Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

ac2f9c931c...18.exe

windows7-x64

10

ac2f9c931c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 18:59 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac2f9c931c360941abf3d73b58c607fa_JaffaCakes118.exe

  • Size

    90KB

  • MD5

    ac2f9c931c360941abf3d73b58c607fa

  • SHA1

    3bc48b58a78219bc56541fde98c71b7485ee3d6a

  • SHA256

    4144c835690ce732a210ae58f32725741f7f3d83b5ba8d62893b557883a269b5

  • SHA512

    87b5d5eaccbaf0c3a28cd0829b6f0bb2bbeaebc45a35157bbbb85b7fae8982964ba2f9891f798ca207cc0198940e90a5f170d00d1b1357e64d948a7a54fbf1da

  • SSDEEP

    1536:xY9hMoIK7kaQtm3SnpfJp3Mz+BtmYfs0SesDqzBc5JCRmLhrzTQonHGwOki17:+PMwQTnxBXs0SHDqzB2oChrzEuOH

Score
10/10
discoveryevasiontrojan

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 5 IoCs
    evasiontrojan
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac2f9c931c360941abf3d73b58c607fa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ac2f9c931c360941abf3d73b58c607fa_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1624
  • C:\Windows\svchost.exe
    "C:\Windows\svchost.exe"
    1⤵
    • Modifies security service
    • Windows security bypass
    • Deletes itself
    • Executes dropped EXE
    • Windows security modification
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:4856

Network

  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    25.140.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    25.140.123.92.in-addr.arpa
    IN PTR
    Response
    25.140.123.92.in-addr.arpa
    IN PTR
    a92-123-140-25deploystaticakamaitechnologiescom
  • flag-us
    DNS
    82.177.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    82.177.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.nulloxx.net
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    www.nulloxx.net
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    147.142.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    147.142.123.92.in-addr.arpa
    IN PTR
    Response
    147.142.123.92.in-addr.arpa
    IN PTR
    a92-123-142-147deploystaticakamaitechnologiescom
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    38.58.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    38.58.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
  • flag-us
    DNS
    squid.oxxname.com
    svchost.exe
    Remote address:
    8.8.8.8:53
    Request
    squid.oxxname.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    25.140.123.92.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    25.140.123.92.in-addr.arpa

  • 8.8.8.8:53
    82.177.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    82.177.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    www.nulloxx.net
    dns
    svchost.exe
    61 B
     134 B
     1
    1

    DNS Request

    www.nulloxx.net

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    126 B
     136 B
     2
    1

    DNS Request

    squid.oxxname.com

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    147.142.123.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    147.142.123.92.in-addr.arpa

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    38.58.20.217.in-addr.arpa
    dns
    71 B
     131 B
     1
    1

    DNS Request

    38.58.20.217.in-addr.arpa

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    216 B
     158 B
     3
    1

    DNS Request

    14.227.111.52.in-addr.arpa

    DNS Request

    14.227.111.52.in-addr.arpa

    DNS Request

    14.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

  • 8.8.8.8:53
    squid.oxxname.com
    dns
    svchost.exe
    63 B
     136 B
     1
    1

    DNS Request

    squid.oxxname.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe
    Filesize

    90KB

    MD5

    ac2f9c931c360941abf3d73b58c607fa

    SHA1

    3bc48b58a78219bc56541fde98c71b7485ee3d6a

    SHA256

    4144c835690ce732a210ae58f32725741f7f3d83b5ba8d62893b557883a269b5

    SHA512

    87b5d5eaccbaf0c3a28cd0829b6f0bb2bbeaebc45a35157bbbb85b7fae8982964ba2f9891f798ca207cc0198940e90a5f170d00d1b1357e64d948a7a54fbf1da

    Download Submit

  • memory/1624-8-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/1624-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1624-2-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1624-0-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/1624-9-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/4856-13-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-16-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-11-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-12-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-7-0x00000000001E0000-0x00000000001E4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/4856-14-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-15-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-10-0x00000000001E0000-0x00000000001E4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/4856-18-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-19-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-21-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-22-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-23-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-24-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-25-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4856-26-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.