Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

2bb422e859...18.exe

windows7-x64

1

2bb422e859...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    16s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 08:47 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    2bb422e859cb7284cea3dd057d0f7307

  • SHA1

    4be0b78919956e3c060612e2ba10e8396292cdee

  • SHA256

    35be4d2d396f43d4ae1b3380fc3dd5322f285eda97b462fece81e85b3ebd9ce2

  • SHA512

    27ea717987d8129ec52d6f2d10f98b502f4e0ad2811a597ec0f55bc2383cdc224e645f307ae90bbb7d7d6d375249134f35c0a8b2482a22810bd119f4d3f02088

  • SSDEEP

    3072:pvkhkbgd0Dv2L6A+pjWrwjxV/tqY8UNed+M4Nft2hU4C:pMkT/puwjbxedoNHP

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2360

Network

  • flag-us
    DNS
    brestin.in
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    brestin.in
    IN A
    Response
  • flag-us
    DNS
    windowsupdate.microsoft.com
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    windowsupdate.microsoft.com
    IN A
    Response
    windowsupdate.microsoft.com
    IN CNAME
    redir.update.msft.com.trafficmanager.net
    redir.update.msft.com.trafficmanager.net
    IN A
    20.109.209.108
  • flag-us
    GET
    http://windowsupdate.microsoft.com/
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    Remote address:
    20.109.209.108:80
    Request
    GET / HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: windowsupdate.microsoft.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 302 Redirect
    Content-Type: text/html; charset=UTF-8
    Location: http://fe2.update.microsoft.com/
    Server: Microsoft-IIS/10.0
    Date: Mon, 08 Jul 2024 14:36:02 GMT
    Content-Length: 155
  • flag-us
    DNS
    fe2.update.microsoft.com
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    fe2.update.microsoft.com
    IN A
    Response
    fe2.update.microsoft.com
    IN CNAME
    fe2.update.msft.com.trafficmanager.net
    fe2.update.msft.com.trafficmanager.net
    IN A
    52.252.198.178
    fe2.update.msft.com.trafficmanager.net
    IN A
    20.97.190.215
  • flag-us
    GET
    http://fe2.update.microsoft.com/
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    Remote address:
    52.252.198.178:80
    Request
    GET / HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: fe2.update.microsoft.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Server: Microsoft-IIS/10.0
    X-Powered-By: ASP.NET
    Date: Mon, 08 Jul 2024 14:36:03 GMT
    Content-Length: 1245
  • 20.109.209.108:80
    http://windowsupdate.microsoft.com/
    http
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    633 B
     832 B
     6
    3

    HTTP Request

    GET http://windowsupdate.microsoft.com/

    HTTP Response

    302
  • 52.252.198.178:80
    http://fe2.update.microsoft.com/
    http
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    1.1kB
     1.6kB
     9
    5

    HTTP Request

    GET http://fe2.update.microsoft.com/

    HTTP Response

    404
  • 8.8.8.8:53
    brestin.in
    dns
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    56 B
     109 B
     1
    1

    DNS Request

    brestin.in

  • 8.8.8.8:53
    windowsupdate.microsoft.com
    dns
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    73 B
     143 B
     1
    1

    DNS Request

    windowsupdate.microsoft.com

    DNS Response

    20.109.209.108

  • 8.8.8.8:53
    fe2.update.microsoft.com
    dns
    2bb422e859cb7284cea3dd057d0f7307_JaffaCakes118.exe
    70 B
     154 B
     1
    1

    DNS Request

    fe2.update.microsoft.com

    DNS Response

    52.252.198.178
    20.97.190.215

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.