Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
29/07/2024, 00:58
Static task
static1
Behavioral task
behavioral1
Sample
2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe
-
Size
176KB
-
MD5
2f2ce3b75816ebe428c1506fcbd6cc5c
-
SHA1
73086c79a4db60b8a1fd780fe579ac73b693ef46
-
SHA256
b0dc63e33bfe60e4dd7fe58021c85a435dc757d19df506167c0900266eff374e
-
SHA512
09c547270e28a68542a0114588d1ccaa383f80a9d84c0746adb7f2c826d4e7175371fe2406d91a810768fa6f2aa65287fecfab88362560847231e93f056798fa
-
SSDEEP
1536:nRucTgvK09KbbheJJowUQLwedhQ8C/tC2t54LOFn1D4T/A7:nvgCzheJJowPkedh6t54Lun9oA7
Malware Config
Extracted
emotet
Epoch2
70.121.172.89:80
116.202.234.183:8080
69.30.203.214:8080
185.94.252.104:443
64.183.73.122:80
190.55.181.54:443
37.70.8.161:80
174.137.65.18:80
203.153.216.189:7080
109.116.214.124:443
93.51.50.171:8080
190.160.53.126:80
222.214.218.37:4143
87.106.136.232:8080
113.160.130.116:8443
174.102.48.180:80
79.98.24.39:8080
189.212.199.126:443
89.186.91.200:443
24.233.112.152:80
181.230.116.163:80
85.152.162.105:80
104.131.11.150:443
153.163.83.106:80
68.44.137.144:443
97.82.79.83:80
85.105.205.77:8080
104.236.246.93:8080
24.43.99.75:80
199.101.86.142:8080
74.120.55.163:80
176.111.60.55:8080
47.144.21.12:443
109.74.5.95:8080
47.146.117.214:80
116.203.32.252:8080
98.109.204.230:80
173.62.217.22:443
107.185.211.16:80
61.19.246.238:443
5.196.74.210:8080
200.41.121.90:80
91.211.88.52:7080
24.137.76.62:80
85.66.181.138:80
70.167.215.250:8080
203.117.253.142:80
204.197.146.48:80
142.105.151.124:443
167.86.90.214:8080
139.130.242.43:80
157.147.76.151:80
187.161.206.24:80
137.59.187.107:8080
81.2.235.111:8080
95.213.236.64:8080
201.173.217.124:443
87.106.139.101:8080
93.147.212.206:80
24.179.13.119:80
152.168.248.128:443
95.179.229.244:8080
41.60.200.34:80
139.59.60.244:8080
2.58.16.85:7080
46.105.131.79:8080
78.24.219.147:8080
75.139.38.211:80
168.235.67.138:7080
110.145.77.103:80
62.75.141.82:80
68.188.112.97:80
180.92.239.110:8080
104.131.44.150:8080
67.205.85.243:8080
103.86.49.11:8080
74.208.45.104:8080
37.187.72.193:8080
157.245.99.39:8080
37.139.21.175:8080
5.39.91.110:7080
209.141.54.221:8080
188.83.220.2:443
169.239.182.217:8080
83.169.36.251:8080
121.124.124.40:7080
200.114.213.233:8080
Signatures
-
resource yara_rule behavioral2/memory/316-0-0x0000000002390000-0x000000000239C000-memory.dmp emotet behavioral2/memory/316-4-0x0000000002380000-0x0000000002389000-memory.dmp emotet behavioral2/memory/1012-10-0x00000000009B0000-0x00000000009BC000-memory.dmp emotet behavioral2/memory/1012-6-0x00000000009B0000-0x00000000009BC000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
pid Process 1012 KBDMONMO.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DscCoreConfProv\KBDMONMO.exe 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 512 316 WerFault.exe 80 4528 316 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBDMONMO.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe 1012 KBDMONMO.exe 1012 KBDMONMO.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 316 wrote to memory of 1012 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe 84 PID 316 wrote to memory of 1012 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe 84 PID 316 wrote to memory of 1012 316 2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f2ce3b75816ebe428c1506fcbd6cc5c_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\DscCoreConfProv\KBDMONMO.exe"C:\Windows\SysWOW64\DscCoreConfProv\KBDMONMO.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 4362⤵
- Program crash
PID:512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 2482⤵
- Program crash
PID:4528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 316 -ip 3161⤵PID:3800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 316 -ip 3161⤵PID:1516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD52f2ce3b75816ebe428c1506fcbd6cc5c
SHA173086c79a4db60b8a1fd780fe579ac73b693ef46
SHA256b0dc63e33bfe60e4dd7fe58021c85a435dc757d19df506167c0900266eff374e
SHA51209c547270e28a68542a0114588d1ccaa383f80a9d84c0746adb7f2c826d4e7175371fe2406d91a810768fa6f2aa65287fecfab88362560847231e93f056798fa