Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

40126767bf...18.exe

windows7-x64

7

40126767bf...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 13:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe

  • Size

    165KB

  • MD5

    40126767bf28d05e060d06c6233d4544

  • SHA1

    6ecd6a4890cac261fba621756d2b1ab493e98361

  • SHA256

    147b690a3b4eb0d6033e2394c55b019cc9e99b20c59dc22b892911e760aeaf4f

  • SHA512

    21a439ae33c83e9fe1dd7023a943b695a8b3dd0b5ea70e95a47fe0cef53f77ff897c695a40dafa6273c50c1402d95a118ef7aa1ccca0dab0c861bc48b539ef32

  • SSDEEP

    3072:y4HCWau/PlYeuL7ZLFh6Ca6cbL9l2hzB3fJCC6j8+Er6ez4:piI/PlY37ZLF4Ca6WABqBOvs

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\40126767bf28d05e060d06c6233d4544_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Local\Temp\ins8067\ins8067.exe
      "C:\Users\Admin\AppData\Local\Temp\ins8067\ins8067.exe" ins.exe /e6293404 /u50d1d9d5-cf90-407c-820a-35e05bc06f2f
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:536

Network

  • flag-us
    DNS
    68.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.socdn.com
    ins8067.exe
    Remote address:
    8.8.8.8:53
    Request
    api.socdn.com
    IN A
    Response
    api.socdn.com
    IN CNAME
    615321.parkingcrew.net
    615321.parkingcrew.net
    IN A
    13.248.148.254
    615321.parkingcrew.net
    IN A
    76.223.26.96
  • flag-us
    GET
    http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/config
    ins8067.exe
    Remote address:
    13.248.148.254:80
    Request
    GET /installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/config HTTP/1.1
    User-Agent: DownloadMR/3.0.21 (MSIE 9.11;Windows NT 6.2.9200.0;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;m=B660M GAMING X DDR4;northstar)
    Accept-Language: en-US
    Host: api.socdn.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Accept-Ch: viewport-width
    Accept-Ch: dpr
    Accept-Ch: device-memory
    Accept-Ch: rtt
    Accept-Ch: downlink
    Accept-Ch: ect
    Accept-Ch: ua
    Accept-Ch: ua-full-version
    Accept-Ch: ua-platform
    Accept-Ch: ua-platform-version
    Accept-Ch: ua-arch
    Accept-Ch: ua-model
    Accept-Ch: ua-mobile
    Accept-Ch-Lifetime: 30
    Content-Type: text/html; charset=UTF-8
    Date: Sun, 13 Oct 2024 13:18:59 GMT
    Server: Caddy
    Server: nginx
    Vary: Accept-Encoding
    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_rOmv83cr1AAqEX9JHoqHLGPvNJ4QcRn7CbnQ1ZwgNA43nHttjN6T09HzAnTmit1+gX6iV/ZBuo9vkwz9hiHicA==
    X-Buckets: bucket102
    X-Domain: socdn.com
    X-Language: english
    X-Pcrew-Blocked-Reason: hosting network
    X-Pcrew-Ip-Organization: Datacamp
    X-Redirect: skenzo
    X-Subdomain: api
    X-Template: tpl_CleanPeppermintBlack_twoclick
    Transfer-Encoding: chunked
  • flag-us
    POST
    http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/event
    ins8067.exe
    Remote address:
    13.248.148.254:80
    Request
    POST /installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/event HTTP/1.1
    User-Agent: DownloadMR/3.0.21 (MSIE 9.11;Windows NT 6.2.9200.0;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;m=B660M GAMING X DDR4;northstar)
    Accept-Language: en-US
    Content-Type: application/x-www-form-urlencoded
    Host: api.socdn.com
    Content-Length: 3393
    Expect: 100-continue
    Response
    HTTP/1.1 100 Continue
    Server: Caddy
  • flag-us
    DNS
    ins8067.exe
    Remote address:
    13.248.148.254:80
    Response
    HTTP/1.1 200 OK
    Accept-Ch: viewport-width
    Accept-Ch: dpr
    Accept-Ch: device-memory
    Accept-Ch: rtt
    Accept-Ch: downlink
    Accept-Ch: ect
    Accept-Ch: ua
    Accept-Ch: ua-full-version
    Accept-Ch: ua-platform
    Accept-Ch: ua-platform-version
    Accept-Ch: ua-arch
    Accept-Ch: ua-model
    Accept-Ch: ua-mobile
    Accept-Ch-Lifetime: 30
    Content-Type: text/html; charset=UTF-8
    Date: Sun, 13 Oct 2024 13:19:00 GMT
    Server: Caddy
    Server: nginx
    Vary: Accept-Encoding
    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_cnRMFzbldgJHJukTToWoqkVRUIbDeU0MeZLsPD7zt6soFMxKkouutwU2U4G7u0bkRXNVVtRP34JzT4Cq8o2b9A==
    X-Buckets: bucket102
    X-Domain: socdn.com
    X-Language: english
    X-Pcrew-Blocked-Reason: hosting network
    X-Pcrew-Ip-Organization: Datacamp
    X-Redirect: skenzo
    X-Subdomain: api
    X-Template: tpl_CleanPeppermintBlack_twoclick
    Transfer-Encoding: chunked
  • flag-us
    DNS
    254.148.248.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.148.248.13.in-addr.arpa
    IN PTR
    Response
    254.148.248.13.in-addr.arpa
    IN PTR
    aba1c1ff9d2ec5376awsglobalacceleratorcom
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 13.248.148.254:80
    http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/event
    http
    ins8067.exe
    4.8kB
     7.3kB
     15
    17

    HTTP Request

    GET http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/config

    HTTP Response

    200

    HTTP Request

    POST http://api.socdn.com/installer/50d1d9d5-cf90-407c-820a-35e05bc06f2f/6293404/event

    HTTP Response

    100

    HTTP Response

    200
  • 8.8.8.8:53
    68.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    68.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    api.socdn.com
    dns
    ins8067.exe
    59 B
     127 B
     1
    1

    DNS Request

    api.socdn.com

    DNS Response

    13.248.148.254
    76.223.26.96

  • 8.8.8.8:53
    254.148.248.13.in-addr.arpa
    dns
    73 B
     129 B
     1
    1

    DNS Request

    254.148.248.13.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    103.209.201.84.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    103.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ins8067\ins8067.exe
    Filesize

    257KB

    MD5

    ae117f47bd80e5dcf72cf81347fceb73

    SHA1

    1cd3e4c5fc9fb317b7a8eae6c94d53078800b635

    SHA256

    49b0ec8a4000cb30f15b318bef4b6f59be2d0f7365be4c4b2b4fd5607e16e23c

    SHA512

    72d322ec9b13e9ede1967707129f2941328ec75487aa5ea205eab0780ef26c33f253204ce08932052a6ed19d13bd62e68b4f795ef17717b9f31e5a76a9f0c16f

    Download Submit

  • memory/536-18-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-12-0x0000000074102000-0x0000000074103000-memory.dmp

    Filesize

    4KB

    Download

  • memory/536-13-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-14-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-17-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-19-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-20-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-22-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-23-0x0000000074102000-0x0000000074103000-memory.dmp

    Filesize

    4KB

    Download

  • memory/536-25-0x0000000074100000-0x00000000746B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3436-0-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

    Download

  • memory/3436-21-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

    Download

  • memory/3436-26-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.