Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 23:24

General

  • Target

    273291567a770579ce3dc6917e1b4402_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    273291567a770579ce3dc6917e1b4402

  • SHA1

    46a9e2139d2021b2ca68c84fe53a7f798f9b0bc7

  • SHA256

    a12e6a57bafb85c0d8eeb15d71697b09be4a0222ed897fc05b573d57a2593ac2

  • SHA512

    1b966a4ca2103656e1a736ec0629f90364c68f66b3b13b0ff04f7b5ea8d3026c5fe3106113b8ad638335771d019ccc690d420b23a23bc867a86f9d808870e31b

  • SSDEEP

    3072:MJiOVZaic4INE9+j8ocr2i+hF3ijB4QMr3:MJtVZ1cJGIj8YMB4F

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\273291567a770579ce3dc6917e1b4402_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\273291567a770579ce3dc6917e1b4402_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Temp\273291567a770579ce3dc6917e1b4402_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\273291567a770579ce3dc6917e1b4402_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:1520
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3124,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    1⤵
      PID:4804
    • C:\Windows\SysWOW64\dasmrctuip.exe
      "C:\Windows\SysWOW64\dasmrctuip.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Windows\SysWOW64\dasmrctuip.exe
        "C:\Windows\SysWOW64\dasmrctuip.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2012

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1520-25-0x0000000000480000-0x00000000004A5000-memory.dmp

            Filesize

            148KB

          • memory/1520-6-0x0000000000740000-0x000000000075A000-memory.dmp

            Filesize

            104KB

          • memory/1520-11-0x0000000000880000-0x0000000000898000-memory.dmp

            Filesize

            96KB

          • memory/1520-10-0x0000000000720000-0x000000000073A000-memory.dmp

            Filesize

            104KB

          • memory/1520-26-0x0000000000720000-0x000000000073A000-memory.dmp

            Filesize

            104KB

          • memory/2012-27-0x0000000001410000-0x000000000142A000-memory.dmp

            Filesize

            104KB

          • memory/2012-18-0x0000000001890000-0x00000000018AA000-memory.dmp

            Filesize

            104KB

          • memory/2012-23-0x00000000018B0000-0x00000000018C8000-memory.dmp

            Filesize

            96KB

          • memory/2012-22-0x0000000001410000-0x000000000142A000-memory.dmp

            Filesize

            104KB

          • memory/2420-5-0x0000000001670000-0x0000000001688000-memory.dmp

            Filesize

            96KB

          • memory/2420-4-0x0000000001630000-0x000000000164A000-memory.dmp

            Filesize

            104KB

          • memory/2420-0-0x0000000001650000-0x000000000166A000-memory.dmp

            Filesize

            104KB

          • memory/4924-16-0x0000000000E70000-0x0000000000E8A000-memory.dmp

            Filesize

            104KB

          • memory/4924-24-0x0000000000E70000-0x0000000000E8A000-memory.dmp

            Filesize

            104KB

          • memory/4924-17-0x00000000011B0000-0x00000000011C8000-memory.dmp

            Filesize

            96KB

          • memory/4924-12-0x0000000000E90000-0x0000000000EAA000-memory.dmp

            Filesize

            104KB