Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

de3d2e05f3...18.exe

windows7-x64

10

de3d2e05f3...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/12/2024, 19:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe

  • Size

    172KB

  • MD5

    de3d2e05f336d3def9627acf6207e491

  • SHA1

    0952fecd2e53ec418d936812e42aecb10a0bbfaf

  • SHA256

    53ed384c3457e3d19f7ac0b743028abed6ac2018c223a280403d2d8a6c6cee8d

  • SHA512

    720836d66df010601ba39c913ce7922d19d5fbd9180f892c78d01b74fa137fa2d6c1f8edbe57d834ba9e714e8c80081193bbb5223f282fcec61e14fa0e6fd2b1

  • SSDEEP

    3072:DzRJpmbQ0n85faqNZNcJtRVOlwbvrxYpuxqiuUSzhYGrVQOipATuWs+bYL7:DzRJkfZBd7fNfMh7rVQOieToZL7

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2676
    • C:\Users\Admin\AppData\Local\Temp\de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:692

Network

  • flag-us
    DNS
    hollandandbarrett.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    hollandandbarrett.com
    IN A
    Response
    hollandandbarrett.com
    IN A
    184.28.198.179
    hollandandbarrett.com
    IN A
    184.28.198.210
  • flag-gb
    GET
    http://hollandandbarrett.com/images/footer/account.jpg?v88=24&tq=gJ4WK%2FSUh7TFl0R8oY%2BQtMWTUj26kJH7yZtTK%2B%2FbxWq1SfkIYUBM
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    184.28.198.179:80
    Request
    GET /images/footer/account.jpg?v88=24&tq=gJ4WK%2FSUh7TFl0R8oY%2BQtMWTUj26kJH7yZtTK%2B%2FbxWq1SfkIYUBM HTTP/1.0
    Connection: close
    Host: hollandandbarrett.com
    Accept: */*
    User-Agent: mozilla/2.0
    Response
    HTTP/1.0 301 Moved Permanently
    Server: AkamaiGHost
    Content-Length: 0
    Location: https://hollandandbarrett.com/images/footer/account.jpg?v88=24&tq=gJ4WK%2FSUh7TFl0R8oY%2BQtMWTUj26kJH7yZtTK%2B%2FbxWq1SfkIYUBM
    Expires: Tue, 10 Dec 2024 19:08:30 GMT
    Cache-Control: max-age=0, no-cache, no-store
    Pragma: no-cache
    Date: Tue, 10 Dec 2024 19:08:30 GMT
    Connection: close
  • flag-us
    DNS
    zonedg.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    zonedg.com
    IN A
    Response
    zonedg.com
    IN A
    103.224.212.214
  • flag-us
    DNS
    zonedg.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    zonedg.com
    IN A
    Response
    zonedg.com
    IN A
    103.224.212.214
  • flag-us
    DNS
    separatemilkandtee.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    separatemilkandtee.com
    IN A
    Response
  • flag-us
    DNS
    zonedg.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    zonedg.com
    IN A
    Response
    zonedg.com
    IN A
    103.224.212.214
  • flag-us
    DNS
    zonedg.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    zonedg.com
    IN A
    Response
    zonedg.com
    IN A
    103.224.212.214
  • flag-us
    POST
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqpSr%2Fe%2BV5ZuRg%3D%3D
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    103.224.212.214:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqpSr%2Fe%2BV5ZuRg%3D%3D HTTP/1.1
    Host: zonedg.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 302 Found
    date: Tue, 10 Dec 2024 19:08:38 GMT
    server: Apache
    set-cookie: __tad=1733857718.4353684; expires=Fri, 08-Dec-2034 19:08:38 GMT; Max-Age=315360000
    location: http://ww25.zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqpSr%2Fe%2BV5ZuRg%3D%3D&subid1=20241211-0608-383e-8f8f-ad4a773d96da
    content-length: 2
    content-type: text/html; charset=UTF-8
    connection: close
  • flag-us
    POST
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yjYvEaS%2FT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    103.224.212.214:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yjYvEaS%2FT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D HTTP/1.1
    Host: zonedg.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 302 Found
    date: Tue, 10 Dec 2024 19:08:38 GMT
    server: Apache
    set-cookie: __tad=1733857718.7219453; expires=Fri, 08-Dec-2034 19:08:38 GMT; Max-Age=315360000
    location: http://ww25.zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yjYvEaS%2FT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D&subid1=20241211-0608-38df-ad2c-998f590359a8
    content-length: 2
    content-type: text/html; charset=UTF-8
    connection: close
  • flag-us
    POST
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B82uYvEaS%2FT%2BsqNSr%2Fe%2BV5ZuRg%3D%3D
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    103.224.212.214:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B82uYvEaS%2FT%2BsqNSr%2Fe%2BV5ZuRg%3D%3D HTTP/1.1
