Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/09/2024, 04:22 UTC

240913-ey9r9stfrr 10

12/09/2024, 12:11 UTC

240912-pc26eavamh 10

12/09/2024, 11:40 UTC

240912-nszjsatdpb 10

12/09/2024, 11:38 UTC

240912-nrq61stdql 10

12/09/2024, 11:35 UTC

240912-np5lmatdkm 10

Analysis

  • max time kernel
    150s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 11:35 UTC

General

  • Target

    dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe

  • Size

    252KB

  • MD5

    dc3e61d5bd1f1fd82306ce219e4196b8

  • SHA1

    cda8133a4253547f688d51b68bee2cb7197eb6e2

  • SHA256

    442812aafdf526bea8f5b48aac3ecfbe41b555ed33031fee950e2de69c7243b5

  • SHA512

    19525a87738e8aacf1d85c5ab11cbfe62165bfd43f57100ca2eb2dcdc1f68d0299c34c785f9777baa0c2e8f7830952dd1270566406564f7ea7baa4b9e37e8946

  • SSDEEP

    6144:vwzrOIGFZPdfQhbTWKJnuZQiBU94SuuapvLugKf/FHqeOgo83:vwzrO9FLfQhbiKJnuZQ//FHy

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Users\Admin\dtquib.exe
      "C:\Users\Admin\dtquib.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:208

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ns1.player1253.com
    dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.player1253.com
    IN A
    Response
  • flag-us
    DNS
    ns1.videoall.net
    dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.videoall.net
    IN A
    Response
  • flag-us
    DNS
    ns1.mediashares.org
    dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.mediashares.org
    IN A
    Response
    ns1.mediashares.org
    IN A
    104.155.138.21
    ns1.mediashares.org
    IN A
    107.178.223.183
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.126.166.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.126.166.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    81.144.22.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    81.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    ns1.player1253.com
    dns
    dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe
    64 B
    137 B
    1
    1

    DNS Request

    ns1.player1253.com

  • 8.8.8.8:53
    ns1.videoall.net
    dns
    dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe
    62 B
    135 B
    1
    1

    DNS Request

    ns1.videoall.net

  • 8.8.8.8:53
    ns1.mediashares.org
    dns
    dc3e61d5bd1f1fd82306ce219e4196b8_JaffaCakes118.exe
    65 B
    97 B
    1
    1

    DNS Request

    ns1.mediashares.org

    DNS Response

    104.155.138.21
    107.178.223.183

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    56.126.166.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    56.126.166.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\dtquib.exe

    Filesize

    252KB

    MD5

    e8c135a17e5b4aefd64d6964f2cf7022

    SHA1

    1fc6916e0963bf273a1a835616e0c51bf9a62601

    SHA256

    81196d25958750ce28faa824d61d4b11b15fdac435ea541338c00cc67bef83d7

    SHA512

    e101646b9d0e888cd6053d452981dcfd98183bc25c4d8b519a2500cec3efcba54fd83b7100bc2ba60270ff4ca65b58075e1ea8e6c61cf5cc9a411f6d0eb1a2fa

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.