Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_de387a3197507ae6b510853e953e39a400245f1d687c543ecf4036a4ea50daa2.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_de387a3197507ae6b510853e953e39a400245f1d687c543ecf4036a4ea50daa2.dll
-
Size
735KB
-
MD5
ca63d35f20ed8e046a0483e718fab727
-
SHA1
1f3c1b926ce03a7f0a147cd5acb2dec95627547f
-
SHA256
de387a3197507ae6b510853e953e39a400245f1d687c543ecf4036a4ea50daa2
-
SHA512
cec8d0454eeab4a47435caae1f2eca2f9e109ef36f674ce2cdfd9d33374c0192e994ffdb160956f9070d6614578f4edf2ae642e982b1d03a23b1d07a6f263777
-
SSDEEP
12288:agvTeqrCeX329Soy/O+TCJJU2QyDqXkkpLdzR6TqKCKDeS:tviEdX3Y7GTCRhukkpSqUx
Malware Config
Extracted
emotet
Epoch4
131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2216 2596 regsvr32.exe 29 PID 2596 wrote to memory of 2216 2596 regsvr32.exe 29 PID 2596 wrote to memory of 2216 2596 regsvr32.exe 29 PID 2596 wrote to memory of 2216 2596 regsvr32.exe 29 PID 2596 wrote to memory of 2216 2596 regsvr32.exe 29 PID 2596 wrote to memory of 2216 2596 regsvr32.exe 29 PID 2596 wrote to memory of 2216 2596 regsvr32.exe 29 PID 2216 wrote to memory of 2236 2216 regsvr32.exe 30 PID 2216 wrote to memory of 2236 2216 regsvr32.exe 30 PID 2216 wrote to memory of 2236 2216 regsvr32.exe 30 PID 2216 wrote to memory of 2236 2216 regsvr32.exe 30 PID 2216 wrote to memory of 2236 2216 regsvr32.exe 30 PID 2216 wrote to memory of 2236 2216 regsvr32.exe 30 PID 2216 wrote to memory of 2236 2216 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de387a3197507ae6b510853e953e39a400245f1d687c543ecf4036a4ea50daa2.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de387a3197507ae6b510853e953e39a400245f1d687c543ecf4036a4ea50daa2.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de387a3197507ae6b510853e953e39a400245f1d687c543ecf4036a4ea50daa2.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2236
-
-