Resubmissions

08/05/2024, 15:06

240508-sg11pace89 10

08/05/2024, 15:02

240508-sehfkacd88 10

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 15:02

General

  • Target

    2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe

  • Size

    232KB

  • MD5

    2564da359d80d04c9694514158ede3b2

  • SHA1

    2530df461e454959891ea806c3ff15b6bf51d4ca

  • SHA256

    45d879c2e5a55a5c9ac2da5e937e1b531a60ca5a863c44201e4be276ef593619

  • SHA512

    d337278b7adf8d856b45d3f185dce95ed452595760368a579fd7e2e0a19e4fe37e04d4f301cc1050a2861f5a2b969144f6bdfeebf71ef1f5d6c37ecd73dd0cb6

  • SSDEEP

    1536:KsNolkagL6YpgXBx7wJc68fN6Q+H2Ar5q2lM/xSr9uHObV:7olkP+ZxcJrH2A9DlmSmOJ

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Windows\SysWOW64\tablepack.exe
      "C:\Windows\SysWOW64\tablepack.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:228

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/228-13-0x0000000002C70000-0x0000000002C7F000-memory.dmp

          Filesize

          60KB

        • memory/228-9-0x0000000002C70000-0x0000000002C7F000-memory.dmp

          Filesize

          60KB

        • memory/228-14-0x0000000002C60000-0x0000000002C6F000-memory.dmp

          Filesize

          60KB

        • memory/228-15-0x0000000002C80000-0x0000000002C90000-memory.dmp

          Filesize

          64KB

        • memory/228-16-0x0000000002C60000-0x0000000002C6F000-memory.dmp

          Filesize

          60KB

        • memory/2096-6-0x0000000000E40000-0x0000000000E50000-memory.dmp

          Filesize

          64KB

        • memory/2096-5-0x0000000000E20000-0x0000000000E2F000-memory.dmp

          Filesize

          60KB

        • memory/2096-4-0x0000000000E30000-0x0000000000E3F000-memory.dmp

          Filesize

          60KB

        • memory/2096-0-0x0000000000E30000-0x0000000000E3F000-memory.dmp

          Filesize

          60KB

        • memory/2096-8-0x0000000000E20000-0x0000000000E2F000-memory.dmp

          Filesize

          60KB

        • memory/2096-7-0x0000000000600000-0x000000000063A000-memory.dmp

          Filesize

          232KB