Overview

overview

10

Static

static

1

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 06:23 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe

  • Size

    4.4MB

  • MD5

    b57608ee4efaec6a5810a5c102457829

  • SHA1

    61569b436393347426585f2f5c68a46f9b90071e

  • SHA256

    1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f

  • SHA512

    3b83976cbcf2b23ae12ba827bf6d5b3a6981adb7b93ec30edb826f0b1c63d6aa8ebc23f203aadbc97c5b46123423a9a054cb6873295fb192f8b8c080521cacc7

  • SSDEEP

    98304:kku4hoeOgQ1039cOmEdcj4rdd1JH2UW0Sq9HwyIyYz/w:kx4hoeRQ10GOmEdI4rP1dDW0t9HiRI

Score
10/10
gluptebametasploitbackdoordiscoverydropperevasionloaderpersistenceprivilege_escalationrootkittrojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba family
    glupteba
  • Glupteba payload 20 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4004
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1180
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:536
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe /51-51
        3⤵
        • Executes dropped EXE
        • Manipulates WinMonFS driver.
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3268
        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
          C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 636
      2⤵
      • Program crash
      PID:5024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4004 -ip 4004
    1⤵
      PID:1800

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      83.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.210.23.2.in-addr.arpa
      IN PTR
      Response
      83.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-83deploystaticakamaitechnologiescom
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      humisnee.com
      JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      Remote address:
      8.8.8.8:53
      Request
      humisnee.com
      IN A
      Response
      humisnee.com
      IN A
      37.48.65.151
    • flag-us
      DNS
      survey-smiles.com
      JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      Remote address:
      8.8.8.8:53
      Request
      survey-smiles.com
      IN A
      Response
      survey-smiles.com
      IN A
      199.59.243.227
    • flag-us
      GET
      http://survey-smiles.com/
      JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      Remote address:
      199.59.243.227:80
      Request
      GET / HTTP/1.1
      Host: survey-smiles.com
      User-Agent: Go-http-client/1.1
      Content-Type: application/x-www-form-urlencoded
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      date: Sun, 22 Dec 2024 06:23:45 GMT
      content-type: text/html; charset=utf-8
      content-length: 1054
      x-request-id: 63c1fd45-c793-4698-80dc-f725678b05ad
      cache-control: no-store, max-age=0
      accept-ch: sec-ch-prefers-color-scheme
      critical-ch: sec-ch-prefers-color-scheme
      vary: sec-ch-prefers-color-scheme
      x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_GSbXHjSyM4GBXh+TDdQi5Ch6arC3xeKj8KkRwOq4qrqrlRcvBA0AmkBJ57Iam4tUGtRHYm5e3uPQsAB9Z6SRbg==
      set-cookie: parking_session=63c1fd45-c793-4698-80dc-f725678b05ad; expires=Sun, 22 Dec 2024 06:38:45 GMT; path=/
    • flag-us
      DNS
      151.65.48.37.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      151.65.48.37.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      227.243.59.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      227.243.59.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      ninhaine.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      ninhaine.com
      IN TXT
      Response
    • flag-us
      DNS
      2makestorage.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      2makestorage.com
      IN TXT
      Response
    • flag-us
      DNS
      nisdably.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      nisdably.com
      IN TXT
      Response
      nisdably.com
      IN TXT
      .v=spf1 include:_incspfcheck.mailspike.net ?all
    • flag-us
      DNS
      817a56e4-04cf-46d8-919a-a4a4c0bf13bf.ninhaine.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      817a56e4-04cf-46d8-919a-a4a4c0bf13bf.ninhaine.com
      IN TXT
      Response
    • flag-us
      DNS
      server4.ninhaine.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      server4.ninhaine.com
      IN A
      Response
      server4.ninhaine.com
      IN A
