Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/09/2024, 10:01
General
-
Target
d808c29b4242eeba4f67f31a0669ddc5_JaffaCakes118.exe
-
Size
624KB
-
MD5
d808c29b4242eeba4f67f31a0669ddc5
-
SHA1
bc14fb81924ab893cd75fb59a8614a1482baf370
-
SHA256
0f3df36c91797ff6c6411c846caadae9d9f1004000dbdcbb1f768624e77c5c5f
-
SHA512
1d9ca7a697e2c27f489f579eb6629f4729f8431cf80b68d06a41721f3ce7971444003b0f824992b04eeca8a0cee6aa08cfe3e793d61a970bb2820b0df572a8d3
-
SSDEEP
12288:lIGeyldceHHy5TXTkiHyJl9tuHiRzD8XkQyg:lIGeylC7jtHipdDPg
Malware Config
Extracted
emotet
Epoch3
220.147.247.145:80
45.79.16.230:7080
145.239.169.32:7080
190.85.46.52:7080
185.142.236.163:443
200.120.241.238:80
37.205.9.252:7080
202.166.170.43:80
203.153.216.178:7080
37.187.100.220:7080
60.125.114.64:443
115.78.11.155:80
88.247.58.26:80
189.150.209.206:80
103.229.73.17:8080
157.245.138.101:7080
181.122.154.240:80
113.160.248.110:80
46.32.229.152:8080
103.48.68.173:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d808c29b4242eeba4f67f31a0669ddc5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d808c29b4242eeba4f67f31a0669ddc5_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
60KB