Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

ff0ba30bf9...18.exe

windows7-x64

8

ff0ba30bf9...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 17:43 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe

  • Size

    731KB

  • MD5

    ff0ba30bf984ab9528b4f7a3e836b852

  • SHA1

    2c95aefbfb20ab29a236767bc8b6ca50bbd3fbc3

  • SHA256

    a2d387ed3b20b3b7c3a46936e296a2ee1c7efdc2c726f669e4d9c23cd135a3ee

  • SHA512

    2a54b9ee3a22bdc936b7976a23726ac7c8aed56d1933a8f1933a05b545ca67ce0e56c545059ae5f478f0279aa538b7310394ccf7624e6646cb71204c4133a87f

  • SSDEEP

    12288:Jaingtd/9iCpVEZxzraxdUdpmeFmjnDgGeIttwoPR5pWZhAIRXHYnrmJ:JaigD/ArravUdsewnlFttwYQRXHYrmJ

Score
8/10
discoveryevasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1152
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2644
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1336
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1380

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    cdn.download.sweetpacks.com
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    cdn.download.sweetpacks.com
    IN A
    Response
    cdn.download.sweetpacks.com
    IN CNAME
    google.com
    google.com
    IN A
    142.250.200.14
  • flag-us
    DNS
    www.directdownloader.com
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    www.directdownloader.com
    IN A
    Response
    www.directdownloader.com
    IN A
    162.255.119.249
  • flag-gb
    GET
    http://cdn.download.sweetpacks.com/simsdm/bundle/bundlesweetimsetup.exe
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    142.250.200.14:80
    Request
    GET /simsdm/bundle/bundlesweetimsetup.exe HTTP/1.1
    Range: bytes=0-
    User-Agent: downloader
    Host: cdn.download.sweetpacks.com
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html; charset=UTF-8
    Referrer-Policy: no-referrer
    Content-Length: 1597
    Date: Sun, 29 Sep 2024 17:43:51 GMT
  • flag-us
    GET
    http://www.directdownloader.com/DirectDownloaderInstaller.exe
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    162.255.119.249:80
    Request
    GET /DirectDownloaderInstaller.exe HTTP/1.1
    Range: bytes=0-
    User-Agent: downloader
    Host: www.directdownloader.com
    Response
    HTTP/1.1 302 Found
    Date: Sun, 29 Sep 2024 17:43:51 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 113
    Connection: keep-alive
    Location: http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe
    X-Served-By: Namecheap URL Forward
    Server: namecheap-nginx
  • flag-us
    DNS
    www.google.com
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    www.google.com
    IN A
    Response
    www.google.com
    IN A
    142.250.180.4
  • flag-gb
    GET
    http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    142.250.180.4:80
    Request
    GET /enterprise/apps/business/products.html/DirectDownloaderInstaller.exe HTTP/1.1
    Range: bytes=0-
    User-Agent: downloader
    Host: www.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Location: https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe
    Cross-Origin-Resource-Policy: cross-origin
    X-Content-Type-Options: nosniff
    Server: sffe
    Content-Length: 284
    X-XSS-Protection: 0
    Date: Sun, 29 Sep 2024 17:43:32 GMT
    Expires: Sun, 29 Sep 2024 18:13:32 GMT
    Cache-Control: public, max-age=1800
    Content-Type: text/html; charset=UTF-8
    Age: 19
  • flag-us
    DNS
    enterprise.google.com
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    enterprise.google.com
    IN A
    Response
    enterprise.google.com
    IN CNAME
    www3.l.google.com
    www3.l.google.com
    IN A
    142.250.178.14
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.200.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.200.250.142.in-addr.arpa
    IN PTR
    Response
    14.200.250.142.in-addr.arpa
    IN PTR
    lhr48s29-in-f141e100net
  • flag-us
    DNS
    249.119.255.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    249.119.255.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    4.180.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.180.250.142.in-addr.arpa
    IN PTR
    Response
    4.180.250.142.in-addr.arpa
    IN PTR
    lhr25s32-in-f41e100net
  • flag-gb
    GET
    https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    142.250.178.14:443
    Request
    GET /apps/business/products.html/DirectDownloaderInstaller.exe HTTP/1.1
    Range: bytes=0-
    User-Agent: downloader
    Connection: Keep-Alive
    Host: enterprise.google.com
    Response
    HTTP/1.1 301 Moved Permanently
    Location: https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe
    Cross-Origin-Resource-Policy: cross-origin
    X-Content-Type-Options: nosniff
    Server: sffe
    Content-Length: 266
    X-XSS-Protection: 0
    Date: Sun, 29 Sep 2024 17:43:30 GMT
    Expires: Sun, 29 Sep 2024 18:13:30 GMT
    Cache-Control: public, max-age=1800
    Content-Type: text/html; charset=UTF-8
    Age: 22
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    c.pki.goog
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.187.227
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    142.250.187.227:80
    Request
    GET /r/r1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 854
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sun, 29 Sep 2024 17:43:07 GMT
    Expires: Sun, 29 Sep 2024 18:33:07 GMT
    Cache-Control: public, max-age=3000
    Age: 45
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    o.pki.goog
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    o.pki.goog
    IN A
    Response
    o.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.187.227
  • flag-gb
    GET
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDmcMw%2Fo03sIxABiVt5eEgl
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    142.250.187.227:80
    Request
    GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDmcMw%2Fo03sIxABiVt5eEgl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: o.pki.goog
    Response
    HTTP/1.1 200 OK
    Server: ocsp_responder
    Content-Length: 472
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Date: Sun, 29 Sep 2024 17:30:01 GMT
    Cache-Control: public, max-age=14400
    Content-Type: application/ocsp-response
    Age: 831
  • flag-us
    DNS
    gsuite.google.com
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    gsuite.google.com
    IN A
    Response
    gsuite.google.com
    IN A
    172.217.16.238
  • flag-gb
    GET
    https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    172.217.16.238:443
    Request
    GET /products.html/DirectDownloaderInstaller.exe HTTP/1.1
    Range: bytes=0-
    User-Agent: downloader
    Connection: Keep-Alive
    Host: gsuite.google.com
    Response
    HTTP/1.1 301 Moved Permanently
    Location: https://workspace.google.com/products.html/DirectDownloaderInstaller.exe
    X-Content-Type-Options: nosniff
    Server: sffe
    Content-Length: 269
    X-XSS-Protection: 0
    Date: Sun, 29 Sep 2024 17:43:30 GMT
    Expires: Sun, 29 Sep 2024 18:13:30 GMT
    Cache-Control: public, max-age=1800
    Content-Type: text/html; charset=UTF-8
    Age: 22
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    workspace.google.com
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    workspace.google.com
    IN A
    Response
    workspace.google.com
    IN A
    172.217.169.78
  • flag-us
    DNS
    14.178.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.178.250.142.in-addr.arpa
    IN PTR
    Response
    14.178.250.142.in-addr.arpa
    IN PTR
    lhr48s27-in-f141e100net
  • flag-us
    DNS
    238.16.217.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    238.16.217.172.in-addr.arpa
    IN PTR
    Response
    238.16.217.172.in-addr.arpa
    IN PTR
    mad08s04-in-f141e100net
    238.16.217.172.in-addr.arpa
    IN PTR
    lhr48s28-in-f14�I
  • flag-us
    DNS
    227.187.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    227.187.250.142.in-addr.arpa
    IN PTR
    Response
    227.187.250.142.in-addr.arpa
    IN PTR
    lhr25s34-in-f31e100net
  • flag-gb
    GET
    https://workspace.google.com/products.html/DirectDownloaderInstaller.exe
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    Remote address:
    172.217.169.78:443
    Request
    GET /products.html/DirectDownloaderInstaller.exe HTTP/1.1
    Range: bytes=0-
    User-Agent: downloader
    Connection: Keep-Alive
    Host: workspace.google.com
    Response
    HTTP/1.1 404 Not Found
    Cross-Origin-Resource-Policy: cross-origin
    Content-Type: text/html; charset=ISO-8859-1
    P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Date: Sun, 29 Sep 2024 17:43:52 GMT
    Server: sffe
    Content-Length: 255678
    X-XSS-Protection: 0
    Set-Cookie: NID=518=HGPA08zWsfv_V8U8VBaa8w1LTEWJEv-SIL0iq2cqsNimlTchLprkLgY5BHaskvv0hektcjD1zOmJz65ES0HLCivCR3Rug3qzSdyynBUtgfDlwayF7z-H-xm__I0oqJEZavWY0Q968pzVvA-PjWJfeUIrJvRl3yfJE4hd_Yuh5hs7YZrA; expires=Mon, 31-Mar-2025 17:43:52 GMT; path=/; domain=.google.com; HttpOnly
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    78.169.217.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    78.169.217.172.in-addr.arpa
    IN PTR
    Response
    78.169.217.172.in-addr.arpa
    IN PTR
    lhr48s09-in-f141e100net
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 142.250.200.14:80
    http://cdn.download.sweetpacks.com/simsdm/bundle/bundlesweetimsetup.exe
    http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    452 B
     2.0kB
     7
    5

