Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...f1.exe

windows7-x64

10

JaffaCakes...f1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2025, 21:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe

  • Size

    52KB

  • MD5

    7c0481d9c602ae8ea05aacd668cc2df1

  • SHA1

    b6e8320d97172aa319b7cd6bd6744f53be4f23cb

  • SHA256

    b5c0d51df891b0fae6c8b3ec105648de2493b1a54eb992035e404b0a44f73169

  • SHA512

    9cf256190bd9aa01952da750cad298992c3a9191d568625cba6da908378f46ae3165739c112677c8fac704c75c67f0ec3615319a3a87e5344ee82cd752ba7a73

  • SSDEEP

    768:SCIqdH/k1ZVcT194jp4IvAidiAKtVDOngyZjyHyCgl2Yh7cjGTU4rKDj0:SNqaLV8a6IvABfy9vDh764e0

Score
10/10
mydoomdiscoverypersistenceupxworm

Malware Config

Signatures

  • Detects MyDoom family 10 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom
  • Mydoom family
    mydoom
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1756

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nocorp.me
    Remote address:
    8.8.8.8:53
    Request
    nocorp.me
    IN A
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.117.19.2.in-addr.arpa
    IN PTR
    Response
    75.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-75deploystaticakamaitechnologiescom
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    resources.jar
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    resources.jar
    IN MX
    Response
  • flag-us
    DNS
    resources.jar
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    resources.jar
    IN MX
    Response
  • flag-us
    DNS
    cs.stanford.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    cs.stanford.edu
    IN MX
    Response
    cs.stanford.edu
    IN MX
    �
    cs.stanford.edu
    IN MX
    smtp2�
    cs.stanford.edu
    IN MX
    smtp1�
  • flag-us
    DNS
    outlook.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    outlook.com
    IN MX
    Response
    outlook.com
    IN MX
     outlook-comolc protection�
  • flag-us
    DNS
    cs.stanford.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    cs.stanford.edu
    IN A
    Response
    cs.stanford.edu
    IN A
    171.64.64.64
  • flag-us
    DNS
    outlook-com.olc.protection.outlook.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    outlook-com.olc.protection.outlook.com
    IN A
    Response
    outlook-com.olc.protection.outlook.com
    IN A
    52.101.41.59
    outlook-com.olc.protection.outlook.com
    IN A
    52.101.11.6
    outlook-com.olc.protection.outlook.com
    IN A
    52.101.10.7
    outlook-com.olc.protection.outlook.com
    IN A
    52.101.42.5
  • flag-us
    DNS
    nocorp.me
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    nocorp.me
    IN MX
    Response
    nocorp.me
    IN MX
    in2-smtpmessagingenginecom
    nocorp.me
    IN MX
    in1-smtp�2
  • flag-us
    DNS
    in2-smtp.messagingengine.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    in2-smtp.messagingengine.com
    IN A
    Response
    in2-smtp.messagingengine.com
    IN A
    202.12.124.217
    in2-smtp.messagingengine.com
    IN A
    202.12.124.216
  • flag-us
    DNS
    alumni.caltech.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN MX
    Response
    alumni.caltech.edu
    IN MX
    alumni-caltech-edumail protectionoutlookcom
  • flag-us
    DNS
    gzip.org
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN MX
    Response
    gzip.org
    IN MX
    �
  • flag-us
    DNS
    alumni-caltech-edu.mail.protection.outlook.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    Response
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.10.18
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.42.6
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.9.21
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.10.12
  • flag-us
    DNS
    gzip.org
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN A
    Response
    gzip.org
    IN A
    85.187.148.2
  • flag-us
    DNS
    smtp2.cs.stanford.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp2.cs.stanford.edu
    IN A
    Response
    smtp2.cs.stanford.edu
    IN A
    171.64.64.26
  • flag-us
    DNS
    outlook.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    outlook.com
    IN A
    Response
    outlook.com
    IN A
    52.96.111.82
    outlook.com
    IN A
    52.96.222.194
    outlook.com
    IN A
    52.96.223.2
    outlook.com
    IN A
    52.96.91.34
    outlook.com
    IN A
    52.96.229.242
    outlook.com
    IN A
    52.96.228.130
    outlook.com
    IN A
    52.96.214.50
    outlook.com
    IN A
    52.96.222.226
    outlook.com
    IN A
    52.96.172.98
