Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 20:11

General

  • Target

    47d49f04c0fb9e26f1da11b559256f57_JaffaCakes118.exe

  • Size

    672KB

  • MD5

    47d49f04c0fb9e26f1da11b559256f57

  • SHA1

    9e31f80bbabbb2e3b7cd395f1844044fb246864c

  • SHA256

    ae7c22ed0513c605257ed4ad873080a7290ca3f57fe4070faeff66e1f240c303

  • SHA512

    3fb95c3eef1d6aa11628f639c8eb30a7193268b39ef61da69602d45f7a4283f40f9d19c6ca3e4ee9575758167f472c0d6c7a726a5946e592b3ef5c7290403c2e

  • SSDEEP

    6144:PtEkXzqXV4beq+3nzgmF3JhpolOrJ53cEKM5fkLaMiLgLWL7SqaaYo5wzPLNQOIG:PtZb03nzgU3yOrn3t6zEPdAH4c

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

116.91.240.96:80

167.71.227.113:8080

190.85.46.52:7080

162.144.42.60:8080

202.166.170.43:80

95.216.205.155:8080

120.51.34.254:80

103.93.220.182:80

111.89.241.139:80

60.125.114.64:443

45.177.120.37:8080

185.86.148.68:443

75.127.14.170:8080

119.92.77.17:80

203.153.216.178:7080

172.96.190.154:8080

179.5.118.12:80

153.229.219.1:443

139.59.12.63:8080

115.79.195.246:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet payload 5 IoCs

    Detects Emotet payload in memory.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47d49f04c0fb9e26f1da11b559256f57_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\47d49f04c0fb9e26f1da11b559256f57_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3748
    • C:\Windows\SysWOW64\mfmjpegdec\SystemPropertiesAdvanced.exe
      "C:\Windows\SysWOW64\mfmjpegdec\SystemPropertiesAdvanced.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\mfmjpegdec\SystemPropertiesAdvanced.exe

    Filesize

    672KB

    MD5

    47d49f04c0fb9e26f1da11b559256f57

    SHA1

    9e31f80bbabbb2e3b7cd395f1844044fb246864c

    SHA256

    ae7c22ed0513c605257ed4ad873080a7290ca3f57fe4070faeff66e1f240c303

    SHA512

    3fb95c3eef1d6aa11628f639c8eb30a7193268b39ef61da69602d45f7a4283f40f9d19c6ca3e4ee9575758167f472c0d6c7a726a5946e592b3ef5c7290403c2e

  • memory/2396-14-0x0000000002040000-0x0000000002050000-memory.dmp

    Filesize

    64KB

  • memory/2396-10-0x0000000002220000-0x0000000002232000-memory.dmp

    Filesize

    72KB

  • memory/3748-4-0x0000000002300000-0x0000000002310000-memory.dmp

    Filesize

    64KB

  • memory/3748-7-0x00000000022D0000-0x00000000022DF000-memory.dmp

    Filesize

    60KB

  • memory/3748-0-0x00000000022E0000-0x00000000022F2000-memory.dmp

    Filesize

    72KB

  • memory/3748-9-0x0000000000400000-0x00000000004AC000-memory.dmp

    Filesize

    688KB