    HTTP Request

    GET http://cdn.download.sweetpacks.com/simsdm/bundle/bundlesweetimsetup.exe

    HTTP Response

    404
  • 162.255.119.249:80
    http://www.directdownloader.com/DirectDownloaderInstaller.exe
    http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    672 B
     592 B
     12
    4

    HTTP Request

    GET http://www.directdownloader.com/DirectDownloaderInstaller.exe

    HTTP Response

    302
  • 142.250.180.4:80
    http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe
    http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    449 B
     885 B
     6
    4

    HTTP Request

    GET http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe

    HTTP Response

    301
  • 142.250.178.14:443
    https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe
    tls, http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    1.1kB
     8.0kB
     14
    11

    HTTP Request

    GET https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe

    HTTP Response

    301
  • 142.250.187.227:80
    http://c.pki.goog/r/r1.crl
    http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    395 B
     1.8kB
     6
    5

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    200
  • 142.250.187.227:80
    http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDmcMw%2Fo03sIxABiVt5eEgl
    http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    511 B
     884 B
     6
    4

    HTTP Request

    GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDmcMw%2Fo03sIxABiVt5eEgl

    HTTP Response

    200
  • 172.217.16.238:443
    https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe
    tls, http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    1.1kB
     7.9kB
     14
    10

    HTTP Request

    GET https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe

    HTTP Response

    301
  • 172.217.169.78:443
    https://workspace.google.com/products.html/DirectDownloaderInstaller.exe
    tls, http
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    10.0kB
     277.1kB
     207
    204

    HTTP Request

    GET https://workspace.google.com/products.html/DirectDownloaderInstaller.exe

    HTTP Response

    404
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    cdn.download.sweetpacks.com
    dns
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    143 B
     196 B
     2
    2

    DNS Request

    cdn.download.sweetpacks.com

    DNS Response

    142.250.200.14

    DNS Request

    www.directdownloader.com

    DNS Response

    162.255.119.249

  • 8.8.8.8:53
    www.google.com
    dns
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    60 B
     76 B
     1
    1

    DNS Request

    www.google.com

    DNS Response

    142.250.180.4

  • 8.8.8.8:53
    enterprise.google.com
    dns
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    67 B
     104 B
     1
    1

    DNS Request

    enterprise.google.com

    DNS Response

    142.250.178.14

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    14.200.250.142.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    14.200.250.142.in-addr.arpa

  • 8.8.8.8:53
    249.119.255.162.in-addr.arpa
    dns
    74 B
     154 B
     1
    1

    DNS Request

    249.119.255.162.in-addr.arpa

  • 8.8.8.8:53
    4.180.250.142.in-addr.arpa
    dns
    72 B
     110 B
     1
    1

    DNS Request

    4.180.250.142.in-addr.arpa

  • 8.8.8.8:53
    c.pki.goog
    dns
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.187.227

  • 8.8.8.8:53
    o.pki.goog
    dns
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    56 B
     107 B
     1
    1

    DNS Request

    o.pki.goog

    DNS Response

    142.250.187.227

  • 8.8.8.8:53
    gsuite.google.com
    dns
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    63 B
     79 B
     1
    1

    DNS Request

    gsuite.google.com

    DNS Response

    172.217.16.238

  • 8.8.8.8:53
    workspace.google.com
    dns
    ff0ba30bf984ab9528b4f7a3e836b852_JaffaCakes118.exe
    66 B
     82 B
     1
    1

    DNS Request

    workspace.google.com

    DNS Response

    172.217.169.78

  • 8.8.8.8:53
    14.178.250.142.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    14.178.250.142.in-addr.arpa

  • 8.8.8.8:53
    238.16.217.172.in-addr.arpa
    dns
    73 B
     142 B
     1
    1

    DNS Request

    238.16.217.172.in-addr.arpa

  • 8.8.8.8:53
    227.187.250.142.in-addr.arpa
    dns
    74 B
     112 B
     1
    1

    DNS Request

    227.187.250.142.in-addr.arpa

  • 8.8.8.8:53
    78.169.217.172.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    78.169.217.172.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe
    Filesize

    7B

    MD5

    824ab679eea19c5b43b186800c2c625f

    SHA1

    f8b90bc89117ac4f1a272e7acef952a79a64b617

    SHA256

    f6d4a23bd6b412e4d4906cbd1c56dcbcf5ddd96b6a9098ceba96be94e52f7ab3

    SHA512

    e13bb9c005c2acb412916bf0f4a37b39c2800298042d5344b877143d1b767342903c9bb3e8d4eda75f37cc323b5f623d6bf34629d2c999c7df316de4ffd3caf4

    Download Submit

  • memory/1176-13-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.