Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe
-
Size
632KB
-
MD5
da4e888ddb2802a99902ee8e4ef31faf
-
SHA1
6c0bc9ff40d3617eff872e7b5d32f590acf71c84
-
SHA256
74d5968f2dd70567b9a74948ef389d7291955713f93c843a371d5b63a527eeb5
-
SHA512
44be3f4a891414bbebcdb5cb83762652cb793fc9126411a0cf819db7563cab05c2a64cc211ff11fa3665a1375be9cbb18edb8cbfbcd27f41eb3629117a18c045
-
SSDEEP
12288:RphSRoPQfYGRWDr/ZxQko0WYNkjC9smpNNH:RHL6WDDWY6UN5
Malware Config
Extracted
emotet
Epoch3
54.38.94.197:8080
192.161.190.171:8080
80.93.48.49:7080
222.239.249.166:443
201.196.15.79:990
37.59.24.25:8080
113.52.135.33:7080
172.104.70.207:8080
217.26.163.82:7080
216.75.37.196:8080
157.7.164.178:8081
212.129.14.27:8080
198.57.217.170:8080
186.66.224.182:990
119.159.150.176:443
181.197.108.171:443
191.100.24.201:50000
95.216.212.157:8080
187.177.155.123:990
190.189.79.73:80
143.95.101.72:8080
78.46.87.133:8080
192.163.221.191:8080
124.150.175.129:8080
83.169.33.157:8080
181.44.166.242:80
181.47.235.26:993
46.105.131.68:8080
192.241.220.183:8080
139.162.185.116:443
172.245.13.50:8080
124.150.175.133:80
138.197.140.163:8080
50.116.78.109:8080
200.71.112.158:53
5.189.148.98:8080
152.169.32.143:8080
142.93.87.198:8080
212.112.113.235:80
163.172.97.112:8080
95.216.207.86:7080
176.58.93.123:80
162.144.46.90:8080
195.201.56.68:7080
51.38.134.203:8080
46.17.6.116:8080
182.176.116.139:995
195.226.144.249:80
177.226.25.78:80
23.253.207.142:8080
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fillgroup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fillgroup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fillgroup.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fillgroup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fillgroup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fillgroup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fillgroup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fillgroup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fillgroup.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe 380 fillgroup.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3536 da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1164 da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe 3536 da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe 4620 fillgroup.exe 380 fillgroup.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1164 wrote to memory of 3536 1164 da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe 86 PID 1164 wrote to memory of 3536 1164 da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe 86 PID 1164 wrote to memory of 3536 1164 da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe 86 PID 4620 wrote to memory of 380 4620 fillgroup.exe 93 PID 4620 wrote to memory of 380 4620 fillgroup.exe 93 PID 4620 wrote to memory of 380 4620 fillgroup.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\da4e888ddb2802a99902ee8e4ef31faf_JaffaCakes118.exe--432c356b2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:3536
-
-
C:\Windows\SysWOW64\fillgroup.exe"C:\Windows\SysWOW64\fillgroup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\fillgroup.exe--e7430f122⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6f2a78af3f34dee4a4986c4aabfc2f55_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
Filesize50B
MD54f99903ecfac80c29a056d3bd0e89210
SHA1fd77786d9a0042037f362a15e52bc9d500e2a792
SHA256a66a8472f091db077d4d12eb295d1b2cb8322d1850322cc87b5b15c66e20dace
SHA512e811d0a67e6bfa9c799dec6132b4f706c2a9b4199412fab6396a606c660bb864a3bcb2975fcfc62b8cecfe64d1ad92005b2bccf7dd0a6d9be936490e19ee1ba5