Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e4078f0242...18.exe

windows7-x64

10

e4078f0242...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/12/2024, 01:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe

  • Size

    202KB

  • MD5

    e4078f024216d42ffb2cf93253d1e269

  • SHA1

    388d33df212372db1baefe5dcd8a2952fbe2bfd5

  • SHA256

    4011693ae2f420ea3775f4382304d5938a44cb3400bee4ee964decf2177d9755

  • SHA512

    5e0b5ac29d8d6535cc355d24ca9ff30779e5d59321a02f180b62770e15429333e9296e90fd1184bede465b39b044c3d180dc34bbd899407d6557a5a828ab9a42

  • SSDEEP

    3072:VbOCtDy04LH1tMYBhsYWc/iCah6R29Tjo4vEywZSQr6hlR9Zl2VMjdMYt8ssD3:pOUT4JngYWbCap9TjoohS3ejdPt8ss

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Users\Admin\AppData\Local\Temp\e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1736
    • C:\Users\Admin\AppData\Local\Temp\e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3012

Network

  • flag-us
    DNS
    psfk.com
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    psfk.com
    IN A
    Response
    psfk.com
    IN A
    35.158.87.123
  • flag-de
    GET
    http://psfk.com/img/icons/twitter.png?v52=74&tq=gHZutDyMv5rJfyG1J8K%2B1MWCJbP4lltXIA%3D%3D
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    35.158.87.123:80
    Request
    GET /img/icons/twitter.png?v52=74&tq=gHZutDyMv5rJfyG1J8K%2B1MWCJbP4lltXIA%3D%3D HTTP/1.0
    Connection: close
    Host: psfk.com
    Accept: */*
    User-Agent: mozilla/2.0
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Thu, 12 Dec 2024 13:17:23 GMT
    Content-Type: text/html
    Content-Length: 175
    Connection: close
    Location: https://psfk.com/img/icons/twitter.png?v52=74&tq=gHZutDyMv5rJfyG1J8K%2B1MWCJbP4lltXIA%3D%3D
    Server: my-server
  • flag-us
    DNS
    cofeeandteeshop.com
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    cofeeandteeshop.com
    IN A
    Response
  • flag-us
    DNS
    zonetf.com
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    zonetf.com
    IN A
    Response
    zonetf.com
    IN A
    76.223.54.146
    zonetf.com
    IN A
    13.248.169.48
  • flag-us
    DNS
    zonetf.com
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    zonetf.com
    IN A
    Response
    zonetf.com
    IN A
    76.223.54.146
    zonetf.com
    IN A
    13.248.169.48
  • flag-us
    POST
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    76.223.54.146:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D HTTP/1.1
    Host: zonetf.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 405 Method Not Allowed
    content-length: 0
    connection: close
  • flag-us
    POST
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yjYvEaSvT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    76.223.54.146:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yjYvEaSvT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D HTTP/1.1
    Host: zonetf.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 405 Method Not Allowed
    content-length: 0
    connection: close
  • flag-us
    POST
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    76.223.54.146:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D HTTP/1.1
    Host: zonetf.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 405 Method Not Allowed
    content-length: 0
    connection: close
  • flag-us
    POST
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82uYvEaSvT%2BsqxSr%2Fe%2BV5ZuRg%3D%3D
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    76.223.54.146:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82uYvEaSvT%2BsqxSr%2Fe%2BV5ZuRg%3D%3D HTTP/1.1
    Host: zonetf.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 405 Method Not Allowed
    content-length: 0
    connection: close
  • flag-us
    DNS
    smallautosite.com
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    smallautosite.com
    IN A
    Response
  • flag-us
    DNS
    www.google.com
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    www.google.com
    IN A
    Response
    www.google.com
    IN A
    172.217.20.164
  • flag-fr
    GET
    http://www.google.com/
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    172.217.20.164:80
    Request
    GET / HTTP/1.0
    Connection: close
    Host: www.google.com
    Accept: */*
    Response
    HTTP/1.0 302 Found
    Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGKDF67oGIjA3flTFFtvbC1Zu9hqLWqOazAKY2KVvPa54-zGmHXrvxjNFTRf0Bo7Dvy4mMNO9zOUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    x-hallmonitor-challenge: CgwIocXrugYQu625iQESBLXXsFM
    Content-Type: text/html; charset=UTF-8
    Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-8fR7w7_qeillGxDTKZiiEQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
    Date: Thu, 12 Dec 2024 13:18:25 GMT
    Server: gws
    Content-Length: 396
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Set-Cookie: AEC=AZ6Zc-WfnpaWMdUSFmBm8SsxjpKRycM4oQzLMfxRMsAe_Kw6iIPcRK_vc6o; expires=Tue, 10-Jun-2025 13:18:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
  • flag-us
    DNS
    smallapplecompany.com
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    smallapplecompany.com
    IN A
    Response
  • flag-us
    POST
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82oYvEaTuLuwd129WxK5VKv975Xlm5G
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    76.223.54.146:80
    Request
    POST /index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82oYvEaTuLuwd129WxK5VKv975Xlm5G HTTP/1.1
    Host: zonetf.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
    Content-Length: 0
    Connection: close
    Response
    HTTP/1.1 405 Method Not Allowed
    content-length: 0
    connection: close
  • flag-fr
    GET
    http://www.google.com/
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    172.217.20.164:80
    Request
    GET / HTTP/1.1
    Connection: close
    Pragma: no-cache
    Host: www.google.com
    Response
    HTTP/1.1 302 Found
    Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGKHF67oGIjA4l3oq_H0BJksXsmPifL4-UX_t_HpDZ4wUTP8m6GJ2HBXnZTrjfNUJuKnXLNs236EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    x-hallmonitor-challenge: CgwIocXrugYQw7K6_AISBLXXsFM
    Content-Type: text/html; charset=UTF-8
    Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-U3ZBwNB7H19_ObjbsS8jIA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
    Date: Thu, 12 Dec 2024 13:18:25 GMT
    Server: gws
    Content-Length: 396
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    Set-Cookie: AEC=AZ6Zc-Wbrv3_j8xTTn12wzfpCDRl_J3g827ZJ-DZktUK7WF_gvNUVsmJqQ; expires=Tue, 10-Jun-2025 13:18:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
    Connection: close
  • flag-fr
    GET
    http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGKHF67oGIjA4l3oq_H0BJksXsmPifL4-UX_t_HpDZ4wUTP8m6GJ2HBXnZTrjfNUJuKnXLNs236EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    Remote address:
    172.217.20.164:80
    Request
    GET /sorry/index?continue=http://www.google.com/&q=EgS117BTGKHF67oGIjA4l3oq_H0BJksXsmPifL4-UX_t_HpDZ4wUTP8m6GJ2HBXnZTrjfNUJuKnXLNs236EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1
    Connection: close
    Pragma: no-cache
    Host: www.google.com
    Response
    HTTP/1.1 429 Too Many Requests
    Date: Thu, 12 Dec 2024 13:18:26 GMT
    Pragma: no-cache
    Expires: Fri, 01 Jan 1990 00:00:00 GMT
    Cache-Control: no-store, no-cache, must-revalidate
    Content-Type: text/html
    Server: HTTP server (unknown)
    Content-Length: 3075
    X-XSS-Protection: 0
    Connection: close
  • 35.158.87.123:80
    http://psfk.com/img/icons/twitter.png?v52=74&tq=gHZutDyMv5rJfyG1J8K%2B1MWCJbP4lltXIA%3D%3D
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    579 B
     685 B
     9
    6

