Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 03:16
Static task
static1
Behavioral task
behavioral1
Sample
0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe
-
Size
352KB
-
MD5
0441fa756e426129eb9665f3c48a60b8
-
SHA1
62dc0cc93d78d4acda6e8101d36e56b89d0a0d85
-
SHA256
657f8b3053328137655a125096e18e83baef2a24763a0e58bb1a079325180f31
-
SHA512
6654a33e88d0e002ea491ff3d4819ee94cab021347179b87320f285f9fac4ccf1d916c5c5ff4f1eeca801d082ae917feba62ce4527bf9a35ff9fb32527d3ceda
-
SSDEEP
6144:UYu13J/YyrGwoebB4dzapqUHTTBoGhUWnSQaBE6KHb:UYu13JgyKwradza0UDRna6Hb
Malware Config
Extracted
emotet
Epoch1
104.236.137.72:8080
172.104.233.225:8080
81.169.140.14:443
213.189.36.51:8080
87.106.77.40:7080
86.42.166.147:80
200.113.106.18:80
45.79.95.107:443
125.99.61.162:7080
181.16.17.210:443
207.154.204.40:8080
91.204.163.19:8090
201.190.133.235:8080
91.83.93.124:7080
163.172.40.218:7080
149.62.173.247:8080
189.173.113.67:443
68.183.190.199:8080
190.210.184.138:995
142.127.57.63:8080
181.231.62.54:80
178.79.163.131:8080
50.28.51.143:8080
200.58.83.179:80
91.205.215.57:7080
190.97.30.167:990
203.130.0.69:80
142.93.114.137:8080
190.146.131.105:8080
94.183.71.206:7080
77.55.211.77:8080
85.234.143.94:8080
81.213.215.216:50000
186.1.41.111:443
87.118.70.69:8080
88.250.223.190:8080
119.59.124.163:8080
62.75.143.100:7080
190.17.42.79:80
190.16.101.10:80
5.196.35.138:7080
109.169.86.13:8080
190.38.14.52:80
183.82.97.25:80
187.230.99.192:443
190.195.129.227:8090
181.61.143.177:80
200.123.101.90:80
77.245.101.134:8080
82.196.15.205:8080
185.86.148.222:8080
46.101.212.195:8080
203.25.159.3:8080
14.160.93.230:80
46.28.111.142:7080
201.213.32.59:80
181.135.153.203:443
182.48.194.6:8090
69.163.33.84:8080
86.142.102.191:8443
92.169.250.229:8080
134.209.214.126:8080
154.120.227.206:8080
186.23.132.93:990
139.5.237.27:443
190.4.50.26:80
62.75.160.178:8080
212.71.237.140:8080
201.163.74.202:443
181.36.42.205:443
189.139.35.247:8443
104.131.58.132:8080
217.199.160.224:8080
138.68.106.4:7080
159.203.204.126:8080
186.15.83.52:8080
68.183.170.114:8080
51.255.165.160:8080
181.198.203.45:443
80.85.87.122:8080
96.20.84.254:7080
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
rdswiz.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 rdswiz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE rdswiz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies rdswiz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 rdswiz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
rdswiz.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rdswiz.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rdswiz.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rdswiz.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rdswiz.exepid process 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe 3824 rdswiz.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exepid process 4832 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exerdswiz.exerdswiz.exepid process 996 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe 4832 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe 2144 rdswiz.exe 3824 rdswiz.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exerdswiz.exedescription pid process target process PID 996 wrote to memory of 4832 996 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe PID 996 wrote to memory of 4832 996 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe PID 996 wrote to memory of 4832 996 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe 0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe PID 2144 wrote to memory of 3824 2144 rdswiz.exe rdswiz.exe PID 2144 wrote to memory of 3824 2144 rdswiz.exe rdswiz.exe PID 2144 wrote to memory of 3824 2144 rdswiz.exe rdswiz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\0441fa756e426129eb9665f3c48a60b8_JaffaCakes118.exe--3bffec52⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:4832
-
C:\Windows\SysWOW64\rdswiz.exe"C:\Windows\SysWOW64\rdswiz.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\rdswiz.exe--426701992⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\8049f5751f521006eea6c344abdeca4a_54631303-6cba-4b22-b333-215df416769aFilesize
50B
MD5f730d90525420c3cc17e473d8c01f71c
SHA1d1a3493df7b5f92e4df5a65b0ef3dc24a8744d63
SHA256d7cba870504d6fca4e8bc2a965f8de5586e0af5886780deba265275e53d929f9
SHA51209d865e1087ac655cc246665399febadd0c32415aa21370db6d9b8129ccaf1109d39e24f724fbce35dffebea8bada6e1a99e544ce4c09e2c990e026c00697645
-
memory/996-0-0x0000000002130000-0x0000000002147000-memory.dmpFilesize
92KB
-
memory/996-5-0x00000000005F0000-0x0000000000601000-memory.dmpFilesize
68KB
-
memory/2144-12-0x0000000000F30000-0x0000000000F47000-memory.dmpFilesize
92KB
-
memory/3824-19-0x0000000001050000-0x0000000001067000-memory.dmpFilesize
92KB
-
memory/4832-6-0x0000000000600000-0x0000000000617000-memory.dmpFilesize
92KB
-
memory/4832-17-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB