Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...37.exe

windows7-x64

10

JaffaCakes...37.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 11:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_0ed22d2d988ca024a2dd09144d8b18cb553bd668c6e757ac62b347a6a3ef9b37.exe

  • Size

    368KB

  • MD5

    418332d96971f9bcce9530ec2e9ba72a

  • SHA1

    dbac795dbda05583c31e85885c1af1a643571739

  • SHA256

    0ed22d2d988ca024a2dd09144d8b18cb553bd668c6e757ac62b347a6a3ef9b37

  • SHA512

    e6b968ecd2ae861eac01c6ee65686ec8b06f4dd41fe01db263c08ed62943da4ab7e20e2b182f60896edd0aa79b70f2c1a88d9db6da0510b5120d1267aee1f704

  • SSDEEP

    6144:AozjUrx4KVHa9eUfTLHygDVjfML+YSetuAlyb57P/z6GcNdJ8lGn:AoiHV8zpYSeZlyRnzpcNdCM

Score
10/10
emotetepoch3bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

78.90.78.210:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

120.51.34.254:80

85.246.78.192:80

139.59.12.63:8080

46.105.131.68:8080

5.2.246.108:80

60.108.128.186:80

190.55.186.229:80

47.154.85.229:80

188.80.27.54:80

115.79.59.157:80

91.75.75.46:80

119.92.77.17:80

109.13.179.195:80

190.151.5.131:443

5.79.70.250:8080

175.103.38.146:80
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Emotet family
    emotet
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

    trojanbanker
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ed22d2d988ca024a2dd09144d8b18cb553bd668c6e757ac62b347a6a3ef9b37.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ed22d2d988ca024a2dd09144d8b18cb553bd668c6e757ac62b347a6a3ef9b37.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/540-3-0x0000000000730000-0x0000000000750000-memory.dmp

    Filesize

    128KB

    Download

  • memory/540-5-0x00000000023F0000-0x0000000002411000-memory.dmp

    Filesize

    132KB

    Download

  • memory/540-0-0x00000000023C0000-0x00000000023E2000-memory.dmp

    Filesize

    136KB

    Download