Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

3e2aab25ff...18.dll

windows7-x64

7

3e2aab25ff...18.dll

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 17:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll

  • Size

    278KB

  • MD5

    3e2aab25fff0529721eb8a12b341b5af

  • SHA1

    16bc9431575411fd35ff25c5024fca4873d26dcb

  • SHA256

    ce7bc210779989a9b5fad9d1b7b8c53d6fba37614b8387d1327958f14a311c15

  • SHA512

    debc46701653d0a6eb357d6e7572cb898a06eff16730fff3e913923e263848be1b45c04a727450816b92e2e7a751d216ae86e308ae280b81ebbf42244a8487f2

  • SSDEEP

    6144:1ZFh/0bKu7ZcD0wEaoX/OPthW+fmAWgWVKFl0xsDNmtZ0Kaw7t83/MqLscoS+:DEZcDP2UH3ZRl7sqwR05LscoS+

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e2aab25fff0529721eb8a12b341b5af_JaffaCakes118.dll,#1
      2⤵
        PID:3440
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 568
          3⤵
          • Program crash
          PID:5112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3440 -ip 3440
      1⤵
        PID:2192

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=12B2DBA6E56065FC372ECF1CE48064A0; domain=.bing.com; expires=Wed, 06-Aug-2025 17:04:07 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 1FE5BA0B7F4A4737923376C4C436BE16 Ref B: LON04EDGE1222 Ref C: 2024-07-12T17:04:07Z
        date: Fri, 12 Jul 2024 17:04:06 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=12B2DBA6E56065FC372ECF1CE48064A0
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=QjbxM1yjTWIrllZzi8AZP0miYTk-ljMMRKR71rYGC74; domain=.bing.com; expires=Wed, 06-Aug-2025 17:04:07 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 9860C89D77924CC286F733A04EC6940A Ref B: LON04EDGE1222 Ref C: 2024-07-12T17:04:07Z
        date: Fri, 12 Jul 2024 17:04:06 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=12B2DBA6E56065FC372ECF1CE48064A0; MSPTC=QjbxM1yjTWIrllZzi8AZP0miYTk-ljMMRKR71rYGC74
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: C272E8EF1D5E447D95863B5059E4922F Ref B: LON04EDGE1222 Ref C: 2024-07-12T17:04:07Z
        date: Fri, 12 Jul 2024 17:04:06 GMT
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        68.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        68.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        73.144.22.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        73.144.22.2.in-addr.arpa
        IN PTR
        Response
        73.144.22.2.in-addr.arpa
        IN PTR
        a2-22-144-73deploystaticakamaitechnologiescom
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        56.126.166.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        56.126.166.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        107.12.20.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        107.12.20.2.in-addr.arpa
        IN PTR
        Response
        107.12.20.2.in-addr.arpa
        IN PTR
        a2-20-12-107deploystaticakamaitechnologiescom
      • flag-us
        DNS
        23.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        23.236.111.52.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.237:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        tls, http2
        2.0kB
         9.3kB
         22
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a4f3ccd5d0824b12a3162ea47596f368&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

        HTTP Response

        204
      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.237
        13.107.21.237

      • 8.8.8.8:53
        237.197.79.204.in-addr.arpa
        dns
        73 B
         143 B
         1
        1

        DNS Request

        237.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        68.32.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        68.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        73.144.22.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        73.144.22.2.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        56.126.166.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        56.126.166.20.in-addr.arpa

      • 8.8.8.8:53
        107.12.20.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        107.12.20.2.in-addr.arpa

      • 8.8.8.8:53
        23.236.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        23.236.111.52.in-addr.arpa

      • 8.8.8.8:53

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3440-0-0x0000000010000000-0x00000000100A2000-memory.dmp

        Filesize

        648KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.