Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

b4206ee3a5...8.html

windows7-x64

1

b4206ee3a5...8.html

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 15:02 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4206ee3a5dfc4d735339058c630c263_JaffaCakes118.html

  • Size

    142KB

  • MD5

    b4206ee3a5dfc4d735339058c630c263

  • SHA1

    bba7d8f9a299bb7064fb4f5a7d2262bfc64301c4

  • SHA256

    076e9aa6c7d1de05afe6944f30309a0ae4b9e7f05a2710971a548f362775b447

  • SHA512

    74f9f60544e727b096833d70b319c3d0bf4dbc5c757787b841cc6d8ea1fca7d5b03540ebf5a6ab2d818a9b1c54ade84f1beaa8fab845c105ae57ae9142458b3d

  • SSDEEP

    3072:Sx938jjEx7dyfkMY+BES09JXAnyrZalI+YQ:Sx9sfEx7osMYod+X3oI+YQ

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4206ee3a5dfc4d735339058c630c263_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:860

Network

  • flag-us
    DNS
    www.ysh3p1.top
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.ysh3p1.top
    IN A
    Response
  • flag-us
    DNS
    push.zhanzhang.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    push.zhanzhang.baidu.com
    IN A
    Response
    push.zhanzhang.baidu.com
    IN CNAME
    share.jomodns.com
    share.jomodns.com
    IN CNAME
    share.n.shifen.com
    share.n.shifen.com
    IN A
    163.177.17.97
    share.n.shifen.com
    IN A
    14.215.182.161
    share.n.shifen.com
    IN A
    180.101.212.103
    share.n.shifen.com
    IN A
    182.61.244.229
    share.n.shifen.com
    IN A
    182.61.201.93
    share.n.shifen.com
    IN A
    182.61.201.94
    share.n.shifen.com
    IN A
    39.156.68.163
    share.n.shifen.com
    IN A
    112.34.113.148
  • flag-us
    DNS
    bdimg.share.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    bdimg.share.baidu.com
    IN A
    Response
    bdimg.share.baidu.com
    IN CNAME
    share.jomodns.com
    share.jomodns.com
    IN CNAME
    share.n.shifen.com
    share.n.shifen.com
    IN A
    163.177.17.97
    share.n.shifen.com
    IN A
    112.34.113.148
    share.n.shifen.com
    IN A
    182.61.201.94
    share.n.shifen.com
    IN A
    180.101.212.103
    share.n.shifen.com
    IN A
    182.61.201.93
    share.n.shifen.com
    IN A
    39.156.68.163
    share.n.shifen.com
    IN A
    14.215.182.161
    share.n.shifen.com
    IN A
    182.61.244.229
  • flag-us
    DNS
    www.microsoft.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    23.46.73.244
  • 163.177.17.97:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 163.177.17.97:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 163.177.17.97:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 163.177.17.97:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 14.215.182.161:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 112.34.113.148:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 14.215.182.161:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 112.34.113.148:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    747 B
     7.6kB
     9
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    747 B
     7.6kB
     9
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    875 B
     7.7kB
     11
    13
  • 180.101.212.103:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 180.101.212.103:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.94:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.94:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.244.229:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.244.229:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 180.101.212.103:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 180.101.212.103:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.93:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.93:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.93:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.93:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 8.8.8.8:53
    www.ysh3p1.top
    dns
    IEXPLORE.EXE
    60 B
     130 B
     1
    1

    DNS Request

    www.ysh3p1.top

  • 8.8.8.8:53
    push.zhanzhang.baidu.com
    dns
    IEXPLORE.EXE
    70 B
     255 B
     1
    1

    DNS Request

    push.zhanzhang.baidu.com

    DNS Response

    163.177.17.97
    14.215.182.161
    180.101.212.103
    182.61.244.229
    182.61.201.93
    182.61.201.94
    39.156.68.163
    112.34.113.148

  • 8.8.8.8:53
    bdimg.share.baidu.com
    dns
    IEXPLORE.EXE
    67 B
     252 B
     1
    1

    DNS Request

    bdimg.share.baidu.com

    DNS Response

    163.177.17.97
    112.34.113.148
    182.61.201.94
    180.101.212.103
    182.61.201.93
    39.156.68.163
    14.215.182.161
    182.61.244.229

  • 8.8.8.8:53
    www.microsoft.com
    dns
    iexplore.exe
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    23.46.73.244

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    252B

    MD5

    ee1644c9188ee0047f926c6e3e5db1a9

    SHA1

    9cda84fb2b7297033632e246a9b2fdc3fc58fdeb

    SHA256

    0045de9b29d4ae9e63ae82612ad6f2cfa4ac1010d27cc7206e487a53f0a760aa

    SHA512

    2e09cda939b1d8638579fb5cdf3edec914ff38bd713caa632987e57cd5725d6e749503ea5fe23b2c5be9c5c4b18c2ab86ef7e946882031c75606d07b0ab30256

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    ac7e879e17aa5dc14850e38b75b03a5d

    SHA1

    a5e2a1859e5d65cc66ad4dcdaee566ec023aa285

    SHA256

    18b9868e0c3499cbafb1398e6dd1cd24ff3b2e68a2ccf7d94c17dd60eb561e2f

    SHA512

    9518ad742c65852fba4663184dd6a82c20134172f12d09a6f841299f2e77b61a24693c200911a364799475017dd4c7cc5c1db4f535de83b35cd01f6f50c1cbbf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar2C05.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.