    Host: zonedg.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 302 Found
    date: Tue, 10 Dec 2024 19:08:38 GMT
    server: Apache
    set-cookie: __tad=1733857718.5996960; expires=Fri, 08-Dec-2034 19:08:38 GMT; Max-Age=315360000
    location: http://ww25.zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B82uYvEaS%2FT%2BsqNSr%2Fe%2BV5ZuRg%3D%3D&subid1=20241211-0608-388a-936e-28e60429d1c9
    content-length: 2
    content-type: text/html; charset=UTF-8
    connection: close
  • flag-us
    POST
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    103.224.212.214:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D HTTP/1.1
    Host: zonedg.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 302 Found
    date: Tue, 10 Dec 2024 19:08:38 GMT
    server: Apache
    set-cookie: __tad=1733857718.1043972; expires=Fri, 08-Dec-2034 19:08:38 GMT; Max-Age=315360000
    location: http://ww25.zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D&subid1=20241211-0608-3808-8eeb-25c7efd43995
    content-length: 2
    content-type: text/html; charset=UTF-8
    connection: close
  • flag-us
    DNS
    highspeeddbsearch.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    highspeeddbsearch.com
    IN A
    Response
  • flag-us
    DNS
    www.google.com
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    www.google.com
    IN A
    Response
    www.google.com
    IN A
    142.250.187.196
  • flag-gb
    GET
    http://www.google.com/
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    142.250.187.196:80
    Request
    GET / HTTP/1.0
    Connection: close
    Host: www.google.com
    Accept: */*
    Response
    HTTP/1.0 302 Found
    Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGOej4roGIjB5dYWvXJOy46raxySzaQGfA56V-qyXxjqjjl75I4hc5QCIxMQRLMlW72hHTQPjN9QyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    x-hallmonitor-challenge: CgsI6KPiugYQ-7H8RhIEtdewUw
    Content-Type: text/html; charset=UTF-8
    Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-5r0TCpxdJpIEcyO3XJ3qrg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
    Date: Tue, 10 Dec 2024 19:09:28 GMT
    Server: gws
    Content-Length: 396
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Set-Cookie: AEC=AZ6Zc-W5yPKW2Vn8vE0grBhQAOIG-Oz-N3mgRHRRp_3pzvwtUY-sqK6vEmA; expires=Sun, 08-Jun-2025 19:09:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
  • flag-gb
    GET
    http://www.google.com/
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    142.250.187.196:80
    Request
    GET / HTTP/1.1
    Connection: close
    Pragma: no-cache
    Host: www.google.com
    Response
    HTTP/1.1 302 Found
    Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGOij4roGIjBj9hRR8ku4f952sNUe0EOIFI60ltWnTXmwQbmE5nzF8qwWMVVMmHuYdLMZVkoqkLQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    x-hallmonitor-challenge: CgsI6aPiugYQjemqKhIEtdewUw
    Content-Type: text/html; charset=UTF-8
    Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-eItCgGaZxaMhpgXczOhJcA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
    Date: Tue, 10 Dec 2024 19:09:29 GMT
    Server: gws
    Content-Length: 396
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Set-Cookie: AEC=AZ6Zc-VQI1C3ul4l5VABuKwwkNwMwJfdNpCWqybjuxCjnMdMxyAm1dIbYQ; expires=Sun, 08-Jun-2025 19:09:29 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
    Connection: close
  • flag-gb
    GET
    http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGOij4roGIjBj9hRR8ku4f952sNUe0EOIFI60ltWnTXmwQbmE5nzF8qwWMVVMmHuYdLMZVkoqkLQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    Remote address:
    142.250.187.196:80
    Request
    GET /sorry/index?continue=http://www.google.com/&q=EgS117BTGOij4roGIjBj9hRR8ku4f952sNUe0EOIFI60ltWnTXmwQbmE5nzF8qwWMVVMmHuYdLMZVkoqkLQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1
    Connection: close
    Pragma: no-cache
    Host: www.google.com
    Response
    HTTP/1.1 429 Too Many Requests
    Date: Tue, 10 Dec 2024 19:09:29 GMT
    Pragma: no-cache
    Expires: Fri, 01 Jan 1990 00:00:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Content-Type: text/html
    Server: HTTP server (unknown)
    Content-Length: 3075
    X-XSS-Protection: 0
    Connection: close
  • 184.28.198.179:80
    http://hollandandbarrett.com/images/footer/account.jpg?v88=24&tq=gJ4WK%2FSUh7TFl0R8oY%2BQtMWTUj26kJH7yZtTK%2B%2FbxWq1SfkIYUBM
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    482 B
     584 B
     6
    5

    HTTP Request

    GET http://hollandandbarrett.com/images/footer/account.jpg?v88=24&tq=gJ4WK%2FSUh7TFl0R8oY%2BQtMWTUj26kJH7yZtTK%2B%2FbxWq1SfkIYUBM

