Analysis
-
max time kernel
146s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 22:42
Static task
static1
Behavioral task
behavioral1
Sample
f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe
-
Size
368KB
-
MD5
f8e8dfd09f2218f3df7b2ddcb7c256d7
-
SHA1
c1f150ecc2223d0c448f1e36040873f94d5cb30b
-
SHA256
bf9041e81a2ba70bdba75b83186b826931a9e9a825a350cb80dafdde06efae83
-
SHA512
e5873697ae9cd7cb99cf375e8acf68baaed794a326c2803cad8551a72a88176c9be6f7384c3a0be4bdcb31791176983979db58854b2e1a9fdc4fdca86ccb04ed
-
SSDEEP
6144:8pNhFtYtpGQddLK3FGpMhRWYzyZfaDBZtMXYtJ02TjL+e9k9+:CN6GQdoFM2Jy2nXLt9kE
Malware Config
Extracted
emotet
Epoch3
190.38.252.45:443
105.225.77.21:80
181.167.35.84:80
164.68.115.146:8080
5.189.148.98:8080
46.105.128.215:8080
69.30.205.162:7080
190.161.67.63:80
81.82.247.216:80
72.69.99.47:80
172.90.70.168:443
91.117.31.181:80
200.71.112.158:53
51.77.113.97:8080
190.101.87.170:80
96.234.38.186:8080
190.146.14.143:443
86.70.224.211:80
88.247.26.78:80
175.103.239.50:80
187.233.220.93:443
85.235.219.74:80
87.9.181.247:80
162.144.46.90:8080
58.185.224.18:80
37.59.24.25:8080
138.197.140.163:8080
124.150.175.129:8080
82.79.244.92:80
91.117.131.122:80
185.244.167.25:443
77.245.12.212:80
220.78.29.88:80
95.255.140.89:443
124.150.175.133:80
95.216.207.86:7080
113.52.135.33:7080
177.103.240.93:80
201.196.15.79:990
192.161.190.171:8080
153.190.41.185:80
217.181.139.237:443
110.142.161.90:80
95.9.217.200:8080
189.61.200.9:443
176.58.93.123:80
128.92.54.20:80
195.250.143.182:80
181.46.176.38:80
181.47.235.26:993
192.210.217.94:8080
210.224.65.117:80
139.59.12.63:8080
203.153.216.178:7080
98.15.140.226:80
41.77.74.214:443
50.116.78.109:8080
58.93.151.148:80
78.187.204.70:80
165.100.148.200:443
210.111.160.220:80
59.158.164.66:443
163.172.97.112:8080
119.57.36.54:8080
72.27.212.209:8080
86.98.157.3:80
211.218.105.101:80
72.51.153.27:80
51.38.134.203:8080
123.142.37.165:80
212.129.14.27:8080
37.46.129.215:8080
119.159.150.176:443
95.216.212.157:8080
115.179.91.58:80
191.100.24.201:50000
190.171.135.235:80
24.28.178.71:80
200.41.121.69:443
177.103.201.23:80
174.57.150.13:8080
172.104.70.207:8080
92.16.222.156:80
86.6.123.109:80
110.2.118.164:80
82.146.55.23:7080
178.134.1.238:80
182.176.116.139:995
46.105.131.68:8080
67.254.196.78:443
67.171.182.231:80
175.127.140.68:80
216.75.37.196:8080
37.70.131.107:80
24.27.122.202:80
188.230.134.205:80
201.183.251.100:80
212.112.113.235:80
120.51.83.89:443
193.33.38.208:443
108.184.9.44:80
187.250.92.82:80
83.156.88.159:80
85.109.190.235:443
46.17.6.116:8080
78.46.87.133:8080
89.215.225.15:80
190.5.162.204:80
221.154.59.110:80
189.225.211.171:443
186.84.173.136:8080
78.186.102.195:80
192.241.220.183:8080
158.69.167.246:8080
23.253.207.142:8080
142.93.87.198:8080
100.38.11.243:80
42.51.192.231:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
charipmi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat charipmi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 29 IoCs
Processes:
charipmi.execharipmi.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Settings charipmi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Recent File List charipmi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-51-26-73-0d-da charipmi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD18798-4F76-4900-9E74-C9500276642C}\WpadNetworkName = "Network 3" charipmi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-51-26-73-0d-da\WpadDecisionReason = "1" charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Recent File List charipmi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD18798-4F76-4900-9E74-C9500276642C} charipmi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD18798-4F76-4900-9E74-C9500276642C}\WpadDecisionReason = "1" charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications charipmi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" charipmi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD18798-4F76-4900-9E74-C9500276642C}\WpadDecision = "0" charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Settings charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections charipmi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD18798-4F76-4900-9E74-C9500276642C}\ae-51-26-73-0d-da charipmi.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings charipmi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix charipmi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-51-26-73-0d-da\WpadDecisionTime = 20f617e1e191da01 charipmi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 charipmi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications charipmi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD18798-4F76-4900-9E74-C9500276642C}\WpadDecisionTime = 20f617e1e191da01 charipmi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-51-26-73-0d-da\WpadDecision = "0" charipmi.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
charipmi.exepid process 2516 charipmi.exe 2516 charipmi.exe 2516 charipmi.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exepid process 2800 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exef8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.execharipmi.execharipmi.exepid process 2872 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe 2800 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe 2580 charipmi.exe 2516 charipmi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.execharipmi.exedescription pid process target process PID 2872 wrote to memory of 2800 2872 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe PID 2872 wrote to memory of 2800 2872 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe PID 2872 wrote to memory of 2800 2872 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe PID 2872 wrote to memory of 2800 2872 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe PID 2580 wrote to memory of 2516 2580 charipmi.exe charipmi.exe PID 2580 wrote to memory of 2516 2580 charipmi.exe charipmi.exe PID 2580 wrote to memory of 2516 2580 charipmi.exe charipmi.exe PID 2580 wrote to memory of 2516 2580 charipmi.exe charipmi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe--2b63fad62⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\charipmi.exe"C:\Windows\SysWOW64\charipmi.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\charipmi.exe--3ae8e3ab2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx