo9cKivXQWxZxdkVSoAILOaKMc4YE08SIP6p1zUnjBhwZI782qDB8:SIMd0I5nvHNsvsVxDB8

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2b8b085882fca5135102bad520fab87_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2716

Network

  • flag-us
    DNS
    img1.jiehun.cn
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    img1.jiehun.cn
    IN A
    Response
    img1.jiehun.cn
    IN CNAME
    img1.jiehun.cn.a.bdydns.com
    img1.jiehun.cn.a.bdydns.com
    IN CNAME
    opencdnspy.jomodns.com
    opencdnspy.jomodns.com
    IN A
    27.221.77.35
    opencdnspy.jomodns.com
    IN A
    42.81.98.35
    opencdnspy.jomodns.com
    IN A
    1.194.253.35
    opencdnspy.jomodns.com
    IN A
    1.71.157.35
    opencdnspy.jomodns.com
    IN A
    58.222.20.35
    opencdnspy.jomodns.com
    IN A
    58.42.14.35
    opencdnspy.jomodns.com
    IN A
    1.193.146.35
    opencdnspy.jomodns.com
    IN A
    58.57.102.35
    opencdnspy.jomodns.com
    IN A
    42.101.4.35
    opencdnspy.jomodns.com
    IN A
    42.101.56.35
  • flag-us
    DNS
    img1.jiehun.cn
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    img1.jiehun.cn
    IN A
    Response
    img1.jiehun.cn
    IN CNAME
    img1.jiehun.cn.a.bdydns.com
    img1.jiehun.cn.a.bdydns.com
    IN CNAME
    opencdnspy.jomodns.com
    opencdnspy.jomodns.com
    IN A
    118.212.230.35
    opencdnspy.jomodns.com
    IN A
    111.174.9.35
    opencdnspy.jomodns.com
    IN A
    111.225.213.35
    opencdnspy.jomodns.com
    IN A
    120.41.32.35
    opencdnspy.jomodns.com
    IN A
    118.180.40.35
    opencdnspy.jomodns.com
    IN A
    117.68.52.35
    opencdnspy.jomodns.com
    IN A
    114.232.92.35
    opencdnspy.jomodns.com
    IN A
    111.170.25.35
    opencdnspy.jomodns.com
    IN A
    113.219.142.35
    opencdnspy.jomodns.com
    IN A
    113.219.161.35
  • flag-us
    DNS
    t.cn
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    t.cn
    IN A
    Response
    t.cn
    IN A
    39.105.18.168
  • flag-us
    DNS
    www.googleadsl.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.googleadsl.com
    IN A
    Response
    www.googleadsl.com
    IN A
    170.178.222.41
  • flag-us
    DNS
    hm.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    hm.baidu.com
    IN A
    Response
    hm.baidu.com
    IN CNAME
    hm.e.shifen.com
    hm.e.shifen.com
    IN A
    14.215.182.140
    hm.e.shifen.com
    IN A
    14.215.183.79
    hm.e.shifen.com
    IN A
    111.45.11.83
    hm.e.shifen.com
    IN A
    183.240.98.228
    hm.e.shifen.com
    IN A
    111.45.3.198
  • flag-us
    DNS
    www.jiehun.cn
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.jiehun.cn
    IN A
    Response
    www.jiehun.cn
    IN A
    61.160.251.208
  • 170.178.222.41:80
    www.googleadsl.com
    IEXPLORE.EXE
    152 B
     3
  • 170.178.222.41:80
    www.googleadsl.com
    IEXPLORE.EXE
    152 B
     3
  • 39.105.18.168:80
    t.cn
    IEXPLORE.EXE
    152 B
     3
  • 39.105.18.168:80
    t.cn
    IEXPLORE.EXE
    152 B
     3
  • 27.221.77.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 27.221.77.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 27.221.77.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 170.178.222.41:80
    www.googleadsl.com
    IEXPLORE.EXE
    152 B
     3
  • 170.178.222.41:80
    www.googleadsl.com
    IEXPLORE.EXE
    152 B
     3
  • 39.105.18.168:80
    t.cn
    IEXPLORE.EXE
    152 B
     3
  • 42.81.98.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 42.81.98.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 42.81.98.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 42.81.98.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 61.160.251.208:80
    www.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 61.160.251.208:80
    www.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 42.81.98.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 14.215.182.140:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 14.215.182.140:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 1.194.253.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 1.194.253.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 1.194.253.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 1.194.253.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 61.160.251.208:80
    www.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 61.160.251.208:80
    www.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 1.194.253.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 14.215.183.79:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 14.215.183.79:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    799 B
     7.7kB
     10
    13
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    799 B
     7.7kB
     10
    13
  • 1.71.157.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 1.71.157.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 1.71.157.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    779 B
     7.6kB
     9
    12
  • 1.71.157.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 111.45.11.83:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 1.71.157.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 111.45.11.83:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 58.222.20.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 58.222.20.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 58.222.20.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 58.222.20.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 183.240.98.228:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 183.240.98.228:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 58.222.20.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 58.42.14.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 111.45.3.198:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 58.42.14.35:80
    img1.jiehun.cn
    IEXPLORE.EXE
    152 B
     3
  • 111.45.3.198:80
    hm.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 8.8.8.8:53
    img1.jiehun.cn
    dns
    IEXPLORE.EXE
    120 B
     588 B
     2
    2