    HTTP Request

    GET http://psfk.com/img/icons/twitter.png?v52=74&tq=gHZutDyMv5rJfyG1J8K%2B1MWCJbP4lltXIA%3D%3D

    HTTP Response

    301
  • 76.223.54.146:80
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    579 B
     245 B
     5
    4

    HTTP Request

    POST http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D

    HTTP Response

    405
  • 76.223.54.146:80
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yjYvEaSvT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    579 B
     245 B
     5
    4

    HTTP Request

    POST http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yjYvEaSvT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D

    HTTP Response

    405
  • 76.223.54.146:80
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    561 B
     245 B
     5
    4

    HTTP Request

    POST http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D

    HTTP Response

    405
  • 76.223.54.146:80
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82uYvEaSvT%2BsqxSr%2Fe%2BV5ZuRg%3D%3D
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    631 B
     245 B
     6
    4

    HTTP Request

    POST http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82uYvEaSvT%2BsqxSr%2Fe%2BV5ZuRg%3D%3D

    HTTP Response

    405
  • 172.217.20.164:80
    http://www.google.com/
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    348 B
     1.5kB
     6
    5

    HTTP Request

    GET http://www.google.com/

    HTTP Response

    302
  • 76.223.54.146:80
    http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82oYvEaTuLuwd129WxK5VKv975Xlm5G
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    619 B
     245 B
     6
    4

