Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...f5.exe

windows7-x64

10

JaffaCakes...f5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2025, 01:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe

  • Size

    533KB

  • MD5

    44a5c905d738a570bf4bc0fdc7fcb2f5

  • SHA1

    e8c719c5db68ac5f4a54d15a08b630eabc80b160

  • SHA256

    4f075208c4a73e0233240f7ed3bb26f4bb750167d5b419d4ed619eeb449254ec

  • SHA512

    1dcd4ccab7ecd31d109f195d1e902d9457ffdccc476d7156f817446eab33368b5e294d10e33b7028eee0d53bcdb8e47f7e4f2bf7cf9ab2d57e56c3a2038795af

  • SSDEEP

    12288:E93uV1kGdQ97QDQh0KnRmAdGi00OFDXBSEOHnMLB2fdY0:GC15wkkhvYAdH0brMplfd

Score
10/10
44caliberspywarestealer

Malware Config

Signatures

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber
  • 44Caliber family
    44caliber
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2304

Network

  • flag-us
    DNS
    freegeoip.app
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    Remote address:
    8.8.8.8:53
    Request
    freegeoip.app
    IN A
    Response
    freegeoip.app
    IN A
    172.67.160.84
    freegeoip.app
    IN A
    104.21.73.97
  • flag-us
    GET
    https://freegeoip.app/xml/
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    Remote address:
    172.67.160.84:443
    Request
    GET /xml/ HTTP/1.1
    Host: freegeoip.app
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Tue, 07 Jan 2025 01:04:31 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Tue, 07 Jan 2025 02:04:31 GMT
    Location: https://ipbase.com/xml/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fvwnywg4aQQp%2FnzR52HeyrLo2XBRI1B8%2Fe48tlwAQY63zg9nCqWrnN17p1LL7bSje6x%2Fbu77w0NzKEjp2SrHMMqulE2DuPx2pqxIpTHuy8iU7QDqYNTrRLGhVR%2ByEbmg"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8fe008c6f83a9502-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=50279&min_rtt=47065&rtt_var=15664&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=352&delivery_rate=73705&cwnd=250&unsent_bytes=0&cid=e39652b38de6986b&ts=128&x=0"
  • flag-us
    DNS
    ipbase.com
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    Remote address:
    8.8.8.8:53
    Request
    ipbase.com
    IN A
    Response
    ipbase.com
    IN A
    104.21.85.189
    ipbase.com
    IN A
    172.67.209.71
  • flag-us
    GET
    https://ipbase.com/xml/
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    Remote address:
    104.21.85.189:443
    Request
    GET /xml/ HTTP/1.1
    Host: ipbase.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Date: Tue, 07 Jan 2025 01:04:32 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Age: 40698
    Cache-Control: public,max-age=0,must-revalidate
    Cache-Status: "Netlify Edge"; hit
    Vary: Accept-Encoding
    X-Nf-Request-Id: 01JGZ4NECC7MAYMFHABQ2796WV
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U3M7KNAJJndy2LB80gNWylA3%2Fgh6Frw7%2FuWF4hvIPxPFBMBQo7MYlCD5MjkVW7RTtUu1c4KkEBklQOnHRPnse%2BROg5Cc%2BxY%2BHBhrEnkYaY6RDEgoiNIfvXr8zOJo"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8fe008c8ac4a385a-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=48176&min_rtt=47270&rtt_var=11535&sent=6&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=349&delivery_rate=79463&cwnd=241&unsent_bytes=0&cid=4f4c1493116198b1&ts=154&x=0"
  • 172.67.160.84:443
    https://freegeoip.app/xml/
    tls, http
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    760 B
     5.3kB
     9
    8

    HTTP Request

    GET https://freegeoip.app/xml/

    HTTP Response

    301
  • 104.21.85.189:443
    https://ipbase.com/xml/
    tls, http
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    843 B
     8.0kB
     11
    14

    HTTP Request

    GET https://ipbase.com/xml/

    HTTP Response

    404
  • 8.8.8.8:53
    freegeoip.app
    dns
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    59 B
     91 B
     1
    1

    DNS Request

    freegeoip.app

    DNS Response

    172.67.160.84
    104.21.73.97

  • 8.8.8.8:53
    ipbase.com
    dns
    JaffaCakes118_44a5c905d738a570bf4bc0fdc7fcb2f5.exe
    56 B
     88 B
     1
    1

    DNS Request

    ipbase.com

    DNS Response

    104.21.85.189
    172.67.209.71

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44\Process.txt
    Filesize

    472B

    MD5

    4e83a5421da5461897cf1d2ce0df4963

    SHA1

    8d52a9fa003717d1f7498d2bb295b2610b073f99

    SHA256

    d2886abd936a3047b14e7ebf2c7137373bbc8e035493a4508b4c0f2693405cef

    SHA512

    92f544cadd8199be0f8727519a243f672fc4823072347566a336a6736a66f9772ecf6b59fbdce14553a26eba93a0b881808e3522d26ecf4b9aff9f8c4ba3e897

    Download Submit

  • memory/2304-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2304-1-0x00000000013D0000-0x000000000145C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/2304-2-0x000000001AD30000-0x000000001AE0A000-memory.dmp

    Filesize

    872KB

    Download

  • memory/2304-3-0x00000000003C0000-0x00000000003C6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2304-4-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2304-56-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

    Filesize

    9.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.