Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/04/2024, 11:14 UTC
240411-nb5z8sdd7y 1011/04/2024, 11:14 UTC
240411-nb5dpsdd7w 1011/04/2024, 11:14 UTC
240411-nb43yaac56 1011/04/2024, 11:14 UTC
240411-nb3vwadd7t 1011/04/2024, 11:14 UTC
240411-nb3j4sac55 1009/04/2024, 03:54 UTC
240409-egc2zahd2z 1009/04/2024, 03:53 UTC
240409-ef443adg89 1009/04/2024, 03:53 UTC
240409-efxd8ahc9v 1009/04/2024, 03:53 UTC
240409-efmvsahc8w 1003/04/2024, 00:16 UTC
240403-akzypahh9t 10Analysis
-
max time kernel
296s -
max time network
309s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
09/04/2024, 03:53 UTC
General
-
Target
9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe
-
Size
7.6MB
-
MD5
9b035bad2b8a21fb2c57fd784c89b8d5
-
SHA1
ee15fad65f3f22df7f54e218176c45d369ebb70f
-
SHA256
2d49873798ab5ee10992f377ebb27ee940b1f354b9ec4ebebe687177ea2b214c
-
SHA512
96c0189aba67db2f1c38affa5ac44665566ea17e20e5f749aef771739c81beb96bbcac8ea35aad80cffc9d492e23fcbaefbf03f72011d9bd1ccac36182466dde
-
SSDEEP
196608:imEljesxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQUDxtw3iFFrS6XOfTV73cP:balxwZ6v1CPwDv3uFteg2EeJUO9WLjD/
Malware Config
Extracted
bitrat
1.32
7ix5nfolcp4ta4mk2dtihev73rw7d2edpbd5tp7sf7zgmpv66fpxnwqd.onion:80
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
dllhost
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
BitRAT payload 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 57 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe"C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
-
DNS38.21.59.86.in-addr.arpaRemote address:8.8.8.8:53Request38.21.59.86.in-addr.arpaIN PTRResponse38.21.59.86.in-addr.arpaIN CNAME38.32-29.21.59.86.in-addr.arpa38.32-29.21.59.86.in-addr.arpaIN PTRtornoreplyorg -
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNS187.153.104.109.in-addr.arpaRemote address:8.8.8.8:53Request187.153.104.109.in-addr.arpaIN PTRResponse
-
DNS98.179.111.23.in-addr.arpaRemote address:8.8.8.8:53Request98.179.111.23.in-addr.arpaIN PTRResponse98.179.111.23.in-addr.arpaIN PTR23-111-179-98statichvvcus
-
DNSmyexternalip.comRemote address:8.8.8.8:53Requestmyexternalip.comIN AResponsemyexternalip.comIN A34.117.118.44
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEwu-bg-shim.trafficmanager.netwu-bg-shim.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.17.197.240a767.dspw65.akamai.netIN A2.17.197.249
-
DNSx1.c.lencr.orgRemote address:8.8.8.8:53Requestx1.c.lencr.orgIN AResponsex1.c.lencr.orgIN CNAMEcrl.root-x1.letsencrypt.org.edgekey.netcrl.root-x1.letsencrypt.org.edgekey.netIN CNAMEe8652.dscx.akamaiedge.nete8652.dscx.akamaiedge.netIN A23.55.97.11
-
DNSr3.o.lencr.orgRemote address:8.8.8.8:53Requestr3.o.lencr.orgIN AResponser3.o.lencr.orgIN CNAMEo.lencr.edgesuite.neto.lencr.edgesuite.netIN CNAMEa1887.dscq.akamai.neta1887.dscq.akamai.netIN A23.63.101.171a1887.dscq.akamai.netIN A23.63.101.170
-
DNS44.118.117.34.in-addr.arpaRemote address:8.8.8.8:53Request44.118.117.34.in-addr.arpaIN PTRResponse44.118.117.34.in-addr.arpaIN PTR4411811734bcgoogleusercontentcom
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEwu-bg-shim.trafficmanager.netwu-bg-shim.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.17.197.240a767.dspw65.akamai.netIN A2.17.197.249
-
DNS11.97.55.23.in-addr.arpaRemote address:8.8.8.8:53Request11.97.55.23.in-addr.arpaIN PTRResponse11.97.55.23.in-addr.arpaIN PTRa23-55-97-11deploystaticakamaitechnologiescom
-
