Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 12:02

General

  • Target

    da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe

  • Size

    632KB

  • MD5

    da4e888ddb2802a99902ee8e4ef31faf

  • SHA1

    6c0bc9ff40d3617eff872e7b5d32f590acf71c84

  • SHA256

    74d5968f2dd70567b9a74948ef389d7291955713f93c843a371d5b63a527eeb5

  • SHA512

    44be3f4a891414bbebcdb5cb83762652cb793fc9126411a0cf819db7563cab05c2a64cc211ff11fa3665a1375be9cbb18edb8cbfbcd27f41eb3629117a18c045

  • SSDEEP

    12288:RphSRoPQfYGRWDr/ZxQko0WYNkjC9smpNNH:RHL6WDDWY6UN5

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

54.38.94.197:8080

192.161.190.171:8080

80.93.48.49:7080

222.239.249.166:443

201.196.15.79:990

37.59.24.25:8080

113.52.135.33:7080

172.104.70.207:8080

217.26.163.82:7080

216.75.37.196:8080

157.7.164.178:8081

212.129.14.27:8080

198.57.217.170:8080

186.66.224.182:990

119.159.150.176:443

181.197.108.171:443

191.100.24.201:50000

95.216.212.157:8080

187.177.155.123:990

190.189.79.73:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Users\Admin\AppData\Local\Temp\da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe
      --432c356b
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:3536
  • C:\Windows\SysWOW64\fillgroup.exe
    "C:\Windows\SysWOW64\fillgroup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Windows\SysWOW64\fillgroup.exe
      --e7430f12
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6f2a78af3f34dee4a4986c4aabfc2f55_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823

    Filesize

    50B

    MD5

    4f99903ecfac80c29a056d3bd0e89210

    SHA1

    fd77786d9a0042037f362a15e52bc9d500e2a792

    SHA256

    a66a8472f091db077d4d12eb295d1b2cb8322d1850322cc87b5b15c66e20dace

    SHA512

    e811d0a67e6bfa9c799dec6132b4f706c2a9b4199412fab6396a606c660bb864a3bcb2975fcfc62b8cecfe64d1ad92005b2bccf7dd0a6d9be936490e19ee1ba5

  • memory/380-19-0x0000000000DC0000-0x0000000000DD4000-memory.dmp

    Filesize

    80KB

  • memory/1164-5-0x00000000024A0000-0x00000000024AF000-memory.dmp

    Filesize

    60KB

  • memory/1164-0-0x00000000024B0000-0x00000000024C4000-memory.dmp

    Filesize

    80KB

  • memory/3536-6-0x0000000002060000-0x0000000002074000-memory.dmp

    Filesize

    80KB

  • memory/3536-17-0x0000000000400000-0x00000000004A3000-memory.dmp

    Filesize

    652KB

  • memory/4620-12-0x0000000001060000-0x0000000001074000-memory.dmp

    Filesize

    80KB