    HTTP Response

    301
  • 103.224.212.214:80
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqpSr%2Fe%2BV5ZuRg%3D%3D
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    583 B
     716 B
     5
    4

    HTTP Request

    POST http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqpSr%2Fe%2BV5ZuRg%3D%3D

    HTTP Response

    302
  • 103.224.212.214:80
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yjYvEaS%2FT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    585 B
     718 B
     5
    4

    HTTP Request

    POST http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yjYvEaS%2FT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D

    HTTP Response

    302
  • 103.224.212.214:80
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B82uYvEaS%2FT%2BsqNSr%2Fe%2BV5ZuRg%3D%3D
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    585 B
     718 B
     5
    4

    HTTP Request

    POST http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B82uYvEaS%2FT%2BsqNSr%2Fe%2BV5ZuRg%3D%3D

    HTTP Response

    302
  • 103.224.212.214:80
    http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    565 B
     698 B
     5
    4

    HTTP Request

    POST http://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfxtX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB9I4%2Fyx3QXzGT7iirKpf%2FdsOJWI0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D

    HTTP Response

    302
  • 142.250.187.196:80
    http://www.google.com/
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    302 B
     1.5kB
     5
    5

    HTTP Request

    GET http://www.google.com/

    HTTP Response

    302
  • 127.0.0.1:57838
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
  • 142.250.187.196:80
    http://www.google.com/
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    307 B
     1.5kB
     5
    5

    HTTP Request

    GET http://www.google.com/

    HTTP Response

    302
  • 142.250.187.196:80
    http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGOij4roGIjBj9hRR8ku4f952sNUe0EOIFI60ltWnTXmwQbmE5nzF8qwWMVVMmHuYdLMZVkoqkLQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    http
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    526 B
     3.7kB
     6
    7

    HTTP Request

    GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGOij4roGIjBj9hRR8ku4f952sNUe0EOIFI60ltWnTXmwQbmE5nzF8qwWMVVMmHuYdLMZVkoqkLQyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

    HTTP Response

    429
  • 127.0.0.1:57838
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
  • 8.8.8.8:53
    hollandandbarrett.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    67 B
     99 B
     1
    1

    DNS Request

    hollandandbarrett.com

    DNS Response

    184.28.198.179
    184.28.198.210

  • 8.8.8.8:53
    zonedg.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    56 B
     72 B
     1
    1

    DNS Request

    zonedg.com

    DNS Response

    103.224.212.214

  • 8.8.8.8:53
    zonedg.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    56 B
     72 B
     1
    1

    DNS Request

    zonedg.com

    DNS Response

    103.224.212.214

  • 8.8.8.8:53
    separatemilkandtee.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    68 B
     141 B
     1
    1

    DNS Request

    separatemilkandtee.com

  • 8.8.8.8:53
    zonedg.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    56 B
     72 B
     1
    1

    DNS Request

    zonedg.com

    DNS Response

    103.224.212.214

  • 8.8.8.8:53
    zonedg.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    56 B
     72 B
     1
    1

    DNS Request

    zonedg.com

    DNS Response

    103.224.212.214

  • 8.8.8.8:53
    highspeeddbsearch.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    67 B
     140 B
     1
    1

    DNS Request

    highspeeddbsearch.com

  • 8.8.8.8:53
    www.google.com
    dns
    de3d2e05f336d3def9627acf6207e491_JaffaCakes118.exe
    60 B
     76 B
     1
    1

    DNS Request

    www.google.com

    DNS Response

    142.250.187.196

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\0BDC.283
    Filesize

    1KB

    MD5

    98c16c66ae75c051ba9364085046a588

    SHA1

    3d65733bbd4838a904930ac37b7273e25812ef0f

    SHA256

    2885496d218f31a2188a16d55e809296bcd1b5105c24e574c02d1f0c5e7c2e8d

    SHA512

    7d6f98bf404d2d69da955f42d9177d8618252dc4ac9f5cbe7e531ff620003e04e6ab7aefb4b8194c18c6e42cbd31752063725f535ec8a7a5f87800924a3da6d3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\0BDC.283
    Filesize

    600B

    MD5

    be68d1e3392a5b67808ad8aeaac4ba60

    SHA1

    b86a7ce97da8bbf074c65b2092d9868d6be2b248

    SHA256

    c281388f1db36ccd7cdff036a7991acf518b394b79579d06a74bb624e96df0cf

    SHA512

    db658c11863e70acfd06b1aecaa3aefa2cc1bc4b3309123cc506387c926fabe73eb40c5861df62562fb70c9db5a1f1bb831a1df3bcf2529113b80ae0a9668310

    Download Submit

  • memory/692-89-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/692-90-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2676-8-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2676-9-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2676-10-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2756-1-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2756-2-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2756-15-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2756-157-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

  • memory/2756-195-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.