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.229.43
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdcus08.centralus.cloudapp.azure.comonedscolprdcus08.centralus.cloudapp.azure.comIN A104.208.16.88
-
DNS171.101.63.23.in-addr.arpaRemote address:8.8.8.8:53Request171.101.63.23.in-addr.arpaIN PTRResponse171.101.63.23.in-addr.arpaIN PTRa23-63-101-171deploystaticakamaitechnologiescom
-
DNS43.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
DNS88.16.208.104.in-addr.arpaRemote address:8.8.8.8:53Request88.16.208.104.in-addr.arpaIN PTRResponse
-
DNS240.197.17.2.in-addr.arpaRemote address:8.8.8.8:53Request240.197.17.2.in-addr.arpaIN PTRResponse240.197.17.2.in-addr.arpaIN PTRa2-17-197-240deploystaticakamaitechnologiescom
-
DNS182.65.177.93.in-addr.arpaRemote address:8.8.8.8:53Request182.65.177.93.in-addr.arpaIN PTRResponse182.65.177.93.in-addr.arpaIN PTRtor-entry-001-4363241313opsfinet
-
80.127.137.19:443 -
127.0.0.1:49768 -
81.7.16.182:443 -
51.38.134.104:443 -
127.0.0.1:45808
-
86.59.21.38:443www.lb3sfo2x4ppe2l6a7sakhb.comtls -
109.104.153.187:443www.s32ickwa.comtls
-
23.111.179.98:443www.o23tix.comtls
-
23.111.179.98:443www.hox7iachkxehwnd5iwqckq7.comtls
-
109.104.153.187:443www.xdjy3ojxtpmf5j2akz.comtls
-
127.0.0.1:45808
-
34.117.118.44:443myexternalip.comtls
-
127.0.0.1:49899
-
127.0.0.1:45808
-
34.117.118.44:443myexternalip.comtls
-
127.0.0.1:49940
-
93.177.65.182:443www.jwxepwb52xwbkkcy2.comtls
-
109.104.153.187:443www.b3vshebdtfllyprfvzvhq.comtls
-
23.111.179.98:443www.jkuf7zg7jbmhbawaie.comtls
-
127.0.0.1:45808
-
34.117.118.44:443myexternalip.comtls
-
127.0.0.1:50020
-
127.0.0.1:45808
-
34.117.118.44:443myexternalip.comtls
-
127.0.0.1:50062
-
199.249.230.64:443
-
109.104.153.187:443www.a2rxagksmvdy7dduog.comtls
-
23.111.179.98:443www.tm5hcw.comtls
-
127.0.0.1:45808
-
34.117.118.44:443myexternalip.comtls
-
127.0.0.1:50136
-
127.0.0.1:50164
-
81.7.16.182:443
-
23.111.179.98:443www.2e53.comtls
-
109.104.153.187:443www.jhak2wov.comtls
-
127.0.0.1:45808
-
34.117.118.44:443myexternalip.comtls
-
127.0.0.1:50231
-
96.253.78.108:443
-
109.104.153.187:443www.wkbtgu5rzq57ezzvc.comtls
-
23.111.179.98:443www.htuosdcshs5ipskdidclu.comtls
-
127.0.0.1:45808
-
8.8.8.8:5338.21.59.86.in-addr.arpadns
DNS Request
38.21.59.86.in-addr.arpa
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
187.153.104.109.in-addr.arpa
DNS Request
98.179.111.23.in-addr.arpa
DNS Request
myexternalip.com
DNS Response
34.117.118.44
DNS Request
ctldl.windowsupdate.com
DNS Response
2.17.197.2402.17.197.249
DNS Request
x1.c.lencr.org
DNS Response
23.55.97.11
DNS Request
r3.o.lencr.org
DNS Response
23.63.101.17123.63.101.170
DNS Request
44.118.117.34.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
2.17.197.2402.17.197.249
-
8.8.8.8:5311.97.55.23.in-addr.arpadns
DNS Request
11.97.55.23.in-addr.arpa
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.229.43
DNS Request
self.events.data.microsoft.com
DNS Response
104.208.16.88
-
8.8.8.8:53171.101.63.23.in-addr.arpadns
DNS Request
171.101.63.23.in-addr.arpa
DNS Request
43.229.111.52.in-addr.arpa
DNS Request
88.16.208.104.in-addr.arpa
-
8.8.8.8:53240.197.17.2.in-addr.arpadns
DNS Request
240.197.17.2.in-addr.arpa
DNS Request
182.65.177.93.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5176a380414571c82c6f67199097e7eb8
SHA1c9d45ad936db5e3f836ce855e9dd950f7eb9be90
SHA256552720cc9077c5db337957417461e8d8df884e3db049b862fc34bbfb3ab6ef7b
SHA5122ce7caa084350e0955065bcfd3a66d6640ceedb6a6d5b4bf3e368407248731ff3e7663c645723476327aecdbfa53d535ac9dc703c725d2664fbe531d21989006
-
Filesize
2.6MB
MD5d4dfff132a935ecda7a5a6a32522a37f
SHA1339a56e3e87ff64e3d956f1523b40087de3c4910
SHA2561994d6d7b4f22815ab1b58cd593049f5139e9339de08f38cf152e546b2e329c2
SHA5129d2aa6ff53076a59855e26076e75bcd802ad14b3791d8c57b9fa715d24d2decf76bd0cdbb0a25dd3616217a4419a12780914cdbf615c90084f86fbcc69ea130f
-
Filesize
20.4MB
MD563fe835924610a7c3ae43245de62d3cb
SHA10db34a6f8e6733dfa600e7a6adf5bd9dea52da47
SHA2564fb047eed229232e39115be2c962848a9e60338cb94b29a702ea7ba92072a9b3
SHA512af007a02cbddd5d7269d09a6564df698e99f4ef6db73ac0b7b2057cce268b0bad4cb8d852eda5c327749a12edd47aef253dc62360ac9bb4d4749b006fb0fb62f
-
Filesize
20.4MB
MD5d6932756589a9ea2e48c42ee5c556a57
SHA179d69fac60f510081d8a2bdc583561ac3751541c
SHA2563e9ab09c1276922ca73f4fc1efbe5b7cb0ca48554bf371c6bf7404c5a0b32dfa
SHA512cca862865880910fb1b42ba75e6e8fbf9205ce14d6a7db3e94e7a86b81e5129dd3af0df7d337bfc3c28261f6111011a6afb7dbcc2e549899ce7d157c319c827a
-
Filesize
10.8MB
MD5edc9d2725fc6f23d734ba73ea5d2ff23
SHA1d60f52f6c3c900020ed5e7eb5819426d6166a3cf
SHA256ef750ecc3ee31c60e9bbe0df8b29953253cd44f96b5f63e96467ccfbd68da417
SHA5126797ade7eb63e10e32133e7337941b38fee06cfd35a27237644dd0434798ccffa435939c773801b7e711e20ca0a86ebc455edc98cbf33f2a5a7bba6098ccd63a
-
Filesize
6KB
MD58e00b5c8c125cb76d20f88ca1b9bf804
SHA154e0642fae0bd4e73b15ad4c562c7d3b628b8b5a
SHA2565f726c68be41c0e86aaaf2efab6ac234c4587bb6694006808eab96f820b698d9
SHA51283af9856f4d47fcd26f3126605d8bcaee8268263f64816999499ec3a227692b1fb556609c5ba15042dec915f733cb8ac4a217a836a76d5a983fe2d55d227fa1d
-
Filesize
9KB
MD571ad82b39ee06759fbae6a4fca1ceabe
SHA104ca4ebf768688348c8a685f2a033ad57802aa9a
SHA25637dcd19e627411acd9a4602a4be27ef2d76dea670f54cd3ba1385efa26f2ca73
SHA512dea83f8e80affc393c15964d81ff8ca3eb915f119b6f0a2497836e9aec7bcd3c25501f8acd207589ad3797bfd1b3915f0d2fb3efa4261ac3e798e17cfd5ed7eb
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
139B
MD5dbd537e3da06f7d7aeaf58f4decc0c94
SHA17e740ea6dcf8545710f99519014e9bb029028a84
SHA256349b36a467d778e29b96528cdd25d6c34a54be659a9ef516b3833106ceb679b2
SHA512a84633c420c825b15ef2fc5cf83a6d75fcdddbb06d3b7dc74537d5bc98b5d910d3dec4838f30be3a06373662d2946f156f36bd2e033e0b6089753006ac327a90
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
144KB
-
Filesize
800KB
-
Filesize
1.0MB
-
Filesize
824KB
-
Filesize
544KB
-
Filesize
800KB
-
Filesize
2.8MB
-
Filesize
292KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
800KB
-
Filesize
4.0MB
-
Filesize
2.8MB
-
Filesize
544KB
-
Filesize
292KB
-
Filesize
824KB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
1.0MB
-
Filesize
144KB
-
Filesize
800KB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
292KB
-
Filesize
144KB
-
Filesize
824KB
-
Filesize
1.0MB
-
Filesize
544KB
-
Filesize
292KB
-
Filesize
144KB
-
Filesize
824KB
-
Filesize
800KB
-
Filesize
2.8MB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
544KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
824KB
-
Filesize
544KB
-
Filesize
2.8MB
-
Filesize
144KB
-
Filesize
4.0MB
-
Filesize
544KB
-
Filesize
824KB
-
Filesize
2.8MB
-
Filesize
4.0MB
-
Filesize
1.0MB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
292KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
144KB
-
Filesize
4.0MB
-
Filesize
800KB
-
Filesize
544KB
-
Filesize
1.0MB
-
Filesize
2.8MB
-
Filesize
824KB
-
Filesize
292KB