Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240729-en -
resource tags
arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system -
submitted
29/07/2024, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe
-
Size
938KB
-
MD5
63cce2ccac3f8b860cc43b456decd73b
-
SHA1
4f1a7cc61ed4b63b2bff5f7f439b0fec5eba1652
-
SHA256
7b6a8d980f45784bac433be27a8e98feb2a764dc824506fa8ecaaff15b798bcb
-
SHA512
0f68d688702163d36098e6308d1fb3b140860d08e6ad6204306639d6a032f295ca99e5d2a7976bf9b51b47252cdb5795af9436812d640bf23a6bd09ba8da2cf0
-
SSDEEP
12288:3wkneM5vh5urXxuYBPksipf0lF7+RW78yNQnvB8IBxYL:3VeBuY9kpf0lZzNyvB8IBS
Malware Config
Extracted
emotet
Epoch2
47.146.117.214:80
62.108.54.22:8080
212.51.142.238:8080
190.160.53.126:80
87.106.136.232:8080
74.208.45.104:8080
121.124.124.40:7080
124.45.106.173:443
76.27.179.47:80
210.165.156.91:80
61.19.246.238:443
81.2.235.111:8080
169.239.182.217:8080
181.230.116.163:80
139.130.242.43:80
46.105.131.87:80
139.59.60.244:8080
222.214.218.37:4143
41.60.200.34:80
200.55.243.138:8080
24.234.133.205:80
190.55.181.54:443
189.212.199.126:443
93.156.165.186:80
62.138.26.28:8080
62.75.141.82:80
176.111.60.55:8080
168.235.67.138:7080
109.117.53.230:443
5.196.74.210:8080
162.154.38.103:80
152.168.248.128:443
83.110.223.58:443
95.9.185.228:443
180.92.239.110:8080
209.141.54.221:8080
37.187.72.193:8080
113.160.130.116:8443
85.59.136.180:8080
79.98.24.39:8080
91.231.166.124:8080
185.94.252.104:443
108.48.41.69:80
95.179.229.244:8080
71.208.216.10:80
93.51.50.171:8080
78.24.219.147:8080
24.179.13.119:80
200.41.121.90:80
153.126.210.205:7080
104.236.246.93:8080
46.105.131.79:8080
201.173.217.124:443
50.116.86.205:8080
116.203.32.252:8080
157.245.99.39:8080
109.74.5.95:8080
203.153.216.189:7080
87.106.139.101:8080
137.59.187.107:8080
110.145.77.103:80
47.153.182.47:80
95.213.236.64:8080
24.43.99.75:80
209.182.216.177:443
173.91.22.41:80
5.39.91.110:7080
75.139.38.211:80
91.211.88.52:7080
37.139.21.175:8080
162.241.92.219:8080
104.131.11.150:443
70.167.215.250:8080
104.131.44.150:8080
103.86.49.11:8080
65.111.120.223:80
Signatures
-
resource yara_rule behavioral2/memory/1920-4-0x0000000000BD0000-0x0000000000BD9000-memory.dmp emotet behavioral2/memory/1920-0-0x0000000000BE0000-0x0000000000BEC000-memory.dmp emotet behavioral2/memory/2196-9-0x0000000002390000-0x000000000239C000-memory.dmp emotet behavioral2/memory/2196-13-0x0000000002390000-0x000000000239C000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
pid Process 2196 mmgaclient.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mfc110rus\mmgaclient.exe 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmgaclient.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe 2196 mmgaclient.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1920 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1920 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe 1920 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe 2196 mmgaclient.exe 2196 mmgaclient.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2196 1920 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe 84 PID 1920 wrote to memory of 2196 1920 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe 84 PID 1920 wrote to memory of 2196 1920 63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63cce2ccac3f8b860cc43b456decd73b_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\mfc110rus\mmgaclient.exe"C:\Windows\SysWOW64\mfc110rus\mmgaclient.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
938KB
MD563cce2ccac3f8b860cc43b456decd73b
SHA14f1a7cc61ed4b63b2bff5f7f439b0fec5eba1652
SHA2567b6a8d980f45784bac433be27a8e98feb2a764dc824506fa8ecaaff15b798bcb
SHA5120f68d688702163d36098e6308d1fb3b140860d08e6ad6204306639d6a032f295ca99e5d2a7976bf9b51b47252cdb5795af9436812d640bf23a6bd09ba8da2cf0