      46.8.8.145
    • flag-us
      DNS
      ww53.ninhaine.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      ww53.ninhaine.com
      IN A
      Response
      ww53.ninhaine.com
      IN CNAME
      g87442272.c.giantpanda.com
      g87442272.c.giantpanda.com
      IN A
      139.162.181.76
      g87442272.c.giantpanda.com
      IN A
      172.104.149.86
    • flag-de
      GET
      http://ww53.ninhaine.com/
      csrss.exe
      Remote address:
      139.162.181.76:80
      Request
      GET / HTTP/1.1
      Host: ww53.ninhaine.com
      User-Agent: Go-http-client/1.1
      Content-Type: application/json; charset=UTF-8
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: openresty/1.25.3.2
      Date: Sun, 22 Dec 2024 06:23:52 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      Set-Cookie: session_id=0545e9334a65392e3009ea06d82076c1; Path=/; HttpOnly; Max-Age=86400; Expires=Sunday, 22-Dec-2024 06:23:52 GMT
      Content-Encoding: gzip
    • flag-de
      GET
      http://ww53.ninhaine.com/
      csrss.exe
      Remote address:
      139.162.181.76:80
      Request
      GET / HTTP/1.1
      Host: ww53.ninhaine.com
      User-Agent: Go-http-client/1.1
      Content-Type: application/x-www-form-urlencoded
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: openresty/1.25.3.2
      Date: Sun, 22 Dec 2024 06:23:52 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      Set-Cookie: session_id=9995f5a98066f627504168b347d6a640; Path=/; HttpOnly; Max-Age=86400; Expires=Sunday, 22-Dec-2024 06:23:52 GMT
      Content-Encoding: gzip
    • flag-us
      DNS
      ww82.ninhaine.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      ww82.ninhaine.com
      IN A
      Response
      ww82.ninhaine.com
      IN CNAME
      63214.bodis.com
      63214.bodis.com
      IN A
      199.59.243.227
    • flag-us
      GET
      http://ww82.ninhaine.com/
      csrss.exe
      Remote address:
      199.59.243.227:80
      Request
      GET / HTTP/1.1
      Host: ww82.ninhaine.com
      User-Agent: Go-http-client/1.1
      Content-Type: application/x-www-form-urlencoded
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      date: Sun, 22 Dec 2024 06:23:52 GMT
      content-type: text/html; charset=utf-8
      content-length: 1054
      x-request-id: 9349c35b-e862-42f0-9828-ddec0fd4ede3
      cache-control: no-store, max-age=0
      accept-ch: sec-ch-prefers-color-scheme
      critical-ch: sec-ch-prefers-color-scheme
      vary: sec-ch-prefers-color-scheme
      x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Tt/J9oqHpuqXX6un3Cskdko3ntgD1EOja6YOeQ+8B1Hpbe2+JoOhWbyNcOz/GR92FxtaOj/IK4FrDZpNw9TExw==
      set-cookie: parking_session=9349c35b-e862-42f0-9828-ddec0fd4ede3; expires=Sun, 22 Dec 2024 06:38:52 GMT; path=/
    • flag-us
      GET
      http://ww82.ninhaine.com/
      csrss.exe
      Remote address:
      199.59.243.227:80
      Request
      GET / HTTP/1.1
      Host: ww82.ninhaine.com
      User-Agent: Go-http-client/1.1
      Content-Type: application/x-www-form-urlencoded
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      date: Sun, 22 Dec 2024 06:23:57 GMT
      content-type: text/html; charset=utf-8
      content-length: 1054
      x-request-id: 304d39aa-9b96-4166-9f85-5ef4b43541fb
      cache-control: no-store, max-age=0
      accept-ch: sec-ch-prefers-color-scheme
      critical-ch: sec-ch-prefers-color-scheme
      vary: sec-ch-prefers-color-scheme
      x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Tt/J9oqHpuqXX6un3Cskdko3ntgD1EOja6YOeQ+8B1Hpbe2+JoOhWbyNcOz/GR92FxtaOj/IK4FrDZpNw9TExw==
      set-cookie: parking_session=304d39aa-9b96-4166-9f85-5ef4b43541fb; expires=Sun, 22 Dec 2024 06:38:57 GMT; path=/
    • flag-us
      GET
      http://ww82.ninhaine.com/
      csrss.exe
      Remote address:
      199.59.243.227:80
      Request
      GET / HTTP/1.1
      Host: ww82.ninhaine.com
      User-Agent: Go-http-client/1.1
      Content-Type: application/x-www-form-urlencoded
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      date: Sun, 22 Dec 2024 06:24:01 GMT
      content-type: text/html; charset=utf-8
      content-length: 1054
      x-request-id: e8787927-7a30-4b65-a386-92649eb31bf4
      cache-control: no-store, max-age=0
      accept-ch: sec-ch-prefers-color-scheme
      critical-ch: sec-ch-prefers-color-scheme
      vary: sec-ch-prefers-color-scheme