    DNS Request

    img1.jiehun.cn

    DNS Request

    img1.jiehun.cn

    DNS Response

    27.221.77.35
    42.81.98.35
    1.194.253.35
    1.71.157.35
    58.222.20.35
    58.42.14.35
    1.193.146.35
    58.57.102.35
    42.101.4.35
    42.101.56.35

    DNS Response

    118.212.230.35
    111.174.9.35
    111.225.213.35
    120.41.32.35
    118.180.40.35
    117.68.52.35
    114.232.92.35
    111.170.25.35
    113.219.142.35
    113.219.161.35

  • 8.8.8.8:53
    t.cn
    dns
    IEXPLORE.EXE
    50 B
     66 B
     1
    1

    DNS Request

    t.cn

    DNS Response

    39.105.18.168

  • 8.8.8.8:53
    www.googleadsl.com
    dns
    IEXPLORE.EXE
    64 B
     80 B
     1
    1

    DNS Request

    www.googleadsl.com

    DNS Response

    170.178.222.41

  • 8.8.8.8:53
    hm.baidu.com
    dns
    IEXPLORE.EXE
    58 B
     164 B
     1
    1

    DNS Request

    hm.baidu.com

    DNS Response

    14.215.182.140
    14.215.183.79
    111.45.11.83
    183.240.98.228
    111.45.3.198

  • 8.8.8.8:53
    www.jiehun.cn
    dns
    IEXPLORE.EXE
    59 B
     75 B
     1
    1

    DNS Request

    www.jiehun.cn

    DNS Response

    61.160.251.208

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    62bfc8cd7d5613eb5d28cdbe4c9f51d0

    SHA1

    43a4b5b5288cc451a9fa6f24c2bf090d0489b78e

    SHA256

    0d538288cd2eb8470515a01b831a9baa2c2b9b620b446331f2e440b8871b9643

    SHA512

    09119995a293ffcfbe42238093a314c2cf6d3ddd666e739152ca2d6b16ff7c137b24045d5e57e2207b05fabc4b3a41de8c62089a0a1e3108509fcda09d42d4da

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    537b0cc6bbd473a755f32031ccaa1ad1

    SHA1

    b7081deb48d32520507139eaf82e040b1db912d1

    SHA256

    b27a009c201cc794c4e2173fcf44f963f119dd3c49dd2a9be03b8999867b6b4e

    SHA512

    4b874df03feabf23ee0be4c7487eb74c894ed948b5b2ab8076dc9db43b69066bdaa4e033f11df75e58ecfefeabbd680f10c63f88a1195729945ed57372a15c71

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f0596f59c273ccdbe9ab2f0b1488ab0a

