Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

406980bf7f...18.exe

windows7-x64

10

406980bf7f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 16:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    406980bf7fbcaa9e553b861f088e49e5_JaffaCakes118.exe

  • Size

    344KB

  • MD5

    406980bf7fbcaa9e553b861f088e49e5

  • SHA1

    93283c27d27bb46d31c0d3d6cce0b57ecdea40e1

  • SHA256

    c6366935e713fa3af2fd659adb112f42924136e8feeb89dcc9291612f646a4b6

  • SHA512

    635c72fde2d327bf888eb962776296a729ea5df6ba81f5bd8eb49efc4964259bdcc1d7a20852804e0c2d46e518c65f0bcd6ac757f63f5397745ee26b1154c152

  • SSDEEP

    6144:rr/JAPRthhyJrZ/489mw42uDLnUuy88ij484V4JFN:ehorZQ88LLnUuy5L4LN

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

192.158.216.73:80

85.214.28.226:8080

142.44.137.67:443

162.241.242.173:8080

85.152.162.105:80

62.30.7.67:443

78.24.219.147:8080

74.120.55.163:80

169.239.182.217:8080

216.208.76.186:80

95.213.236.64:8080

200.114.213.233:8080

104.131.44.150:8080

70.121.172.89:80

75.139.38.211:80

185.94.252.104:443

97.82.79.83:80

103.86.49.11:8080

79.98.24.39:8080

83.169.36.251:8080
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\406980bf7fbcaa9e553b861f088e49e5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\406980bf7fbcaa9e553b861f088e49e5_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-7-0x0000000000300000-0x000000000030B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1044-0-0x0000000000310000-0x000000000031E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1044-4-0x00000000003A0000-0x00000000003AC000-memory.dmp

    Filesize

    48KB

    Download