      x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Tt/J9oqHpuqXX6un3Cskdko3ntgD1EOja6YOeQ+8B1Hpbe2+JoOhWbyNcOz/GR92FxtaOj/IK4FrDZpNw9TExw==
      set-cookie: parking_session=e8787927-7a30-4b65-a386-92649eb31bf4; expires=Sun, 22 Dec 2024 06:39:02 GMT; path=/
    • flag-us
      DNS
      145.8.8.46.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      145.8.8.46.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      76.181.162.139.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.181.162.139.in-addr.arpa
      IN PTR
      Response
      76.181.162.139.in-addr.arpa
      IN PTR
      139-162-181-76iplinodeusercontentcom
    • flag-de
      GET
      http://ww53.ninhaine.com/
      csrss.exe
      Remote address:
      139.162.181.76:80
      Request
      GET / HTTP/1.1
      Host: ww53.ninhaine.com
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36 Edg/80.0.361.62
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: openresty/1.25.3.2
      Date: Sun, 22 Dec 2024 06:23:57 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      Set-Cookie: session_id=113b9a1203c4a31e5ff9a3b2884b1c24; Path=/; HttpOnly; Max-Age=86400; Expires=Sunday, 22-Dec-2024 06:23:57 GMT
      Content-Encoding: gzip
    • flag-de
      GET
      http://ww53.ninhaine.com/
      csrss.exe
      Remote address:
      139.162.181.76:80
      Request
      GET / HTTP/1.1
      Host: ww53.ninhaine.com
      User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: openresty/1.25.3.2
      Date: Sun, 22 Dec 2024 06:23:58 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      Set-Cookie: session_id=eef23f0e4b82aa6f78fff2a35819a6a1; Path=/; HttpOnly; Max-Age=86400; Expires=Sunday, 22-Dec-2024 06:23:58 GMT
      Content-Encoding: gzip
    • flag-de
      GET
      http://ww53.ninhaine.com/
      csrss.exe
      Remote address:
      139.162.181.76:80
      Request
      GET / HTTP/1.1
      Host: ww53.ninhaine.com
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: openresty/1.25.3.2
      Date: Sun, 22 Dec 2024 06:24:00 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      Set-Cookie: session_id=5f2f7834e7822ad78873b00719892e27; Path=/; HttpOnly; Max-Age=86400; Expires=Sunday, 22-Dec-2024 06:24:00 GMT
      Content-Encoding: gzip
    • flag-de
      GET
      http://ww53.ninhaine.com/
      csrss.exe
      Remote address:
      139.162.181.76:80
      Request
      GET / HTTP/1.1
      Host: ww53.ninhaine.com
      User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/80.0.3987.87 Chrome/80.0.3987.87 Safari/537.36
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: openresty/1.25.3.2
      Date: Sun, 22 Dec 2024 06:24:02 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      Set-Cookie: session_id=f1ce5b4a929737f6b6e6b0b1bd4c48aa; Path=/; HttpOnly; Max-Age=86400; Expires=Sunday, 22-Dec-2024 06:24:02 GMT
      Content-Encoding: gzip
    • flag-us
      DNS
      spolaect.info
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      spolaect.info
      IN A
      Response
    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      65.139.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      65.139.73.23.in-addr.arpa
      IN PTR
      Response
      65.139.73.23.in-addr.arpa
      IN PTR
      a23-73-139-65deploystaticakamaitechnologiescom
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-de
      GET
      http://ww53.ninhaine.com/
      csrss.exe
      Remote address:
      139.162.181.76:80
      Request
      GET / HTTP/1.1
      Host: ww53.ninhaine.com
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
      Accept-Encoding: gzip
      Response
      HTTP/1.1 200 OK
      Server: openresty/1.25.3.2
      Date: Sun, 22 Dec 2024 06:24:44 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      Set-Cookie: session_id=1b2a454b9700f68f9680fdcb181be53f; Path=/; HttpOnly; Max-Age=86400; Expires=Sunday, 22-Dec-2024 06:24:44 GMT
      Content-Encoding: gzip
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      server4.2makestorage.com
      csrss.exe
      Remote address:
      8.8.8.8:53
      Request
      server4.2makestorage.com
      IN A
      Response
    • 37.48.65.151:443
      humisnee.com
      tls
      JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      1.4kB
       3.9kB
       12
      11
    • 199.59.243.227:80
      http://survey-smiles.com/
      http
      JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      429 B
       2.3kB
       6
      5

