Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

4334f7c0ca...8.html

windows7-x64

3

4334f7c0ca...8.html

windows10-2004-x64

3

Analysis

  • max time kernel
    119s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 16:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4334f7c0ca5b963a76646fd47cc3bf77_JaffaCakes118.html

  • Size

    25KB

  • MD5

    4334f7c0ca5b963a76646fd47cc3bf77

  • SHA1

    7f8a35614ae4d817d1bb646349cfcb6b0d4bfb3b

  • SHA256

    62a130380f60037756e4de34ad6581d6bda7437e6c4f1ea3580e453064386b8e

  • SHA512

    2736484156112f4ff1711e4a1b410d54e229d6a5b2ec3d792c276a640f792bebd790fc929ff92afd75155a8fe6ffa578cc19ea79fea219b91e8eb4aabf60f12f

  • SSDEEP

    192:3ZDqEuCo60OBnod1oQvV+p3PCTjfuKNiVZ2xJq8HOya1yUVV7lvbFSn5KcyKLjJt:pOpnaAwxwkwmg/5/5N

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4334f7c0ca5b963a76646fd47cc3bf77_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:840

Network

  • flag-us
    DNS
    pigeonwatchforums.co.uk
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    pigeonwatchforums.co.uk
    IN A
    Response
  • flag-us
    DNS
    web.icq.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    web.icq.com
    IN A
    Response
    web.icq.com
    IN CNAME
    www.icq.com
    www.icq.com
    IN CNAME
    www.ovip.icq.com
    www.ovip.icq.com
    IN A
    5.61.236.229
  • flag-ru
    GET
    http://web.icq.com/whitepages/online?icq=582746249&img=5
    IEXPLORE.EXE
    Remote address:
    5.61.236.229:80
    Request
    GET /whitepages/online?icq=582746249&img=5 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: web.icq.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: kittenx
    Date: Mon, 14 Oct 2024 16:53:38 GMT
    Content-Type: text/html
    Content-Length: 178
    Connection: keep-alive
    Location: https://web.icq.com/whitepages/online?icq=582746249&img=5
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  • flag-ru
    GET
    https://web.icq.com/whitepages/online?icq=582746249&img=5
    IEXPLORE.EXE
    Remote address:
    5.61.236.229:443
    Request
    GET /whitepages/online?icq=582746249&img=5 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: web.icq.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: kittenx
    Date: Mon, 14 Oct 2024 16:53:46 GMT
    Content-Type: text/html
    Content-Length: 178
    Connection: keep-alive
    Location: https://icq.com/
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  • flag-us
    DNS
    icq.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    icq.com
    IN A
    Response
    icq.com
    IN A
    5.61.236.229
  • flag-ru
    GET
    https://icq.com/
    IEXPLORE.EXE
    Remote address:
    5.61.236.229:443
    Request
    GET / HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: icq.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Moved Temporarily
    Server: kittenx
    Date: Mon, 14 Oct 2024 16:53:50 GMT
    Content-Type: text/html
    Content-Length: 154
    Connection: keep-alive
    Location: https://icq.com/en
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  • flag-ru
    GET
    https://icq.com/en
    IEXPLORE.EXE
    Remote address:
    5.61.236.229:443
    Request
    GET /en HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: icq.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Moved Temporarily
    Server: kittenx
    Date: Mon, 14 Oct 2024 16:53:50 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Location: https://icq.com/desktop/en#windows
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    Content-Security-Policy-Report-Only: default-src 'none'; script-src icq.com c.icq.com cicq.org 1l-hit.mail.ru www.google-analytics.com buddyicon.foto.mail.ru www.googletagmanager.com top-fwz1.mail.ru 'sha256-DKOsdd00IXAHc7qK64HiC18YrB2K4SfiH8Sl6A9aFyg=' 'sha256-u4WiMVZhYDdCrFwB8Zn3gLba1EI3pqIlFYWFZfXJl2I=' 'sha256-ynzJCJTMBeZF6kbmzoI2rC+vDRozRAHxsPfAruxve88=' 'sha256-j51JRkq0bwz97Hd/1wJQsIy6/aX9cz16Xyp+M8FshTA=' 'self'; style-src c.icq.com icq.com cicq.org 'self' 'unsafe-inline'; img-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com buddyicon.foto.mail.ru files.icq.com files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net swa.icq.com stats.g.doubleclick.net 'self'; media-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com files.icq.com api.icq.net files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net 'self'; font-src icq.com c.icq.com cicq.org 'self'; connect-src privacy.icq.com icq.com top-fwz1.mail.ru 'self'; report-uri /system/error
