Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...d0.exe

windows7-x64

10

JaffaCakes...d0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2025, 14:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe

  • Size

    729KB

  • MD5

    cac1301b905d042d31eb516ba68194d0

  • SHA1

    f27b01eb5748018092bd2a445d58888c595b3ae2

  • SHA256

    23658c8c271c4ab7ac03deffe76b11a688eb0e5a82e603cf61ecfcb3ea1b619d

  • SHA512

    175150f88fb50366a7941fb2731f102fd598b09bfbb13aaa58a251c34ce634b6340ce4b16b7af5f916789f17d1d979661fd7a4f6e76516da9da7135aadab3cd0

  • SSDEEP

    12288:RMA4xsEtFL0TjAz5/6Aq1FJ/HrsR2GHpIalIC810o1jLise6eN2qqH:itFL0IN/bq1q2QIalIJpQybH

Score
10/10
vidar1008discoverystealer

Malware Config

Extracted

Family

vidar

Version

41.4

Botnet

1008

C2

https://mas.to/@sslam

Attributes
  • profile_id

    1008

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Vidar Stealer 5 IoCs
    stealer
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1040
      2⤵
      • Program crash
      PID:2992

Network

  • flag-us
    DNS
    mas.to
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    Remote address:
    8.8.8.8:53
    Request
    mas.to
    IN A
    Response
    mas.to
    IN A
    104.21.11.154
    mas.to
    IN A
    172.67.166.96
  • flag-us
    GET
    https://mas.to/@sslam
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    Remote address:
    104.21.11.154:443
    Request
    GET /@sslam HTTP/1.1
    Host: mas.to
    Response
    HTTP/1.1 410 Gone
    Date: Thu, 09 Jan 2025 14:39:58 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 0
    referrer-policy: same-origin
    Cache-Control: max-age=180, public
    content-security-policy: base-uri 'none'; default-src 'none'; frame-ancestors 'none'; font-src 'self' https://mas.to; img-src 'self' data: blob: https://mas.to https://media.mas.to; style-src 'self' https://mas.to 'nonce-iVZ1NIZu0yiJVJw4Gn7YhQ=='; media-src 'self' data: https://mas.to https://media.mas.to; manifest-src 'self' https://mas.to; form-action 'none'; child-src 'self' blob: https://mas.to; worker-src 'self' blob: https://mas.to; connect-src 'self' data: blob: https://mas.to https://media.mas.to wss://mas.to; script-src 'self' https://mas.to 'wasm-unsafe-eval'; frame-src 'self' https:
    x-request-id: e2e0da62-26bb-481a-865a-65d4318390a0
    x-runtime: 0.010183
    strict-transport-security: max-age=63072000; includeSubDomains
    vary: Accept, Accept-Language, Cookie, Origin
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lAQyrTeC%2BztOBYmbnc5m%2Be%2FwmGo9CcmUBbEs12qyFIpoAIhDdkOJW94CanzQgAy%2F4jHA9xuQu2UtGusIqZk4AKEfg1xy%2FJbLYyPleEpL%2BClwaVOuaazUDbg%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8ff52e03ad7871f8-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=48304&min_rtt=47250&rtt_var=15190&sent=7&recv=8&lost=0&retrans=1&sent_bytes=3166&recv_bytes=350&delivery_rate=74432&cwnd=253&unsent_bytes=0&cid=a6211e9df29a5056&ts=511&x=0"
  • flag-us
    DNS
    c.pki.goog
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.178.3
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    Remote address:
    142.250.178.3:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Thu, 09 Jan 2025 14:22:47 GMT
    Expires: Thu, 09 Jan 2025 15:12:47 GMT
    Cache-Control: public, max-age=3000
    Age: 1030
    Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    Remote address:
    142.250.178.3:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Thu, 09 Jan 2025 14:37:30 GMT
    Expires: Thu, 09 Jan 2025 15:27:30 GMT
    Cache-Control: public, max-age=3000
    Age: 147
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    www.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    95.100.245.144
  • flag-gb
    GET
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    Remote address:
    95.100.245.144:80
    Request
    GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Sun, 18 Aug 2024 00:23:49 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: www.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1078
    Content-Type: application/octet-stream
    Content-MD5: PjrtHAukbJio72s77Ag5mA==
    Last-Modified: Thu, 31 Oct 2024 23:26:09 GMT
    ETag: 0x8DCFA0366D6C4CA
    x-ms-request-id: 7ca9c103-d01e-0016-3fee-2ba13d000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Thu, 09 Jan 2025 14:40:28 GMT
    Connection: keep-alive
    TLS_version: UNKNOWN
    ms-cv: CASMicrosoftCV36b483b2.0
    ms-cv-esi: CASMicrosoftCV36b483b2.0
    X-RTag: RT
  • flag-us
    DNS
    crl.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    crl.microsoft.com
    IN A
    Response
    crl.microsoft.com
    IN CNAME
    crl.www.ms.akadns.net
    crl.www.ms.akadns.net
    IN CNAME
    a1363.dscg.akamai.net
    a1363.dscg.akamai.net
    IN A
    2.19.252.143
    a1363.dscg.akamai.net
    IN A
    2.19.252.157
  • flag-gb
    GET
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    Remote address:
    2.19.252.143:80
    Request
    GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 26 Sep 2024 02:21:11 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1036
    Content-Type: application/octet-stream
    Content-MD5: +oTkvMkqpdtzWrUHEQQM3g==
    Last-Modified: Thu, 12 Dec 2024 00:06:56 GMT
    ETag: 0x8DD1A40E476D877
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 346168ca-101e-0054-5d36-4c18bd000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Thu, 09 Jan 2025 14:40:28 GMT
    Connection: keep-alive
  • 104.21.11.154:443
    https://mas.to/@sslam
    tls, http
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    942 B
     7.2kB
     13
    15

    HTTP Request

    GET https://mas.to/@sslam

    HTTP Response

    410
  • 142.250.178.3:80
    http://c.pki.goog/r/r4.crl
    http
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    554 B
     3.8kB
     7
    5

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 95.100.245.144:80
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    http
    393 B
     1.7kB
     4
    4

    HTTP Request

    GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

    HTTP Response

    200
  • 2.19.252.143:80
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    http
    399 B
     1.7kB
     4
    4

    HTTP Request

    GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

    HTTP Response

    200
  • 8.8.8.8:53
    mas.to
    dns
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    52 B
     84 B
     1
    1

    DNS Request

    mas.to

    DNS Response

    104.21.11.154
    172.67.166.96

  • 8.8.8.8:53
    c.pki.goog
    dns
    JaffaCakes118_cac1301b905d042d31eb516ba68194d0.exe
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.178.3

  • 8.8.8.8:53
    www.microsoft.com
    dns
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    95.100.245.144

  • 8.8.8.8:53
    crl.microsoft.com
    dns
    63 B
     162 B
     1
    1

    DNS Request

    crl.microsoft.com

    DNS Response

    2.19.252.143
    2.19.252.157

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1196-1-0x00000000018D0000-0x00000000019D0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1196-2-0x0000000000220000-0x00000000002F6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/1196-3-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

    Download

  • memory/1196-18-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

    Download

  • memory/1196-20-0x0000000000220000-0x00000000002F6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/1196-19-0x00000000018D0000-0x00000000019D0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1196-17-0x0000000000400000-0x0000000001729000-memory.dmp

    Filesize

    19.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.