      HTTP Request

      GET http://survey-smiles.com/

      HTTP Response

      200
    • 46.8.8.145:443
      server4.ninhaine.com
      tls
      csrss.exe
      784 B
       3.5kB
       9
      9
    • 46.8.8.145:443
      server4.ninhaine.com
      tls
      csrss.exe
      784 B
       3.5kB
       9
      9
    • 46.8.8.145:443
      server4.ninhaine.com
      tls
      csrss.exe
      16.5kB
       5.7kB
       53
      45
    • 139.162.181.76:80
      http://ww53.ninhaine.com/
      http
      csrss.exe
      608 B
       2.8kB
       7
      6

      HTTP Request

      GET http://ww53.ninhaine.com/

      HTTP Response

      200

      HTTP Request

      GET http://ww53.ninhaine.com/

      HTTP Response

      200
    • 139.162.181.76:80
      ww53.ninhaine.com
      csrss.exe
      190 B
       132 B
       4
      3
    • 199.59.243.227:80
      http://ww82.ninhaine.com/
      http
      csrss.exe
      1.0kB
       6.8kB
       13
      13

      HTTP Request

      GET http://ww82.ninhaine.com/

      HTTP Response

      200

      HTTP Request

      GET http://ww82.ninhaine.com/

      HTTP Response

      200

      HTTP Request

      GET http://ww82.ninhaine.com/

      HTTP Response

      200
    • 139.162.181.76:80
      http://ww53.ninhaine.com/
      http
      csrss.exe
      1.3kB
       5.4kB
       12
      8

      HTTP Request

      GET http://ww53.ninhaine.com/

      HTTP Response

      200

      HTTP Request

      GET http://ww53.ninhaine.com/

      HTTP Response

      200

      HTTP Request

      GET http://ww53.ninhaine.com/

      HTTP Response

      200

      HTTP Request

      GET http://ww53.ninhaine.com/

      HTTP Response

      200
    • 46.8.8.145:443
      server4.ninhaine.com
      tls
      csrss.exe
      2.0kB
       4.1kB
       15
      18
    • 139.162.181.76:80
      http://ww53.ninhaine.com/
      http
      csrss.exe
      477 B
       1.5kB
       6
      5

      HTTP Request

      GET http://ww53.ninhaine.com/

      HTTP Response

      200
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      83.210.23.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      83.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      0.159.190.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      0.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      humisnee.com
      dns
      JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      58 B
       74 B
       1
      1

      DNS Request

      humisnee.com

      DNS Response

      37.48.65.151

    • 8.8.8.8:53
      survey-smiles.com
      dns
      JaffaCakes118_1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f.exe
      63 B
       79 B
       1
      1

      DNS Request

      survey-smiles.com

      DNS Response

      199.59.243.227

    • 8.8.8.8:53
      151.65.48.37.in-addr.arpa
      dns
      71 B
       134 B
       1
      1

      DNS Request

      151.65.48.37.in-addr.arpa

    • 8.8.8.8:53
      227.243.59.199.in-addr.arpa
      dns
      73 B
       131 B
       1
      1

