Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
30/08/2024, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe
-
Size
132KB
-
MD5
cb5660dabdeae5d73d5c36b3af0c4f11
-
SHA1
e0befe26d7bc0e179a33c3c32e0ecf94bddc2e50
-
SHA256
8feb3da81ccde5d71483e103591c8637bf382b0bd717823679660ba0fccacbbd
-
SHA512
184e27c1d5b52795c405ff82b50462a10c56341d2469c6c788f9cdb63c9bc69ddf498f631b22f30f17fdb40fda2060d96f35e85be37f6eb4c5c42c3a83b47e35
-
SSDEEP
1536:GmYczEyk9QpGW+Za55pi/SQr5RCs6Hl68+895baYCSjTZyl2JtXaBIYH7prGOO12:G4z+Qk/X/5u1P95ba2E0qBDbpahaxbz
Malware Config
Extracted
emotet
Epoch2
91.187.80.246:80
108.191.2.72:80
188.152.7.140:80
108.179.206.219:8080
59.110.18.236:443
45.56.88.91:443
206.81.10.215:8080
178.209.71.63:8080
91.231.166.126:8080
200.71.148.138:8080
87.106.139.101:8080
212.186.191.177:80
212.129.24.79:8080
173.13.135.102:80
197.254.221.174:80
37.157.194.134:443
190.211.207.11:443
190.226.44.20:21
165.228.24.197:80
107.170.24.125:8080
195.244.215.206:80
186.75.241.230:80
24.45.193.161:7080
213.179.105.214:8080
165.227.156.155:443
91.73.197.90:80
211.63.71.72:8080
201.184.105.242:443
92.222.216.44:8080
206.189.112.148:8080
93.147.141.5:80
149.202.153.252:8080
190.53.135.159:21
128.65.154.183:443
182.176.132.213:8090
5.88.182.250:80
12.229.155.122:80
31.172.240.91:8080
91.242.138.5:80
47.50.251.130:80
167.71.10.37:8080
164.68.101.171:80
104.236.246.93:8080
80.11.163.139:21
67.225.179.64:8080
209.97.168.52:8080
104.131.11.150:8080
181.57.193.14:80
101.187.247.29:80
190.108.228.48:990
62.75.187.192:8080
87.106.136.232:8080
159.65.25.128:8080
116.48.142.21:443
217.160.182.191:8080
31.12.67.62:7080
181.143.194.138:443
189.209.217.49:80
167.114.242.226:8080
31.31.77.83:443
192.81.213.192:8080
46.105.131.87:80
190.12.119.180:443
192.241.255.77:8080
45.33.49.124:443
178.210.51.222:8080
78.24.219.147:8080
59.103.164.174:80
83.136.245.190:8080
169.239.182.217:8080
176.31.200.130:8080
183.102.238.69:465
176.106.183.253:8080
92.186.52.193:80
87.230.19.21:8080
167.99.105.223:7080
104.131.44.150:8080
173.212.203.26:8080
91.205.215.66:8080
144.139.247.220:80
138.201.140.110:8080
191.92.209.110:7080
181.31.213.158:8080
120.150.246.241:80
5.196.74.210:8080
118.201.230.249:80
107.2.2.28:80
80.21.182.46:80
103.39.131.88:80
190.147.215.53:22
95.128.43.213:8080
50.116.86.205:8080
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat anglerun.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language anglerun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language anglerun.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7F9E8909-E9DB-4E20-A1BA-AFE327912841}\62-85-ec-93-ce-62 anglerun.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-85-ec-93-ce-62\WpadDecisionTime = 701c4d6d04fbda01 anglerun.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix anglerun.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" anglerun.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7F9E8909-E9DB-4E20-A1BA-AFE327912841}\WpadDecision = "0" anglerun.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7F9E8909-E9DB-4E20-A1BA-AFE327912841}\WpadNetworkName = "Network 2" anglerun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7F9E8909-E9DB-4E20-A1BA-AFE327912841} anglerun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections anglerun.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 anglerun.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" anglerun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad anglerun.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 anglerun.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7F9E8909-E9DB-4E20-A1BA-AFE327912841}\WpadDecisionTime = 701c4d6d04fbda01 anglerun.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-85-ec-93-ce-62\WpadDecision = "0" anglerun.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7F9E8909-E9DB-4E20-A1BA-AFE327912841}\WpadDecisionReason = "1" anglerun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-85-ec-93-ce-62 anglerun.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-85-ec-93-ce-62\WpadDecisionReason = "1" anglerun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings anglerun.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" anglerun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings anglerun.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 anglerun.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2400 anglerun.exe 2400 anglerun.exe 2400 anglerun.exe 2400 anglerun.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1748 cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2432 cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe 1748 cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe 2880 anglerun.exe 2400 anglerun.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2432 wrote to memory of 1748 2432 cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe 30 PID 2432 wrote to memory of 1748 2432 cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe 30 PID 2432 wrote to memory of 1748 2432 cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe 30 PID 2432 wrote to memory of 1748 2432 cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe 30 PID 2880 wrote to memory of 2400 2880 anglerun.exe 32 PID 2880 wrote to memory of 2400 2880 anglerun.exe 32 PID 2880 wrote to memory of 2400 2880 anglerun.exe 32 PID 2880 wrote to memory of 2400 2880 anglerun.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe--b1588812⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
C:\Windows\SysWOW64\anglerun.exe"C:\Windows\SysWOW64\anglerun.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\anglerun.exe--e2c4a3aa2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2400
-