    SHA1

    ff0ad564fca74ba251f343398e34d82728fb2b68

    SHA256

    de2d8556849f4634d7a3b91d7d89c4edd9a5d903bf03ae5aa227913232d07567

    SHA512

    c689d1c7044ec15ff9e165f6232520e6c822f1b419476485131e68a102d16d86617900a855d2d8e4a697ff5c641f9584db3565270fbf35c50fafec6ce368c9b6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    fe0c7205a932137973a25393374ffeb5

    SHA1

    1ce83b31500cc82f52f8d6a9530e7e0770c965c4

    SHA256

    8455c218baf4c9a5a516e5371f617ab78edd0abe427f64da0fca21c84a1bd35a

    SHA512

    7ccfb30f39a1855d1aae11f3a7fad0ff6f8cb93bad79b7a3bfbf40be034108c485a5b21a99cf40d4f71171fa58e1f703dc2b3493c4bff74ae4a28dfafb958667

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    eab7c63bf2b48914bc41b0ecad34008c

    SHA1

    b234341693c89c944edd9d2bbfcc313b966f79e0

    SHA256

    db70a69fb24cc94179d4df5a27a5146827c08f7f883b29e5d35ba1be52be84e6

    SHA512

    7ab6af6e9e4ee79bd87b2b069de3209d0d05cf7f4580526c2118b037d2edf64094de7bfd84195a7ed028475a750d396973ce3a3d93d76e53c945efe4a75ed528

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    4a6f75168552655ebb4f535a2562052f

    SHA1

    0d7df715cb0d0f1cb7cbc28ed5d0b829ad73542a

    SHA256

    bf0413c298fe6e774de3a85e142aac7845f6016878849848ececaba4b2afac4f

    SHA512

    81e0a4c642a6d9afddf1778fb563a43a1ea2efa6c0a6991b19dd5d89b9b518d3de03ee435067d7166d9f5ba272eba1359ab96b28f6855246a245542847cbfd00

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    91f50855bd70aafbdd2d65fd0c3988cb

    SHA1

    118717ce1c58c5229de93e02651f0f22d449f444

    SHA256

    200b41e315b7e26a750f9ccc09567ec78c9b9a0e4728ff3ce4bfbe384bd6610d

    SHA512

    3328faafc0caf1281ecac60ad610194a90bdfc0abe59354f2c52d4eb50c61e556f43070413886bae70004cb35869b0528cd379651be19bd4ff32c9a7ff93d562

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    bc5a404a3cd5df0fc4ba578a589dee5d

    SHA1

    5500b3bab24632947aab3343c513b73d92b720d9

    SHA256

    92fe4c89c9cdfa096a91a81f374363c686dee31c5b348595dafb8d37a4f78ac2

    SHA512

    9ba78471fe79628ebfa1a500b8cf0f22851f289367b0857880f4123d72e7f01a156f06a59a76b749f4990a85dd7ca2ea581cd3ab06bd64c820fdfc9a1c693e1a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a1d85273b0b5bbd81130e0c9ad5a892d

    SHA1

    1a3f70cf17d47eec0c17b5fc5be26dd96d3f334e

    SHA256

    6a7f808888f2a1580798e9a37fcb94fd2cc6022906515a4eccd66fba3a28129a

    SHA512

    3c86a35bfb747c7985abc37ee3fdfdec060f765a84bb08caa92862faddc8d915c1445198710559790603f83069012b2b5729adfa11149a709f5b22bf7fb4339a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab14AB.tmp
    Filesize

    67KB

    MD5

    2d3dcf90f6c99f47e7593ea250c9e749

    SHA1

    51be82be4a272669983313565b4940d4b1385237

    SHA256

    8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

    SHA512

    9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar154E.tmp
    Filesize

    160KB

    MD5

    7186ad693b8ad9444401bd9bcd2217c2

    SHA1

    5c28ca10a650f6026b0df4737078fa4197f3bac1

    SHA256

    9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

    SHA512

    135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.