      DNS Request

      227.243.59.199.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      ninhaine.com
      dns
      csrss.exe
      58 B
       58 B
       1
      1

      DNS Request

      ninhaine.com

    • 8.8.8.8:53
      2makestorage.com
      dns
      csrss.exe
      62 B
       135 B
       1
      1

      DNS Request

      2makestorage.com

    • 8.8.8.8:53
      nisdably.com
      dns
      csrss.exe
      58 B
       117 B
       1
      1

      DNS Request

      nisdably.com

    • 8.8.8.8:53
      817a56e4-04cf-46d8-919a-a4a4c0bf13bf.ninhaine.com
      dns
      csrss.exe
      95 B
       95 B
       1
      1

      DNS Request

      817a56e4-04cf-46d8-919a-a4a4c0bf13bf.ninhaine.com

    • 8.8.8.8:53
      server4.ninhaine.com
      dns
      csrss.exe
      66 B
       82 B
       1
      1

      DNS Request

      server4.ninhaine.com

      DNS Response

      46.8.8.145

    • 8.8.8.8:53
      ww53.ninhaine.com
      dns
      csrss.exe
      63 B
       132 B
       1
      1

      DNS Request

      ww53.ninhaine.com

      DNS Response

      139.162.181.76
      172.104.149.86

    • 8.8.8.8:53
      ww82.ninhaine.com
      dns
      csrss.exe
      63 B
       105 B
       1
      1

      DNS Request

      ww82.ninhaine.com

      DNS Response

      199.59.243.227

    • 8.8.8.8:53
      145.8.8.46.in-addr.arpa
      dns
      69 B
       129 B
       1
      1

      DNS Request

      145.8.8.46.in-addr.arpa

    • 8.8.8.8:53
      76.181.162.139.in-addr.arpa
      dns
      73 B
       126 B
       1
      1

      DNS Request

      76.181.162.139.in-addr.arpa

    • 8.8.8.8:53
      spolaect.info
      dns
      csrss.exe
      59 B
       138 B
       1
      1

      DNS Request

      spolaect.info

    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      65.139.73.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      65.139.73.23.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      server4.2makestorage.com
      dns
      csrss.exe
      70 B
       143 B
       1
      1

      DNS Request

      server4.2makestorage.com

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    1
    T1546

    Netsh Helper DLL

    1
    T1546.007

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    1
    T1546

    Netsh Helper DLL

    1
    T1546.007

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Impair Defenses

    1
    T1562

    Disable or Modify System Firewall

    1
    T1562.004

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    1
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

      Download Submit

    • C:\Windows\rss\csrss.exe
      Filesize

      4.4MB

      MD5

      b57608ee4efaec6a5810a5c102457829

      SHA1

      61569b436393347426585f2f5c68a46f9b90071e

      SHA256

      1b2a56096efd20d49d01d593b08246ce99b0194bb2fa9166a7289850189e3b1f

      SHA512

      3b83976cbcf2b23ae12ba827bf6d5b3a6981adb7b93ec30edb826f0b1c63d6aa8ebc23f203aadbc97c5b46123423a9a054cb6873295fb192f8b8c080521cacc7

      Download Submit

    • memory/3944-29-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-25-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-35-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-34-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-33-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-32-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-23-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-27-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-24-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-31-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-30-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-17-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-28-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/3944-26-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/4004-3-0x0000000000400000-0x0000000000D41000-memory.dmp

      Filesize

      9.3MB

      Download

    • memory/4004-1-0x0000000004680000-0x0000000004ABF000-memory.dmp

      Filesize

      4.2MB

      Download

    • memory/4004-6-0x0000000004AC0000-0x00000000053E6000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/4004-2-0x0000000004AC0000-0x00000000053E6000-memory.dmp

      Filesize

      9.1MB

      Download

    • memory/4004-7-0x0000000000400000-0x0000000000D41000-memory.dmp

      Filesize

      9.3MB

      Download

    • memory/4004-5-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/5012-16-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/5012-9-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    • memory/5012-8-0x0000000000400000-0x00000000027DB000-memory.dmp

      Filesize

      35.9MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.