Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 19:17

General

  • Target

    e335f90b6ef00b3ae36d4b701cc910dd_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    e335f90b6ef00b3ae36d4b701cc910dd

  • SHA1

    8147539779e5e88f173b13ee370e8d721d5fa5a2

  • SHA256

    e2278f7f09a788d6feb4827183ee3f155c41efe1377c9d77ace231494589bafa

  • SHA512

    84e3f638056d44f36901f09e84c9f46fc351a16f59aeaa635afa374d879f75522bfc10eba54d31ccd008ec801aeb966eb69da9f72a99d35119b0b5330ef283c4

  • SSDEEP

    3072:9Tw3LbQSLZkGvBb/ads9GK4lowNllwMfpzgk04C71KRg:tw3LbQS1kYDahlPeE7GgR

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e335f90b6ef00b3ae36d4b701cc910dd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e335f90b6ef00b3ae36d4b701cc910dd_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\e335f90b6ef00b3ae36d4b701cc910dd_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e335f90b6ef00b3ae36d4b701cc910dd_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:2160
  • C:\Windows\SysWOW64\adminmouse.exe
    "C:\Windows\SysWOW64\adminmouse.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Windows\SysWOW64\adminmouse.exe
      "C:\Windows\SysWOW64\adminmouse.exe"
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2160-23-0x0000000000240000-0x000000000025A000-memory.dmp

    Filesize

    104KB

  • memory/2160-6-0x0000000000240000-0x000000000025A000-memory.dmp

    Filesize

    104KB

  • memory/2160-11-0x0000000000280000-0x0000000000298000-memory.dmp

    Filesize

    96KB

  • memory/2160-7-0x0000000000260000-0x000000000027A000-memory.dmp

    Filesize

    104KB

  • memory/2160-28-0x0000000000240000-0x000000000025A000-memory.dmp

    Filesize

    104KB

  • memory/2160-27-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2520-0-0x0000000000260000-0x000000000027A000-memory.dmp

    Filesize

    104KB

  • memory/2520-5-0x00000000005E0000-0x00000000005F8000-memory.dmp

    Filesize

    96KB

  • memory/2520-12-0x0000000000260000-0x000000000027A000-memory.dmp

    Filesize

    104KB

  • memory/2520-1-0x00000000005C0000-0x00000000005DA000-memory.dmp

    Filesize

    104KB

  • memory/2752-24-0x00000000001D0000-0x00000000001EA000-memory.dmp

    Filesize

    104KB

  • memory/2752-25-0x00000000002A0000-0x00000000002B8000-memory.dmp

    Filesize

    96KB

  • memory/2752-20-0x0000000000280000-0x000000000029A000-memory.dmp

    Filesize

    104KB

  • memory/2752-29-0x00000000001D0000-0x00000000001EA000-memory.dmp

    Filesize

    104KB

  • memory/2932-17-0x00000000005C0000-0x00000000005DA000-memory.dmp

    Filesize

    104KB

  • memory/2932-26-0x00000000005C0000-0x00000000005DA000-memory.dmp

    Filesize

    104KB

  • memory/2932-18-0x0000000000600000-0x0000000000618000-memory.dmp

    Filesize

    96KB

  • memory/2932-13-0x00000000005E0000-0x00000000005FA000-memory.dmp

    Filesize

    104KB