  • flag-us
    DNS
    in1-smtp.messagingengine.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    in1-smtp.messagingengine.com
    IN A
    Response
    in1-smtp.messagingengine.com
    IN A
    103.168.172.219
    in1-smtp.messagingengine.com
    IN A
    103.168.172.220
    in1-smtp.messagingengine.com
    IN A
    103.168.172.222
    in1-smtp.messagingengine.com
    IN A
    103.168.172.216
    in1-smtp.messagingengine.com
    IN A
    103.168.172.217
    in1-smtp.messagingengine.com
    IN A
    103.168.172.223
    in1-smtp.messagingengine.com
    IN A
    103.168.172.221
    in1-smtp.messagingengine.com
    IN A
    103.168.172.218
  • flag-us
    DNS
    mozilla.org.xpi
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    alumni.caltech.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN A
    Response
    alumni.caltech.edu
    IN A
    204.13.239.180
  • flag-us
    DNS
    smtp1.cs.stanford.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp1.cs.stanford.edu
    IN A
    Response
    smtp1.cs.stanford.edu
    IN A
    171.64.64.25
  • flag-us
    DNS
    mx.nocorp.me
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mx.nocorp.me
    IN A
    Response
  • flag-us
    DNS
    mail.nocorp.me
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.nocorp.me
    IN A
    Response
  • flag-us
    DNS
    smtp.nocorp.me
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp.nocorp.me
    IN A
    Response
  • flag-us
    DNS
    130.109.69.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    130.109.69.13.in-addr.arpa
    IN PTR
    Response
  • 16.115.195.149:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 24.8.82.143:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 69.151.200.247:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 16.69.10.167:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 206.186.59.62:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 171.64.64.64:25
    cs.stanford.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 52.101.41.59:25
    outlook-com.olc.protection.outlook.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 202.12.124.217:25
    in2-smtp.messagingengine.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 15.228.160.114:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 52.101.10.18:25
    alumni-caltech-edu.mail.protection.outlook.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 85.187.148.2:25
    gzip.org
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 171.64.64.26:25
    smtp2.cs.stanford.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 52.96.111.82:25
    outlook.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 103.168.172.219:25
    in1-smtp.messagingengine.com
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 66.125.96.110:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 204.13.239.180:25
    alumni.caltech.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 85.187.148.2:25
    gzip.org
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    260 B
     5
  • 171.64.64.25:25
    smtp1.cs.stanford.edu
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    156 B
     3
  • 129.218.47.69:1042
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    104 B
     2
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    69.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    69.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    128 B
     261 B
     2
    2

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    nocorp.me

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    75.117.19.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    75.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    resources.jar
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    59 B
     134 B
     1
    1

    DNS Request

    resources.jar

  • 8.8.8.8:53
    resources.jar
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    59 B
     134 B
     1
    1

    DNS Request

    resources.jar

  • 8.8.8.8:53
    cs.stanford.edu
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     121 B
     1
    1

    DNS Request

    cs.stanford.edu

  • 8.8.8.8:53
    outlook.com
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    57 B
     100 B
     1
    1

    DNS Request

    outlook.com

  • 8.8.8.8:53
    cs.stanford.edu
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     77 B
     1
    1

    DNS Request

    cs.stanford.edu

    DNS Response

    171.64.64.64

  • 8.8.8.8:53
    outlook-com.olc.protection.outlook.com
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    84 B
     148 B
     1
    1

    DNS Request

    outlook-com.olc.protection.outlook.com

    DNS Response

    52.101.41.59
    52.101.11.6
    52.101.10.7
    52.101.42.5

  • 8.8.8.8:53
    nocorp.me
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    55 B
     124 B
     1
    1

    DNS Request

    nocorp.me

  • 8.8.8.8:53
    in2-smtp.messagingengine.com
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    74 B
     106 B
     1
    1

    DNS Request

    in2-smtp.messagingengine.com

    DNS Response

    202.12.124.217
    202.12.124.216

  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    64 B
     126 B
     1
    1

    DNS Request

    alumni.caltech.edu

  • 8.8.8.8:53
    gzip.org
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    54 B
     70 B
     1
    1

    DNS Request

    gzip.org

  • 8.8.8.8:53
    alumni-caltech-edu.mail.protection.outlook.com
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    92 B
     156 B
     1
    1

    DNS Request

    alumni-caltech-edu.mail.protection.outlook.com

    DNS Response

    52.101.10.18
    52.101.42.6
    52.101.9.21
    52.101.10.12

  • 8.8.8.8:53
    gzip.org
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    54 B
     70 B
     1
    1

    DNS Request

    gzip.org

    DNS Response

    85.187.148.2

  • 8.8.8.8:53
    smtp2.cs.stanford.edu
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    67 B
     83 B
     1
    1

    DNS Request

    smtp2.cs.stanford.edu

    DNS Response

    171.64.64.26

  • 8.8.8.8:53
    outlook.com
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    57 B
     201 B
     1
    1

    DNS Request

    outlook.com

    DNS Response

    52.96.111.82
    52.96.222.194
    52.96.223.2
    52.96.91.34
    52.96.229.242
    52.96.228.130
    52.96.214.50
    52.96.222.226
    52.96.172.98

  • 8.8.8.8:53
    in1-smtp.messagingengine.com
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    74 B
     202 B
     1
    1

    DNS Request

    in1-smtp.messagingengine.com

    DNS Response

    103.168.172.219
    103.168.172.220
    103.168.172.222
    103.168.172.216
    103.168.172.217
    103.168.172.223
    103.168.172.221
    103.168.172.218

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     136 B
     1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     136 B
     1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     136 B
     1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     136 B
     1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     136 B
     1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    61 B
     136 B
     1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    64 B
     80 B
     1
    1

    DNS Request

    alumni.caltech.edu

    DNS Response

    204.13.239.180

  • 8.8.8.8:53
    smtp1.cs.stanford.edu
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    67 B
     83 B
     1
    1

    DNS Request

    smtp1.cs.stanford.edu

    DNS Response

    171.64.64.25

  • 8.8.8.8:53
    mx.nocorp.me
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    58 B
     120 B
     1
    1

    DNS Request

    mx.nocorp.me

  • 8.8.8.8:53
    mail.nocorp.me
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    60 B
     122 B
     1
    1

    DNS Request

    mail.nocorp.me

  • 8.8.8.8:53
    smtp.nocorp.me
    dns
    JaffaCakes118_7c0481d9c602ae8ea05aacd668cc2df1.exe
    60 B
     122 B
     1
    1

    DNS Request

    smtp.nocorp.me

  • 8.8.8.8:53
    130.109.69.13.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    130.109.69.13.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Kazaa Lite.ShareReactor.com
    Filesize

    52KB

    MD5

    7c0481d9c602ae8ea05aacd668cc2df1

    SHA1

    b6e8320d97172aa319b7cd6bd6744f53be4f23cb

    SHA256

    b5c0d51df891b0fae6c8b3ec105648de2493b1a54eb992035e404b0a44f73169

    SHA512

    9cf256190bd9aa01952da750cad298992c3a9191d568625cba6da908378f46ae3165739c112677c8fac704c75c67f0ec3615319a3a87e5344ee82cd752ba7a73

    Download Submit

  • memory/1756-0-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-3-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-5-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-7-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-9-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-30-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-120-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-136-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-171-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-271-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1756-284-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.