Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/10/2024, 03:53 UTC
General
-
Target
1f70ce5c67b3381a16c9edcd2ef16a04_JaffaCakes118.exe
-
Size
770KB
-
MD5
1f70ce5c67b3381a16c9edcd2ef16a04
-
SHA1
1f3746b68606f3ea96735c4af90df0e96d6b1ea2
-
SHA256
474f66d3344f0a29d6484ab7de9e11e6a293a5d5c719508c91b9bc7d673ce545
-
SHA512
e537fc2f58f9cb314a8da3319c33a31c151bf47283f4822cc5204192f2b51d11a4a02c3c12579ec14b955d9c1a0846e3cb568b86bf416640ea4b800e8cb7aa68
-
SSDEEP
12288:qi8ztcfLUVq0OwHK7zz9NzyT0wlWSMZmbhpmXSzf2FteyC6qn6m5U85O:qi8JKuOnnvWfnhPisyg5
Score
10/10
Malware Config
Extracted
Family
snakekeylogger
Credentials
Protocol: smtp- Host:
mail.rainspor.com - Port:
587 - Username:
assad@rainspor.com - Password:
assad123assad - Email To:
assad@rainspor.com
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f70ce5c67b3381a16c9edcd2ef16a04_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f70ce5c67b3381a16c9edcd2ef16a04_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1f70ce5c67b3381a16c9edcd2ef16a04_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f70ce5c67b3381a16c9edcd2ef16a04_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 16243⤵
- Program crash
-
-
Network
-
DNScheckip.dyndns.orgRemote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A193.122.130.0checkip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A193.122.6.168checkip.dyndns.comIN A132.226.8.169checkip.dyndns.comIN A158.101.44.242 -
GEThttp://checkip.dyndns.org/Remote address:193.122.130.0:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 08 Oct 2024 14:46:32 GMT
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 568797638d6af67ac55622628e1ef878
-
GEThttp://checkip.dyndns.org/Remote address:193.122.130.0:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Date: Tue, 08 Oct 2024 14:46:35 GMT
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: b64bd8bb3a8ff3caf7d44a142ae5e329
-
DNSfreegeoip.appRemote address:8.8.8.8:53Requestfreegeoip.appIN AResponsefreegeoip.appIN A172.67.160.84freegeoip.appIN A104.21.73.97
-
GEThttps://freegeoip.app/xml/138.199.29.44Remote address:172.67.160.84:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: freegeoip.app
Connection: Keep-Alive
ResponseHTTP/1.1 301 Moved Permanently
Date: Tue, 08 Oct 2024 14:46:38 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 08 Oct 2024 15:46:38 GMT
Location: https://ipbase.com/xml/138.199.29.44
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fo8%2BYkLl%2BfqMadCUlK9ZGC6JOHcHimebtlcg%2Bz%2Ba5eM9O5vFwN5Rw9GREzb%2FXUvnysxA1nbPbaYnv6b8XugOaeu4kZCz19Hax%2Fh%2BxjF2Lfg3XMjn%2BgxJ3zhKSn22qv60"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Speculation-Rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 8cf6ebe9ee5648c8-LHR
-
DNSipbase.comRemote address:8.8.8.8:53Requestipbase.comIN AResponseipbase.comIN A172.67.209.71ipbase.comIN A104.21.85.189
-
GEThttps://ipbase.com/xml/138.199.29.44Remote address:172.67.209.71:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: ipbase.com
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Date: Tue, 08 Oct 2024 14:46:38 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Age: 4916
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; hit
Vary: Accept-Encoding
X-Nf-Request-Id: 01J9P9HBTMX4YWGAJZ5H1YB0X6
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YuV5vIi%2BFFv6tC%2BknZIqTvmpnDO8hY1dds9hQb4dvexGUDK9xF7vsOVa6WqjDP71jHrlv5ZZ3fYa7lFfl%2Bhc%2F3o6WSKXGhed%2FmSP1JYH0Assw5HcGFvpTad832xw"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Speculation-Rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 8cf6ebeb7916070a-LHR
-
193.122.130.0:80http://checkip.dyndns.org/http
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200 -
172.67.160.84:443https://freegeoip.app/xml/138.199.29.44tls, http
HTTP Request
GET https://freegeoip.app/xml/138.199.29.44HTTP Response
301 -
172.67.209.71:443https://ipbase.com/xml/138.199.29.44tls, http
HTTP Request
GET https://ipbase.com/xml/138.199.29.44HTTP Response
404
-
8.8.8.8:53checkip.dyndns.orgdns
DNS Request
checkip.dyndns.org
DNS Response
193.122.130.0132.226.247.73193.122.6.168132.226.8.169158.101.44.242
-
8.8.8.8:53freegeoip.appdns
DNS Request
freegeoip.app
DNS Response
172.67.160.84104.21.73.97
-
8.8.8.8:53ipbase.comdns
DNS Request
ipbase.com
DNS Response
172.67.209.71104.21.85.189
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
792KB
-
Filesize
6.9MB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
560KB
-
Filesize
144KB
-
Filesize
6.9MB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB