Overview

overview

10

Static

static

3

34862c07cd...18.exe

windows7-x64

10

34862c07cd...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 11:26 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe

  • Size

    366KB

  • MD5

    34862c07cd78d7a666d050b47dd2947e

  • SHA1

    7cdbf29b0f30c5027a0a9a36d31dbaf59ff87a35

  • SHA256

    6b86f83e3771fc5980e3a3ded1e1ecd25baff9f8cbd4f413300210790f99c42c

  • SHA512

    baccd1c82c046a5c5449be13b965e22922705edfe14355868fa4436ccf5b8d9e20a015cefb59d412c48ec9b9dcf4fc11c327ad1fa2a73beb210a4bfcc8bece3b

  • SSDEEP

    6144:CIpMzUW/BsYB1Z7ophFTFYh4mYvshWh1OpZbjukXjG9T2KrjPRZfKNyhTO4sbwfv:CfgWJtj9ophrM49O44pZbju0jGFzjPRf

Score
10/10
fickerstealerinfostealer

Malware Config

Extracted

Family

fickerstealer

C2

deniedfight.com:80

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Local\Temp\34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe"
      2⤵
        PID:5076

    Network

    • flag-us
      DNS
      api.ipify.org
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      api.ipify.org
      IN A
      Response
      api.ipify.org
      IN A
      104.26.12.205
      api.ipify.org
      IN A
      172.67.74.152
      api.ipify.org
      IN A
      104.26.13.205
    • flag-us
      GET
      http://api.ipify.org/?format=xml
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      104.26.12.205:80
      Request
      GET /?format=xml HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Host: api.ipify.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Wed, 10 Jul 2024 11:26:36 GMT
      Content-Type: text/plain
      Content-Length: 13
      Connection: keep-alive
      Vary: Origin
      CF-Cache-Status: DYNAMIC
      Server: cloudflare
      CF-RAY: 8a1033286f3471ec-LHR
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.dual-a-0034.a-msedge.net
      g-bing-com.dual-a-0034.a-msedge.net
      IN CNAME
      dual-a-0034.a-msedge.net
      dual-a-0034.a-msedge.net
      IN A
      204.79.197.237
      dual-a-0034.a-msedge.net
      IN A
      13.107.21.237
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=3F40AEAE62B861BB3BCBBA16633B604A; domain=.bing.com; expires=Mon, 04-Aug-2025 11:26:37 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: F0C307C8190648C88E76ACF33381A5B4 Ref B: AMS04EDGE2814 Ref C: 2024-07-10T11:26:37Z
      date: Wed, 10 Jul 2024 11:26:36 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=3F40AEAE62B861BB3BCBBA16633B604A
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=DFRpW5dqmJrRkyqyVsNJK9UcU20tSp5A1sIzb_GYysk; domain=.bing.com; expires=Mon, 04-Aug-2025 11:26:37 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 66453CE8189E447D9459AB0ACCE69C80 Ref B: AMS04EDGE2814 Ref C: 2024-07-10T11:26:37Z
      date: Wed, 10 Jul 2024 11:26:36 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=3F40AEAE62B861BB3BCBBA16633B604A; MSPTC=DFRpW5dqmJrRkyqyVsNJK9UcU20tSp5A1sIzb_GYysk
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: BC045CE6C4D64D48B6D3810FDA0CD375 Ref B: AMS04EDGE2814 Ref C: 2024-07-10T11:26:37Z
      date: Wed, 10 Jul 2024 11:26:36 GMT
    • flag-us
      DNS
      205.12.26.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.12.26.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      237.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.197.79.204.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      81.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.144.22.2.in-addr.arpa
      IN PTR
      Response
      81.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-81deploystaticakamaitechnologiescom
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      29.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      29.243.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • flag-us
      DNS
      deniedfight.com
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      Remote address:
      8.8.8.8:53
      Request
      deniedfight.com
      IN A
      Response
    • 104.26.12.205:80
      http://api.ipify.org/?format=xml
      http
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      559 B
       401 B
       6
      4

      HTTP Request

      GET http://api.ipify.org/?format=xml

      HTTP Response

      200
    • 204.79.197.237:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
      tls, http2
      2.0kB
       9.3kB
       22
      19

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7e89ef878a544907beaa0e5cce0f4a77&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

      HTTP Response

      204
    • 8.8.8.8:53
      api.ipify.org
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      59 B
       107 B
       1
      1

      DNS Request

      api.ipify.org

      DNS Response

      104.26.12.205
      172.67.74.152
      104.26.13.205

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       151 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      204.79.197.237
      13.107.21.237

    • 8.8.8.8:53
      205.12.26.104.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      205.12.26.104.in-addr.arpa

    • 8.8.8.8:53
      237.197.79.204.in-addr.arpa
      dns
      73 B
       143 B
       1
      1

      DNS Request

      237.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      71.31.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      71.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      81.144.22.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      81.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      29.243.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      29.243.111.52.in-addr.arpa

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    • 8.8.8.8:53
      deniedfight.com
      dns
      34862c07cd78d7a666d050b47dd2947e_JaffaCakes118.exe
      61 B
       134 B
       1
      1

      DNS Request

      deniedfight.com

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\kaosdma.txt
      Filesize

      13B

      MD5

      907326301a53876360553d631f2775c4

      SHA1

      e900c12c18a7295611f3e2234bc68e8dc0501e06

      SHA256

      d5543b3a5715587c9c0993a7f56f3e1ee445af837f62c38f2f3457a2ea8d00c8

      SHA512

      435c1fd96b79b70c370d6f769d44eca3e682404189ff42a6b5718c21bf9dc8358d72c115d68dc25014b8cb9c709af0e64de012103fce687cf4a340fa8f3ea2aa

      Download Submit

    • memory/628-2-0x0000000002BD0000-0x0000000002C15000-memory.dmp

      Filesize

      276KB

      Download

    • memory/628-1-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/5076-3-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

      Download

    • memory/5076-5-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

      Download

    • memory/5076-6-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

      Download

    • memory/5076-12-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.