    HTTP Request

    POST http://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNsX%2BP9h%2BI0sDkX9PiwomL2GUvg7sbefvJsSvT8t61i9hlL9PmxrHH0bV%2FmiMWrdPd5SOeikL50gB5ClI7NrAWBGT7iirLZAYYfSJD90alxtygbpb6HvnSAOQij%2B82oYvEaTuLuwd129WxK5VKv975Xlm5G

    HTTP Response

    405
  • 172.217.20.164:80
    http://www.google.com/
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    307 B
     1.5kB
     5
    5

    HTTP Request

    GET http://www.google.com/

    HTTP Response

    302
  • 172.217.20.164:80
    http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGKHF67oGIjA4l3oq_H0BJksXsmPifL4-UX_t_HpDZ4wUTP8m6GJ2HBXnZTrjfNUJuKnXLNs236EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
    http
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    572 B
     3.7kB
     7
    7

    HTTP Request

    GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGKHF67oGIjA4l3oq_H0BJksXsmPifL4-UX_t_HpDZ4wUTP8m6GJ2HBXnZTrjfNUJuKnXLNs236EyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

    HTTP Response

    429
  • 127.0.0.1:55939
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
  • 127.0.0.1:55939
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
  • 8.8.8.8:53
    psfk.com
    dns
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    54 B
     70 B
     1
    1

    DNS Request

    psfk.com

    DNS Response

    35.158.87.123

  • 8.8.8.8:53
    cofeeandteeshop.com
    dns
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    65 B
     138 B
     1
    1

    DNS Request

    cofeeandteeshop.com

  • 8.8.8.8:53
    zonetf.com
    dns
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    56 B
     88 B
     1
    1

    DNS Request

    zonetf.com

    DNS Response

    76.223.54.146
    13.248.169.48

  • 8.8.8.8:53
    zonetf.com
    dns
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    56 B
     88 B
     1
    1

    DNS Request

    zonetf.com

    DNS Response

    76.223.54.146
    13.248.169.48

  • 8.8.8.8:53
    smallautosite.com
    dns
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    63 B
     136 B
     1
    1

    DNS Request

    smallautosite.com

  • 8.8.8.8:53
    www.google.com
    dns
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    60 B
     76 B
     1
    1

    DNS Request

    www.google.com

    DNS Response

    172.217.20.164

  • 8.8.8.8:53
    smallapplecompany.com
    dns
    e4078f024216d42ffb2cf93253d1e269_JaffaCakes118.exe
    67 B
     140 B
     1
    1

    DNS Request

    smallapplecompany.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\C2A6.BFB
    Filesize

    1KB

    MD5

    ac8ae23485802296d6cc37dd3eb2b8ff

    SHA1

    509dbfb8af2760ee046d384bcf416c671b2aa696

    SHA256

    8c1a365a2c1e8fcf7f60a35ae81aa78e6609f10295304fd97042567999137ffb

    SHA512

    df4e02af8ec3eb2f8bf9f15304b7ee3468253518c45f6a5fe4bb865bbc6e5212c2a37bad7231e4ea2e7522f282f34b5d639be576c4cbbb43da26aa504c3d5b5e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\C2A6.BFB
    Filesize

    600B

    MD5

    ecf6e556e5c85f895bcc3917e7315849

    SHA1

    4e143d5cd24d96f22c5a950bdadfa72d6a9baca1

    SHA256

    0d0d721d67868d79c1a70c28ccc1f75a880278ee4eecc910a4fa72935b6277a9

    SHA512

    d9443982a2f8b5724dc440c0699a5b36a24b941f7c71ceb831c81fd08440c760f05f3eda04dffc61a8691efe32238e1f45107b6c21a1bc3cf9aa7003dce341eb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\C2A6.BFB
    Filesize

    996B

    MD5

    69adc9694111500f939b69d094f5334f

    SHA1

    12d2ec5b6a0b9452489313880b1f928ca26f167b

    SHA256

    6878b96a2503eb4bb408b57d2d7911bc0de2a206365dde47257dc613d75779b3

    SHA512

    7d309504cb8fa48203afbcc6e3548bdb1e7ba81c03759b72d1c7d9d98fff2457f4dae5fbf4bdc9923191b34ed6d3982bca062da686fea7a5a82b26cef81579dc

    Download Submit

  • memory/1736-8-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/1736-5-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/1736-6-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/2308-16-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/2308-2-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/2308-79-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/2308-1-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/2308-183-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/3012-78-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/3012-77-0x0000000000400000-0x000000000048C000-memory.dmp

    Filesize

    560KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.