Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe
-
Size
668KB
-
MD5
0c02fb61032cec8238998cb38324d3c7
-
SHA1
66a843db2c08dcc98f04144aefcd789074c13221
-
SHA256
104c09b63d5e1a880b0186c79fab4599836620a73d21f8f55f07505c87b24e68
-
SHA512
31fb3ff73f20ac1866e991896112b7e7f5640bc22c076b94912cfbf0ca163daf197fdacc4c0c599cf1ebf18cf62471cb5106830af94a86ae59511ffe40a1771d
-
SSDEEP
6144:gdiE4zqXVY7PfBHnzA0F3JhJx4eS5mNMTy5fkLaMiLgLWL7SqaaYo5wzPLNQOIeG:gdw7hHnzAe3oe6mZ6zEPaexL62
Malware Config
Extracted
emotet
Epoch1
202.22.141.45:80
37.187.161.206:8080
202.29.239.162:443
80.87.201.221:7080
82.76.111.249:443
216.47.196.104:80
192.241.143.52:8080
192.81.38.31:80
87.106.253.248:8080
64.201.88.132:80
192.241.146.84:8080
12.162.84.2:8080
1.226.84.243:8080
177.129.17.170:443
202.134.4.210:7080
70.169.17.134:80
152.169.22.67:80
5.196.35.138:7080
138.97.60.141:7080
203.205.28.68:80
83.169.21.32:7080
191.182.6.118:80
190.188.245.242:80
62.84.75.50:80
181.74.0.251:80
189.2.177.210:443
111.67.12.221:8080
188.135.15.49:80
217.13.106.14:8080
68.183.190.199:8080
178.250.54.208:8080
189.35.44.221:80
201.213.177.139:80
137.74.106.111:7080
177.73.0.98:443
70.32.84.74:8080
51.15.7.145:80
177.74.228.34:80
185.94.252.27:443
50.121.220.50:80
186.70.127.199:8090
85.214.26.7:8080
181.129.96.162:8080
70.32.115.157:8080
82.230.1.24:80
60.93.23.51:80
213.197.182.158:8080
149.202.72.142:7080
190.115.18.139:8080
72.167.223.217:8080
190.24.243.186:80
109.169.12.78:80
94.176.234.118:443
185.232.182.218:80
219.92.13.25:80
209.236.123.42:8080
119.106.216.84:80
51.255.165.160:8080
51.75.33.127:80
51.15.7.189:80
61.197.92.216:80
5.189.178.202:8080
172.104.169.32:8080
45.33.77.42:8080
98.13.75.196:80
74.58.215.226:80
68.183.170.114:8080
155.186.0.121:80
190.117.79.209:80
128.92.203.42:80
202.4.58.197:80
70.116.143.84:80
77.238.212.227:80
67.247.242.247:80
12.163.208.58:80
212.71.237.140:8080
46.43.2.95:8080
96.227.52.8:443
186.103.141.250:443
185.94.252.12:80
104.131.41.185:8080
45.46.37.97:80
95.9.180.128:80
87.106.46.107:8080
50.28.51.143:8080
65.36.62.20:80
35.143.99.174:80
51.38.124.206:80
185.183.16.47:80
181.30.61.163:443
170.81.48.2:80
74.136.144.133:80
Signatures
-
resource yara_rule behavioral2/memory/1284-4-0x0000000000860000-0x0000000000870000-memory.dmp emotet behavioral2/memory/1284-7-0x0000000000830000-0x000000000083F000-memory.dmp emotet behavioral2/memory/1284-0-0x0000000000840000-0x0000000000852000-memory.dmp emotet behavioral2/memory/3684-14-0x0000000002210000-0x0000000002220000-memory.dmp emotet behavioral2/memory/3684-10-0x00000000021A0000-0x00000000021B2000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
pid Process 3684 werui.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\raschap\werui.exe 0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe 3684 werui.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1284 0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1284 0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe 3684 werui.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1284 wrote to memory of 3684 1284 0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe 85 PID 1284 wrote to memory of 3684 1284 0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe 85 PID 1284 wrote to memory of 3684 1284 0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c02fb61032cec8238998cb38324d3c7_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\raschap\werui.exe"C:\Windows\SysWOW64\raschap\werui.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668KB
MD50c02fb61032cec8238998cb38324d3c7
SHA166a843db2c08dcc98f04144aefcd789074c13221
SHA256104c09b63d5e1a880b0186c79fab4599836620a73d21f8f55f07505c87b24e68
SHA51231fb3ff73f20ac1866e991896112b7e7f5640bc22c076b94912cfbf0ca163daf197fdacc4c0c599cf1ebf18cf62471cb5106830af94a86ae59511ffe40a1771d