Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...8f.exe

windows7-x64

10

JaffaCakes...8f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2025, 22:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe

  • Size

    28KB

  • MD5

    78181c38bdd1daba2d3418965029748f

  • SHA1

    56e7c79f628cdedc6f0ae4c0a3ec4d6c373f9d3e

  • SHA256

    530730d7dec602c822fbb0db2e3c922c00657a925fc393945a13c455ebc58f32

  • SHA512

    0ac6bd5db6a56718e66b636844435f0e1c7cccc9a76fac78d9099ffbd4ca24e1f0d08d51342da6dadeee0fa286428f901306e53fa82885b330901c8d9ff51525

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNQKdE:Dv8IRRdsxq1DjJcqfNKe

Score
10/10
mydoomdiscoverypersistenceupxworm

Malware Config

Signatures

  • Detects MyDoom family 6 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom
  • Mydoom family
    mydoom
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2072

Network

  • flag-us
    DNS
    alumni.caltech.edu
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN MX
    Response
    alumni.caltech.edu
    IN MX
    alumni-caltech-edumail protectionoutlookcom
  • flag-us
    DNS
    alumni-caltech-edu.mail.protection.outlook.com
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    Response
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.10.2
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.41.6
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.41.183
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.11.9
  • flag-us
    DNS
    gzip.org
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN MX
    Response
    gzip.org
    IN MX
    �
  • flag-us
    DNS
    gzip.org
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN A
    Response
    gzip.org
    IN A
    85.187.148.2
  • flag-us
    DNS
    alumni.caltech.edu
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN A
    Response
    alumni.caltech.edu
    IN A
    204.13.239.180
  • flag-us
    DNS
    mx.gzip.org
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    mx.gzip.org
    IN A
    Response
  • flag-us
    DNS
    mx.alumni.caltech.edu
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    mx.alumni.caltech.edu
    IN A
    Response
  • flag-us
    DNS
    mail.alumni.caltech.edu
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.alumni.caltech.edu
    IN A
    Response
  • flag-us
    DNS
    smtp.alumni.caltech.edu
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp.alumni.caltech.edu
    IN A
    Response
  • flag-us
    DNS
    mail.gzip.org
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.gzip.org
    IN A
    Response
    mail.gzip.org
    IN CNAME
    gzip.org
    gzip.org
    IN A
    85.187.148.2
  • 159.134.164.126:1034
    services.exe
    152 B
     3
  • 208.189.196.18:1034
    services.exe
    152 B
     3
  • 4.240.75.254:1034
    services.exe
    152 B
     3
  • 24.131.210.134:1034
    services.exe
    152 B
     3
  • 4.240.78.178:1034
    services.exe
    152 B
     3
  • 52.101.10.2:25
    alumni-caltech-edu.mail.protection.outlook.com
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    152 B
     3
  • 85.187.148.2:25
    gzip.org
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    152 B
     3
  • 15.96.48.12:1034
    services.exe
    152 B
     3
  • 85.187.148.2:25
    gzip.org
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    152 B
     3
  • 204.13.239.180:25
    alumni.caltech.edu
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    152 B
     3
  • 4.240.78.237:1034
    services.exe
    152 B
     3
  • 85.187.148.2:25
    mail.gzip.org
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    104 B
     2
  • 16.179.5.169:1034
    services.exe
    52 B
     1
  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    64 B
     126 B
     1
    1

    DNS Request

    alumni.caltech.edu

  • 8.8.8.8:53
    alumni-caltech-edu.mail.protection.outlook.com
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    92 B
     156 B
     1
    1

    DNS Request

    alumni-caltech-edu.mail.protection.outlook.com

    DNS Response

    52.101.10.2
    52.101.41.6
    52.101.41.183
    52.101.11.9

  • 8.8.8.8:53
    gzip.org
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    54 B
     70 B
     1
    1

    DNS Request

    gzip.org

  • 8.8.8.8:53
    gzip.org
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    54 B
     70 B
     1
    1

    DNS Request

    gzip.org

    DNS Response

    85.187.148.2

  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    64 B
     80 B
     1
    1

    DNS Request

    alumni.caltech.edu

    DNS Response

    204.13.239.180

  • 8.8.8.8:53
    mx.gzip.org
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    57 B
     124 B
     1
    1

    DNS Request

    mx.gzip.org

  • 8.8.8.8:53
    mx.alumni.caltech.edu
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    67 B
     145 B
     1
    1

    DNS Request

    mx.alumni.caltech.edu

  • 8.8.8.8:53
    mail.alumni.caltech.edu
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    69 B
     147 B
     1
    1

    DNS Request

    mail.alumni.caltech.edu

  • 8.8.8.8:53
    smtp.alumni.caltech.edu
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    69 B
     147 B
     1
    1

    DNS Request

    smtp.alumni.caltech.edu

  • 8.8.8.8:53
    mail.gzip.org
    dns
    JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
    59 B
     89 B
     1
    1

    DNS Request

    mail.gzip.org

    DNS Response

    85.187.148.2

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1EAA.tmp
    Filesize

    28KB

    MD5

    939ff3f3f419322bf7221e847028afd0

    SHA1

    18782e8be1605de5fa877cce9330b1fb6436b6f4

    SHA256

    dbdd2cf7eeb0e09f15ab715636a47e4a31f02b8208e094e44fbfff7ec0ee07e9

    SHA512

    2331a34b40402907e90d2b58df71a6ea772732317d7c9ace3b618f40ed2cf11434214f53b9beda981995f7adfa039c223587f64879def74c7c61473e2d1cd4c7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    1KB

    MD5

    6fa7afa855dee841d0905b6342fa9dd1

    SHA1

    b65231ba7bff596f63ea50a0361998b74377f6d0

    SHA256

    ef719961dc75d9d934a2bb18a77a41894012dbcbce9c94fb7eb2700335a0054d

    SHA512

    c51db7a896feaa82f8d9ea550a6d464241a272eb56051af78bbaffdae455f55d6994ea947ba8578876b366edbcb4f1aab7a448f36b024bd769b4cdc60eb8eb88

    Download Submit

  • C:\Windows\services.exe
    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

    Download Submit

  • memory/1712-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1712-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1712-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1712-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1712-90-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1712-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1712-83-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1712-78-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1712-74-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1712-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1712-55-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2072-51-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-44-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-39-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-56-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-34-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-46-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-75-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-79-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-84-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-22-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-86-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-91-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2072-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.