Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 22:42
Static task
static1
Behavioral task
behavioral1
Sample
f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe
-
Size
368KB
-
MD5
f8e8dfd09f2218f3df7b2ddcb7c256d7
-
SHA1
c1f150ecc2223d0c448f1e36040873f94d5cb30b
-
SHA256
bf9041e81a2ba70bdba75b83186b826931a9e9a825a350cb80dafdde06efae83
-
SHA512
e5873697ae9cd7cb99cf375e8acf68baaed794a326c2803cad8551a72a88176c9be6f7384c3a0be4bdcb31791176983979db58854b2e1a9fdc4fdca86ccb04ed
-
SSDEEP
6144:8pNhFtYtpGQddLK3FGpMhRWYzyZfaDBZtMXYtJ02TjL+e9k9+:CN6GQdoFM2Jy2nXLt9kE
Malware Config
Extracted
emotet
Epoch3
190.38.252.45:443
105.225.77.21:80
181.167.35.84:80
164.68.115.146:8080
5.189.148.98:8080
46.105.128.215:8080
69.30.205.162:7080
190.161.67.63:80
81.82.247.216:80
72.69.99.47:80
172.90.70.168:443
91.117.31.181:80
200.71.112.158:53
51.77.113.97:8080
190.101.87.170:80
96.234.38.186:8080
190.146.14.143:443
86.70.224.211:80
88.247.26.78:80
175.103.239.50:80
187.233.220.93:443
85.235.219.74:80
87.9.181.247:80
162.144.46.90:8080
58.185.224.18:80
37.59.24.25:8080
138.197.140.163:8080
124.150.175.129:8080
82.79.244.92:80
91.117.131.122:80
185.244.167.25:443
77.245.12.212:80
220.78.29.88:80
95.255.140.89:443
124.150.175.133:80
95.216.207.86:7080
113.52.135.33:7080
177.103.240.93:80
201.196.15.79:990
192.161.190.171:8080
153.190.41.185:80
217.181.139.237:443
110.142.161.90:80
95.9.217.200:8080
189.61.200.9:443
176.58.93.123:80
128.92.54.20:80
195.250.143.182:80
181.46.176.38:80
181.47.235.26:993
192.210.217.94:8080
210.224.65.117:80
139.59.12.63:8080
203.153.216.178:7080
98.15.140.226:80
41.77.74.214:443
50.116.78.109:8080
58.93.151.148:80
78.187.204.70:80
165.100.148.200:443
210.111.160.220:80
59.158.164.66:443
163.172.97.112:8080
119.57.36.54:8080
72.27.212.209:8080
86.98.157.3:80
211.218.105.101:80
72.51.153.27:80
51.38.134.203:8080
123.142.37.165:80
212.129.14.27:8080
37.46.129.215:8080
119.159.150.176:443
95.216.212.157:8080
115.179.91.58:80
191.100.24.201:50000
190.171.135.235:80
24.28.178.71:80
200.41.121.69:443
177.103.201.23:80
174.57.150.13:8080
172.104.70.207:8080
92.16.222.156:80
86.6.123.109:80
110.2.118.164:80
82.146.55.23:7080
178.134.1.238:80
182.176.116.139:995
46.105.131.68:8080
67.254.196.78:443
67.171.182.231:80
175.127.140.68:80
216.75.37.196:8080
37.70.131.107:80
24.27.122.202:80
188.230.134.205:80
201.183.251.100:80
212.112.113.235:80
120.51.83.89:443
193.33.38.208:443
108.184.9.44:80
187.250.92.82:80
83.156.88.159:80
85.109.190.235:443
46.17.6.116:8080
78.46.87.133:8080
89.215.225.15:80
190.5.162.204:80
221.154.59.110:80
189.225.211.171:443
186.84.173.136:8080
78.186.102.195:80
192.241.220.183:8080
158.69.167.246:8080
23.253.207.142:8080
142.93.87.198:8080
100.38.11.243:80
42.51.192.231:8080
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE acquirepdf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies acquirepdf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 acquirepdf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 acquirepdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 11 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Recent File List acquirepdf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir acquirepdf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Recent File List acquirepdf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Settings acquirepdf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix acquirepdf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications acquirepdf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir\Settings acquirepdf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications acquirepdf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" acquirepdf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" acquirepdf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\WinDir acquirepdf.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe 2520 acquirepdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 872 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4752 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe 872 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe 1020 acquirepdf.exe 2520 acquirepdf.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4752 wrote to memory of 872 4752 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe 84 PID 4752 wrote to memory of 872 4752 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe 84 PID 4752 wrote to memory of 872 4752 f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe 84 PID 1020 wrote to memory of 2520 1020 acquirepdf.exe 90 PID 1020 wrote to memory of 2520 1020 acquirepdf.exe 90 PID 1020 wrote to memory of 2520 1020 acquirepdf.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\f8e8dfd09f2218f3df7b2ddcb7c256d7_JaffaCakes118.exe--2b63fad62⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:872
-
-
C:\Windows\SysWOW64\acquirepdf.exe"C:\Windows\SysWOW64\acquirepdf.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\acquirepdf.exe--6c5197ae2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2520
-