Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 17:59 UTC

General

  • Target

    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe

  • Size

    442KB

  • MD5

    b841aad241d5c6c6ad84150ceec11b24

  • SHA1

    0d9915f0ae34c35e75f93cab09e44d3a4f5872e5

  • SHA256

    9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463

  • SHA512

    fd3120946d4b4edf089db5687049da65f834be1850b527d9d89f2d208e84be6a4ee1bc87e8dc9bf055e049b993e6b723a1ccf238a131f746c4d1bd5bff598824

  • SSDEEP

    6144:aRcVGq8TkBsx1PMRBFC5EpIwypyEP6e2rvX6gJiYfUD1ZCDzPAuQyUr8iac5Qh:aWBsfM3C5AEPOOgP8Dqz1QyUrdFQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.96.15.50:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

200.127.14.97:80

190.188.245.242:80

51.15.7.145:80

138.97.60.140:8080

98.13.75.196:80

213.52.74.198:80

74.58.215.226:80

192.81.38.31:80

191.182.6.118:80

212.71.237.140:8080

209.236.123.42:8080

60.93.23.51:80

178.211.45.66:8080

190.24.243.186:80

62.84.75.50:80

50.121.220.50:80

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2112

Network

    No results found
  • 190.96.15.50:80
    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    152 B
    3
  • 190.96.15.50:80
    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    152 B
    3
  • 192.175.111.214:8080
    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    152 B
    3
  • 192.175.111.214:8080
    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    152 B
    3
  • 95.85.33.23:8080
    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    152 B
    3
  • 95.85.33.23:8080
    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    152 B
    3
  • 192.232.229.54:7080
    JaffaCakes118_9bf2bc68a9bb07da6cefc379a9e37e9dfdfaa86fa75867b9686355887657c463.exe
    104 B
    80 B
    2
    2
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2112-4-0x00000000003D0000-0x00000000003FE000-memory.dmp

    Filesize

    184KB

  • memory/2112-8-0x0000000000370000-0x000000000039D000-memory.dmp

    Filesize

    180KB

  • memory/2112-0-0x00000000003A0000-0x00000000003CF000-memory.dmp

    Filesize

    188KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.