Resubmissions

08/05/2024, 15:06

240508-sg11pace89 10

08/05/2024, 15:02

240508-sehfkacd88 10

Analysis

  • max time kernel
    139s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 15:06

General

  • Target

    2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe

  • Size

    232KB

  • MD5

    2564da359d80d04c9694514158ede3b2

  • SHA1

    2530df461e454959891ea806c3ff15b6bf51d4ca

  • SHA256

    45d879c2e5a55a5c9ac2da5e937e1b531a60ca5a863c44201e4be276ef593619

  • SHA512

    d337278b7adf8d856b45d3f185dce95ed452595760368a579fd7e2e0a19e4fe37e04d4f301cc1050a2861f5a2b969144f6bdfeebf71ef1f5d6c37ecd73dd0cb6

  • SSDEEP

    1536:KsNolkagL6YpgXBx7wJc68fN6Q+H2Ar5q2lM/xSr9uHObV:7olkP+ZxcJrH2A9DlmSmOJ

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2564da359d80d04c9694514158ede3b2_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Windows\SysWOW64\jitmdmaus.exe
      "C:\Windows\SysWOW64\jitmdmaus.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3020

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1888-6-0x00000000000C0000-0x00000000000D0000-memory.dmp

          Filesize

          64KB

        • memory/1888-5-0x00000000000A0000-0x00000000000AF000-memory.dmp

          Filesize

          60KB

        • memory/1888-4-0x00000000000B0000-0x00000000000BF000-memory.dmp

          Filesize

          60KB

        • memory/1888-0-0x00000000000B0000-0x00000000000BF000-memory.dmp

          Filesize

          60KB

        • memory/1888-8-0x00000000000A0000-0x00000000000AF000-memory.dmp

          Filesize

          60KB

        • memory/1888-7-0x0000000000E30000-0x0000000000E6A000-memory.dmp

          Filesize

          232KB

        • memory/3020-9-0x0000000000180000-0x000000000018F000-memory.dmp

          Filesize

          60KB

        • memory/3020-14-0x00000000001D0000-0x00000000001DF000-memory.dmp

          Filesize

          60KB

        • memory/3020-10-0x00000000001D0000-0x00000000001DF000-memory.dmp

          Filesize

          60KB

        • memory/3020-15-0x00000000001E0000-0x00000000001F0000-memory.dmp

          Filesize

          64KB

        • memory/3020-16-0x0000000000180000-0x000000000018F000-memory.dmp

          Filesize

          60KB