    Content-Security-Policy: upgrade-insecure-requests
    X-XSS-Protection: 1; mode=block; report=https://cspreport.mail.ru/xxssprotection
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
  • flag-ru
    GET
    https://icq.com/desktop/en
    IEXPLORE.EXE
    Remote address:
    5.61.236.229:443
    Request
    GET /desktop/en HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: icq.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Server: kittenx
    Date: Mon, 14 Oct 2024 16:53:50 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Vary: Accept-Encoding
    Vary: Accept-Encoding
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    Content-Security-Policy-Report-Only: default-src 'none'; script-src icq.com c.icq.com cicq.org 1l-hit.mail.ru www.google-analytics.com buddyicon.foto.mail.ru www.googletagmanager.com top-fwz1.mail.ru 'sha256-DKOsdd00IXAHc7qK64HiC18YrB2K4SfiH8Sl6A9aFyg=' 'sha256-u4WiMVZhYDdCrFwB8Zn3gLba1EI3pqIlFYWFZfXJl2I=' 'sha256-ynzJCJTMBeZF6kbmzoI2rC+vDRozRAHxsPfAruxve88=' 'sha256-j51JRkq0bwz97Hd/1wJQsIy6/aX9cz16Xyp+M8FshTA=' 'self'; style-src c.icq.com icq.com cicq.org 'self' 'unsafe-inline'; img-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com buddyicon.foto.mail.ru files.icq.com files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net swa.icq.com stats.g.doubleclick.net 'self'; media-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com files.icq.com api.icq.net files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net 'self'; font-src icq.com c.icq.com cicq.org 'self'; connect-src privacy.icq.com icq.com top-fwz1.mail.ru 'self'; report-uri /system/error
    Content-Security-Policy: upgrade-insecure-requests
    X-XSS-Protection: 1; mode=block; report=https://cspreport.mail.ru/xxssprotection
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    Content-Encoding: gzip
  • flag-us
    DNS
    crl.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    crl.microsoft.com
    IN A
    Response
    crl.microsoft.com
    IN CNAME
    crl.www.ms.akadns.net
    crl.www.ms.akadns.net
    IN CNAME
    a1363.dscg.akamai.net
    a1363.dscg.akamai.net
    IN A
    2.19.117.22
    a1363.dscg.akamai.net
    IN A
    2.19.117.18
  • flag-gb
    GET
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    Remote address:
    2.19.117.22:80
    Request
    GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 11 Jul 2024 01:45:51 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1036
    Content-Type: application/octet-stream
    Content-MD5: 8M9bF5Tsp81z+cAg2quO8g==
    Last-Modified: Thu, 26 Sep 2024 02:21:11 GMT
    ETag: 0x8DCDDD1E3AF2C76
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 0d86e878-601e-0013-6cbc-0f73e6000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Mon, 14 Oct 2024 16:54:20 GMT
    Connection: keep-alive
  • flag-us
    DNS
    www.microsoft.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    2.17.5.133
  • flag-us
    DNS
    www.microsoft.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
  • flag-us
    DNS
    www.microsoft.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    2.17.5.133
  • 5.61.236.229:80
    http://web.icq.com/whitepages/online?icq=582746249&img=5
    http
    IEXPLORE.EXE
    664 B
     1.2kB
     8
    7

    HTTP Request

    GET http://web.icq.com/whitepages/online?icq=582746249&img=5

    HTTP Response

    301
  • 5.61.236.229:80
    web.icq.com
    IEXPLORE.EXE
    236 B
     164 B
     5
    4
  • 5.61.236.229:443
    https://web.icq.com/whitepages/online?icq=582746249&img=5
    tls, http
    IEXPLORE.EXE
    1.9kB
     5.9kB
     16
    12

