Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 16:58 UTC

General

  • Target

    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe

  • Size

    94KB

  • MD5

    4105f93b05e661c42e73db36cf29a6ee

  • SHA1

    56914941d71012a5f290b2ba0e2d0b7a48f312bc

  • SHA256

    bcdb13401a7c98832830f379436df2f4fa876c74c5c248430cca50be13e290a0

  • SHA512

    5def96571c360a6e61f53a310478e4147e9c2c1b37a3ea84afcb1008c4fe8bf4e6b3f25f76210e9f0858e972e13c14500b74ef2e59c2c721038f1804a29853ad

  • SSDEEP

    1536:pe3w2dCqIAGzLqr3hd9Dt6pNz0XP3XStNLnpfkn4VeaFIy:Yw2vjkLqD76pNz0/8NDasdFIy

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Frj..bat" > nul 2> nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:8

Network

  • flag-us
    DNS
    vnexpress.net
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    vnexpress.net
    IN A
    Response
    vnexpress.net
    IN A
    111.65.250.2
  • flag-us
    DNS
    netlog.com
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    netlog.com
    IN A
    Response
    netlog.com
    IN A
    13.32.145.28
    netlog.com
    IN A
    13.32.145.50
    netlog.com
    IN A
    13.32.145.65
    netlog.com
    IN A
    13.32.145.129
  • flag-us
    DNS
    homeway.com.cn
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    homeway.com.cn
    IN A
    Response
    homeway.com.cn
    IN A
    82.157.151.50
  • flag-us
    DNS
    homeway.com.cn
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    homeway.com.cn
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=0CDD325DC26965161977274AC3AB64DB; domain=.bing.com; expires=Fri, 07-Nov-2025 16:58:18 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9AACFA08542045D6AFC4E861BB660BD7 Ref B: LON601060106029 Ref C: 2024-10-13T16:58:18Z
    date: Sun, 13 Oct 2024 16:58:17 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0CDD325DC26965161977274AC3AB64DB
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=dhjn49UFvcKmerJE5ilASw6bxisN3EmvZWFZ6Qqky9w; domain=.bing.com; expires=Fri, 07-Nov-2025 16:58:18 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A13C3D9370F24C599A6DEF3F0E7481FE Ref B: LON601060106029 Ref C: 2024-10-13T16:58:18Z
    date: Sun, 13 Oct 2024 16:58:17 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0CDD325DC26965161977274AC3AB64DB; MSPTC=dhjn49UFvcKmerJE5ilASw6bxisN3EmvZWFZ6Qqky9w
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DCD4B85E8C3E4D90A84089E808A2FDD4 Ref B: LON601060106029 Ref C: 2024-10-13T16:58:18Z
    date: Sun, 13 Oct 2024 16:58:17 GMT
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nboxonline.in
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    nboxonline.in
    IN A
    Response
  • flag-us
    DNS
    freeflashutilites.in
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    freeflashutilites.in
    IN A
    Response
  • flag-us
    DNS
    freefilesarchive.in
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    freefilesarchive.in
    IN A
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 150.171.27.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=
    tls, http2
    2.0kB
    9.4kB
    22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3832c11fde2e4a8ca73d2e07070f8f33&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=

    HTTP Response

    204
  • 8.8.8.8:53
    vnexpress.net
    dns
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    59 B
    75 B
    1
    1

    DNS Request

    vnexpress.net

    DNS Response

    111.65.250.2

  • 8.8.8.8:53
    netlog.com
    dns
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    56 B
    120 B
    1
    1

    DNS Request

    netlog.com

    DNS Response

    13.32.145.28
    13.32.145.50
    13.32.145.65
    13.32.145.129

  • 8.8.8.8:53
    homeway.com.cn
    dns
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    120 B
    76 B
    2
    1

    DNS Request

    homeway.com.cn

    DNS Request

    homeway.com.cn

    DNS Response

    82.157.151.50

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
    148 B
    1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    14.160.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    nboxonline.in
    dns
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    59 B
    112 B
    1
    1

    DNS Request

    nboxonline.in

  • 8.8.8.8:53
    freeflashutilites.in
    dns
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    66 B
    119 B
    1
    1

    DNS Request

    freeflashutilites.in

  • 8.8.8.8:53
    freefilesarchive.in
    dns
    4105f93b05e661c42e73db36cf29a6ee_JaffaCakes118.exe
    65 B
    118 B
    1
    1

    DNS Request

    freefilesarchive.in

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Frj..bat

    Filesize

    238B

    MD5

    911c38e8225089f721bc328d0604971d

    SHA1

    4af79d8502298820da10fae4f43a7fdbde94afa5

    SHA256

    18ec5eb78604e57b53005b9ef80e8d595c941299c807f862c24a934228e6f0f3

    SHA512

    9f21a254f2734e7b008614ee4f11d377f4ee47bbeeb3725e185d9704f419196184d655db1ddc4c2d771915c47fbab6528965332dd8350452b45a3268e0ac7191

  • memory/2032-0-0x0000000000402000-0x0000000000403000-memory.dmp

    Filesize

    4KB

  • memory/2032-1-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2032-2-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2032-3-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2032-5-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.