Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe
-
Size
667KB
-
MD5
48f67e54053fa5a431a7ecd24458046e
-
SHA1
1b50736608ffc38f07a54e3e1083c902084b5c7b
-
SHA256
186afa3ee664e5b40795615e4b430d53e08249578b7f7018c1bca606c10f88fb
-
SHA512
528097e6f3ca336abc12703ed808ef84163651fd6de4bf956245fc7b20ae859bd545787f885cdf0c9f6b7b7fe2e1937425494bcb91a567d22cbe52f7a17484e7
-
SSDEEP
12288:U2JhG//t8C5VCFSoDpaQlHfl6mCiWDaBMFCioCGsq:U2JC/t8iVNoDgQVN6mCiptLX
Malware Config
Extracted
emotet
Epoch3
116.91.240.96:80
167.71.227.113:8080
190.85.46.52:7080
162.144.42.60:8080
202.166.170.43:80
95.216.205.155:8080
120.51.34.254:80
103.93.220.182:80
111.89.241.139:80
60.125.114.64:443
45.177.120.37:8080
185.86.148.68:443
75.127.14.170:8080
119.92.77.17:80
203.153.216.178:7080
172.96.190.154:8080
179.5.118.12:80
153.229.219.1:443
139.59.12.63:8080
115.79.195.246:80
103.229.73.17:8080
195.201.56.70:8080
190.192.39.136:80
183.77.227.38:80
45.239.204.100:80
192.163.221.191:8080
46.32.229.152:8080
73.55.128.120:80
113.203.238.130:80
138.201.45.2:8080
180.148.4.130:8080
77.74.78.80:443
115.79.59.157:80
91.83.93.103:443
181.80.129.181:80
41.185.29.128:8080
178.33.167.120:8080
185.208.226.142:8080
91.75.75.46:80
86.57.216.23:80
143.95.101.72:8080
118.33.121.37:80
116.202.10.123:8080
103.80.51.61:8080
54.38.143.245:8080
50.116.78.109:8080
128.106.187.110:80
139.59.61.215:443
190.191.171.72:80
58.27.215.3:8080
223.17.215.76:80
37.205.9.252:7080
37.46.129.215:8080
46.105.131.68:8080
192.241.220.183:8080
24.231.51.190:80
113.161.148.81:80
109.206.139.119:80
118.243.83.70:80
185.142.236.163:443
172.105.78.244:8080
185.80.172.199:80
190.194.12.132:80
36.91.44.183:80
200.116.93.61:80
192.210.217.94:8080
93.20.157.143:80
198.57.203.63:8080
78.186.65.230:80
175.103.38.146:80
115.135.158.13:80
113.160.248.110:80
88.247.58.26:80
157.7.164.178:8081
67.121.104.51:20
74.208.173.91:8080
113.156.82.32:80
51.38.201.19:7080
14.241.182.160:80
79.133.6.236:8080
169.1.211.133:80
202.153.220.157:80
8.4.9.137:8080
220.106.127.191:443
5.79.70.250:8080
37.187.100.220:7080
113.193.239.51:443
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4336-7-0x00000000005D0000-0x00000000005DF000-memory.dmp emotet behavioral2/memory/4336-4-0x0000000000660000-0x0000000000670000-memory.dmp emotet behavioral2/memory/4336-0-0x0000000000640000-0x0000000000652000-memory.dmp emotet behavioral2/memory/4736-14-0x0000000000520000-0x0000000000530000-memory.dmp emotet behavioral2/memory/4736-10-0x0000000002030000-0x0000000002042000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
Processes:
LocationFrameworkInternalPS.exepid process 4736 LocationFrameworkInternalPS.exe -
Drops file in System32 directory 1 IoCs
Processes:
48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wmdrmsdk\LocationFrameworkInternalPS.exe 48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
LocationFrameworkInternalPS.exepid process 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe 4736 LocationFrameworkInternalPS.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exepid process 4336 48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exedescription pid process target process PID 4336 wrote to memory of 4736 4336 48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe LocationFrameworkInternalPS.exe PID 4336 wrote to memory of 4736 4336 48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe LocationFrameworkInternalPS.exe PID 4336 wrote to memory of 4736 4336 48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe LocationFrameworkInternalPS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\48f67e54053fa5a431a7ecd24458046e_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\wmdrmsdk\LocationFrameworkInternalPS.exe"C:\Windows\SysWOW64\wmdrmsdk\LocationFrameworkInternalPS.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4736
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1284,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:81⤵PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
667KB
MD548f67e54053fa5a431a7ecd24458046e
SHA11b50736608ffc38f07a54e3e1083c902084b5c7b
SHA256186afa3ee664e5b40795615e4b430d53e08249578b7f7018c1bca606c10f88fb
SHA512528097e6f3ca336abc12703ed808ef84163651fd6de4bf956245fc7b20ae859bd545787f885cdf0c9f6b7b7fe2e1937425494bcb91a567d22cbe52f7a17484e7