Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 19:06 UTC

General

  • Target

    JaffaCakes118_6386b1c14dab880aa5b885afb526a4e28ffe2dabd11b256e8cc7dfc58257a987.dll

  • Size

    882KB

  • MD5

    75be5fe6bfd682ebc8c93c7550ae756b

  • SHA1

    7643022490cdbcaba65ed6b5941b36ccd17c8c01

  • SHA256

    6386b1c14dab880aa5b885afb526a4e28ffe2dabd11b256e8cc7dfc58257a987

  • SHA512

    263453ed8558bca376491c329c47c2842ed857d48e9d47392d2604c2d96ee1263d05a088a7d3eeeef076142df19355005ab7e0645b207e85919045dbe8d99ee6

  • SSDEEP

    12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQwxA3:Opk+4Rj01BkN3tphz0WMTmdK

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.235.8.30:8080

94.23.45.86:4143

119.59.103.152:8080

169.60.181.70:8080

164.68.99.3:8080

172.105.226.75:8080

107.170.39.149:8080

206.189.28.199:8080

1.234.2.232:8080

188.44.20.25:443

186.194.240.217:443

103.43.75.120:443

149.28.143.92:443

159.89.202.34:443

209.97.163.214:443

183.111.227.137:8080

129.232.188.93:443

139.59.126.41:443

110.232.117.186:8080

139.59.56.73:8080

eck1.plain
1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw
3
TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg==
4
-----END PUBLIC KEY-----
ecs1.plain
1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov
3
pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q==
4
-----END PUBLIC KEY-----

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6386b1c14dab880aa5b885afb526a4e28ffe2dabd11b256e8cc7dfc58257a987.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RODxdE\idfmNXBjOXkcLJx.dll"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1708

Network

  • flag-kr
    GET
    https://182.162.143.56/
    regsvr32.exe
    Remote address:
    182.162.143.56:443
    Request
    GET / HTTP/1.1
    Connection: Keep-Alive
    Cookie: bGoVR=DBVngGU4qFmxuuuhqBHpTeA2yqreoTXLtDDlS2nTfjgZ5U//w55se8U+SCdsYAPhPV7TemsuOivxXVXgBib+465KpOdPUnDJo2tyEMqZWwtPAi5xWEz/Bpi+Uc11MNCi868AuAq6Md2HpNoe/DImuhoUFJa49xZbPBI2MlM5eVlVd1njovu3svZxIb/Bo17ge7rm61HSg7/uVocAxsVu5wR/hm0kDuk91I+TNgI7Gg5ZE0Dh+EVtn75tL09p2BGGNGzj8QtyBdypcwyjefAS1aIT7TOTw9VgFvl/9TOhAxvnk8TRkzszMICLcGy/2Zru1tbe4vZdBE8w66He3f/inl1Nqpgxyg==
    Host: 182.162.143.56
  • 182.162.143.56:443
    https://182.162.143.56/
    tls, http
    regsvr32.exe
    1.3kB
    5.0kB
    10
    9

    HTTP Request

    GET https://182.162.143.56/
  • 169.60.181.70:8080
    regsvr32.exe
    152 B
    3
  • 149.28.143.92:443
    regsvr32.exe
    152 B
    3
  • 91.187.140.35:8080
    regsvr32.exe
    152 B
    3
  • 187.63.160.88:80
    regsvr32.exe
    152 B
    120 B
    3
    3
  • 94.23.45.86:4143
    regsvr32.exe
    152 B
    3
  • 95.217.221.146:8080
    regsvr32.exe
    152 B
    3
  • 110.232.117.186:8080
    regsvr32.exe
    152 B
    3
  • 160.16.142.56:8080
    regsvr32.exe
    104 B
    2
No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab1518.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar152B.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1708-8-0x0000000180000000-0x00000001800E2000-memory.dmp

    Filesize

    904KB

  • memory/1708-63-0x0000000180000000-0x00000001800E2000-memory.dmp

    Filesize

    904KB

  • memory/1708-70-0x0000000180000000-0x00000001800E2000-memory.dmp

    Filesize

    904KB

  • memory/2408-0-0x0000000000320000-0x000000000034F000-memory.dmp

    Filesize

    188KB

  • memory/2408-3-0x0000000000150000-0x0000000000151000-memory.dmp

    Filesize

    4KB

  • memory/2408-7-0x0000000180000000-0x00000001800E2000-memory.dmp

    Filesize

    904KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.