Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    30/08/2024, 17:44

General

  • Target

    cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe

  • Size

    132KB

  • MD5

    cb5660dabdeae5d73d5c36b3af0c4f11

  • SHA1

    e0befe26d7bc0e179a33c3c32e0ecf94bddc2e50

  • SHA256

    8feb3da81ccde5d71483e103591c8637bf382b0bd717823679660ba0fccacbbd

  • SHA512

    184e27c1d5b52795c405ff82b50462a10c56341d2469c6c788f9cdb63c9bc69ddf498f631b22f30f17fdb40fda2060d96f35e85be37f6eb4c5c42c3a83b47e35

  • SSDEEP

    1536:GmYczEyk9QpGW+Za55pi/SQr5RCs6Hl68+895baYCSjTZyl2JtXaBIYH7prGOO12:G4z+Qk/X/5u1P95ba2E0qBDbpahaxbz

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

91.187.80.246:80

108.191.2.72:80

188.152.7.140:80

108.179.206.219:8080

59.110.18.236:443

45.56.88.91:443

206.81.10.215:8080

178.209.71.63:8080

91.231.166.126:8080

200.71.148.138:8080

87.106.139.101:8080

212.186.191.177:80

212.129.24.79:8080

173.13.135.102:80

197.254.221.174:80

37.157.194.134:443

190.211.207.11:443

190.226.44.20:21

165.228.24.197:80

107.170.24.125:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\cb5660dabdeae5d73d5c36b3af0c4f11_JaffaCakes118.exe
      --b158881
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:1748
  • C:\Windows\SysWOW64\anglerun.exe
    "C:\Windows\SysWOW64\anglerun.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\SysWOW64\anglerun.exe
      --e2c4a3aa
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1748-6-0x0000000000290000-0x00000000002A7000-memory.dmp

    Filesize

    92KB

  • memory/1748-16-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2400-17-0x00000000004B0000-0x00000000004C7000-memory.dmp

    Filesize

    92KB

  • memory/2432-0-0x00000000003E0000-0x00000000003F7000-memory.dmp

    Filesize

    92KB

  • memory/2432-5-0x00000000003C0000-0x00000000003D1000-memory.dmp

    Filesize

    68KB

  • memory/2880-11-0x0000000000600000-0x0000000000617000-memory.dmp

    Filesize

    92KB