    HTTP Request

    GET https://web.icq.com/whitepages/online?icq=582746249&img=5

    HTTP Response

    301
  • 5.61.236.229:443
    icq.com
    tls
    IEXPLORE.EXE
    1.0kB
     5.4kB
     15
    15
  • 5.61.236.229:443
    https://icq.com/desktop/en
    tls, http
    IEXPLORE.EXE
    2.1kB
     20.1kB
     19
    24

    HTTP Request

    GET https://icq.com/

    HTTP Response

    302

    HTTP Request

    GET https://icq.com/en

    HTTP Response

    302

    HTTP Request

    GET https://icq.com/desktop/en

    HTTP Response

    200
  • 2.19.117.22:80
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    http
    758 B
     1.9kB
     7
    6

    HTTP Request

    GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

    HTTP Response

    200
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    847 B
     7.7kB
     11
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    847 B
     7.7kB
     11
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    779 B
     7.8kB
     9
    12
  • 8.8.8.8:53
    pigeonwatchforums.co.uk
    dns
    IEXPLORE.EXE
    69 B
     137 B
     1
    1

    DNS Request

    pigeonwatchforums.co.uk

  • 8.8.8.8:53
    web.icq.com
    dns
    IEXPLORE.EXE
    57 B
     114 B
     1
    1

    DNS Request

    web.icq.com

    DNS Response

    5.61.236.229

  • 8.8.8.8:53
    icq.com
    dns
    IEXPLORE.EXE
    53 B
     69 B
     1
    1

    DNS Request

    icq.com

    DNS Response

    5.61.236.229

  • 8.8.8.8:53
    crl.microsoft.com
    dns
    63 B
     162 B
     1
    1

    DNS Request

    crl.microsoft.com

    DNS Response

    2.19.117.22
    2.19.117.18

  • 8.8.8.8:53
    www.microsoft.com
    dns
    iexplore.exe
    126 B
     230 B
     2
    1

    DNS Request

    www.microsoft.com

    DNS Request

    www.microsoft.com

    DNS Response

    2.17.5.133

  • 8.8.8.8:53
    www.microsoft.com
    dns
    iexplore.exe
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    2.17.5.133

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    252B

    MD5

    8a35a816be969c6d65f19319bd915d07

    SHA1

    ea812dc8574dd937a5bf7a6e9e974c5721b7bec9

    SHA256

    27a8da1fba77badf8b0df017a3133a4dc61fe21ce359e9dcae4c336b2d02cafd

    SHA512

    dfc688c8fc3da618a3ca2667ae6b8bb052841855f49ade6e178f7fe2a1d5b8587a7d7bd451a903a9d212a9a9e79893b1e518f651313107d5aa9a861e8ad31db9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    d4454d11316120200371d2a283e52b47

    SHA1

    608d55a6d4b2c602392ae31fa615ed20cf7333d2

    SHA256

    b04de8a32b5a5369d2e75babc12f81b16c9b9bb749193cff3cfd0c4cb2152565

    SHA512

    f9884758c939f55366f93e469fb88c3e5a966ce0b198ea331518fa672a8758eb0b75b22d99337baba39508142c1691a5a737c7d1d44a0225bcdbd7c4a7760e5c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    358a693b1a2f13349368a3b767df87ce

    SHA1

    729978cb884a26aa6159a4db737aed6952145d9b

    SHA256

    28272985d8dd1eb93c75b95f6f4333fb83da6052a4dca87adb03309fd331eb2e

    SHA512

    c922e6875c484bb3a4688b835859307c0f66483c8be069578e3e6939c0397a6d0b1ef0a4b791ac2d46bc4413c75ce794a21ceb9dfc9cbd7bb54d80b048390d31

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    06ce80f20d77633dc9a12ece90e9dd51

    SHA1

    b80e6668f4727627e24e8672e8f01685bfa98108

    SHA256

    4127ebafbe1eb339e6a2a8118e2f2d9438b30c02d2de9957c36b3e4629f605ae

    SHA512

    e0ed24dd8d49cc882d8ebf5b658dfb4b2463dfbf2da49295d84d22b31eef23879980483ead58d5cfcaa96d6da2a29d9a4a3bb3342b4a00168d94ae8a4ec2b99d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab13B1.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar1450.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.