Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 17:01
Static task
static1
Behavioral task
behavioral1
Sample
10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe
-
Size
104KB
-
MD5
10ffa05cd9aeefee7af58dea58d3f23a
-
SHA1
a8922767780addf7b962f3a75eb2b9669348ea3d
-
SHA256
8d153fde5f97c7e52a1f5da66c4546152a067ac36abc0c229fda7f21e08ee709
-
SHA512
969a4e0503a967d147bd29b96e56740c8250aafe6cb00dbd1d61658b6509d3ffd9548d7c427f2cca593a6a74ea1066cfa22c13c4a5be3472c92478e06858b7b1
-
SSDEEP
3072:7CaJmI7P7Ynw6SGXAha6UmYBOP5EgVSDO9BEfy:+gmIrqw656UmYBqEK
Malware Config
Extracted
emotet
Epoch1
155.186.0.121:80
51.38.124.206:80
82.196.15.205:8080
38.88.126.202:8080
219.92.13.25:80
111.67.77.202:8080
95.9.180.128:80
77.90.136.129:8080
190.163.31.26:80
74.136.144.133:80
104.131.103.37:8080
45.33.77.42:8080
192.241.143.52:8080
78.249.119.122:80
177.74.228.34:80
152.169.22.67:80
92.24.50.153:80
5.189.178.202:8080
104.131.41.185:8080
82.230.1.24:80
178.250.54.208:8080
67.247.242.247:80
82.76.111.249:443
54.37.42.48:8080
94.176.234.118:443
61.92.159.208:8080
137.74.106.111:7080
73.213.208.163:80
50.121.220.50:80
172.104.169.32:8080
184.66.18.83:80
186.103.141.250:443
65.36.62.20:80
72.47.248.48:7080
213.197.182.158:8080
87.106.46.107:8080
98.13.75.196:80
217.199.160.224:7080
68.183.170.114:8080
190.195.129.227:8090
217.13.106.14:8080
177.73.0.98:443
96.227.52.8:443
5.196.35.138:7080
83.169.21.32:7080
68.69.155.181:80
68.183.190.199:8080
190.190.148.27:8080
51.159.23.217:443
199.203.62.165:80
74.58.215.226:80
209.236.123.42:8080
220.109.145.69:80
12.162.84.2:8080
181.129.96.162:8080
138.97.60.141:7080
45.161.242.102:80
170.81.48.2:80
185.94.252.27:443
185.94.252.12:80
216.47.196.104:80
187.162.248.237:80
188.135.15.49:80
2.47.112.152:80
192.241.146.84:8080
190.24.243.186:80
70.32.115.157:8080
181.30.61.163:443
61.197.92.216:80
204.225.249.100:7080
191.182.6.118:80
185.178.10.77:80
190.115.18.139:8080
45.16.226.117:443
51.255.165.160:8080
45.46.37.97:80
111.67.12.221:8080
185.183.16.47:80
110.142.219.51:80
77.106.157.34:8080
190.6.193.152:8080
189.2.177.210:443
190.2.31.172:80
185.215.227.107:443
186.70.127.199:8090
212.71.237.140:8080
77.238.212.227:80
64.201.88.132:80
96.245.123.149:80
50.28.51.143:8080
70.32.84.74:8080
190.147.137.153:443
Signatures
-
resource yara_rule behavioral2/memory/4496-4-0x00000000009D0000-0x00000000009E0000-memory.dmp emotet behavioral2/memory/4496-0-0x00000000009B0000-0x00000000009C2000-memory.dmp emotet behavioral2/memory/4496-7-0x00000000009A0000-0x00000000009AF000-memory.dmp emotet behavioral2/memory/4708-14-0x0000000002710000-0x0000000002720000-memory.dmp emotet behavioral2/memory/4708-10-0x00000000026F0000-0x0000000002702000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
pid Process 4708 mstscax.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Windows.Media.Ocr\mstscax.exe 10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe 4708 mstscax.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4496 10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4496 10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe 4496 10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe 4708 mstscax.exe 4708 mstscax.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4708 4496 10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe 85 PID 4496 wrote to memory of 4708 4496 10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe 85 PID 4496 wrote to memory of 4708 4496 10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10ffa05cd9aeefee7af58dea58d3f23a_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\Windows.Media.Ocr\mstscax.exe"C:\Windows\SysWOW64\Windows.Media.Ocr\mstscax.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD510ffa05cd9aeefee7af58dea58d3f23a
SHA1a8922767780addf7b962f3a75eb2b9669348ea3d
SHA2568d153fde5f97c7e52a1f5da66c4546152a067ac36abc0c229fda7f21e08ee709
SHA512969a4e0503a967d147bd29b96e56740c8250aafe6cb00dbd1d61658b6509d3ffd9548d7c427f2cca593a6a74ea1066cfa22c13c4a5be3472c92478e06858b7b1