Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

ef9ec30523...18.exe

windows7-x64

10

ef9ec30523...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/04/2024, 22:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe

  • Size

    613KB

  • MD5

    ef9ec305233a1d1e0705c1b58170ba4a

  • SHA1

    9c1e467ae212357a97bd12a1799c2759343463c9

  • SHA256

    1f5d97af06d5f361014a0026bb8fd0f3dd4fd9119a092358a38042e3ee23bf0c

  • SHA512

    4d2d4cd979764bdf0caa113c773c1c9e099cf2962635fef788efed3dd28d47433f99d0cde3b92074f573eda4e912b1787db8cba17841d9fd9a231fff8695b379

  • SSDEEP

    12288:5bu38g1hhiyCCaXNQY0ERzcUKHYjz9Rt7+IA9LpgwiGeaS+6sjDY:5C8gXs7Cz89KHezN7+IA9tEGNDjDY

Score
10/10
raccoon3c5f92faf516d1465cda31b23f6c41b28e34dd73stealer

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

3c5f92faf516d1465cda31b23f6c41b28e34dd73

Attributes
  • url4cnc

    https://telete.in/horslotuselis

rc4.plain
1
$Z2s`ten\@bE9vzR
rc4.plain
1
a5ed90ff63141871007675d11033694b

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Users\Admin\AppData\Local\Temp\ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      2⤵
        PID:2884
      • C:\Users\Admin\AppData\Local\Temp\ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
        2⤵
        • Modifies system certificate store
        PID:1276

    Network

    • flag-us
      DNS
      telete.in
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      telete.in
      IN A
      Response
      telete.in
      IN A
      185.53.177.54
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:23 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:28 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:33 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:38 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:43 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:48 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:53 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:08:58 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:03 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:08 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:14 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:19 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:24 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:29 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:34 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:39 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:44 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:49 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:54 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:09:59 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:10:04 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:10:09 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:10:14 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:10:19 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:10:24 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • flag-de
      GET
      https://telete.in/horslotuselis
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      Remote address:
      185.53.177.54:443
      Request
      GET /horslotuselis HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/plain; charset=UTF-8
      Host: telete.in
      Response
      HTTP/1.1 410 Gone
      Date: Sun, 14 Apr 2024 22:10:29 GMT
      Content-Length: 10
      Content-Type: text/plain; charset=utf-8
    • 185.53.177.54:443
      https://telete.in/horslotuselis
      tls, http
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      8.0kB
       10.7kB
       60
      38

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410

      HTTP Request

      GET https://telete.in/horslotuselis

      HTTP Response

      410
    • 8.8.8.8:53
      telete.in
      dns
      ef9ec305233a1d1e0705c1b58170ba4a_JaffaCakes118.exe
      55 B
       71 B
       1
      1

      DNS Request

      telete.in

      DNS Response

      185.53.177.54

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1276-4-0x0000000000400000-0x0000000000495000-memory.dmp

      Filesize

      596KB

      Download

    • memory/1276-6-0x0000000000400000-0x0000000000495000-memory.dmp

      Filesize

      596KB

      Download

    • memory/1276-8-0x0000000000400000-0x0000000000495000-memory.dmp

      Filesize

      596KB

      Download

    • memory/1276-9-0x0000000000400000-0x0000000000495000-memory.dmp

      Filesize

      596KB

      Download

    • memory/2960-0-0x0000000000230000-0x00000000002CC000-memory.dmp

      Filesize

      624KB

      Download

    • memory/2960-1-0x0000000074AD0000-0x00000000751BE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2960-2-0x0000000004B40000-0x0000000004B80000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2960-3-0x00000000004A0000-0x00000000004C6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2960-7-0x0000000074AD0000-0x00000000751BE000-memory.dmp

      Filesize

      6.9MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.