Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 09:49
Static task
static1
Behavioral task
behavioral1
Sample
54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe
-
Size
312KB
-
MD5
54267330bcd69f6767510d1c10572a09
-
SHA1
dcede8210e1bd860e2f0ce87550f0d4f6e708cd7
-
SHA256
39cb7105e4c4346f37e37b8475593d156917615433ff6588009d708d71594c7f
-
SHA512
f9438ddaf67e32f7ae89fa0175a6b9390891b660ce51772894f4f63a03640f64756123929ab5b409ca44df54264048f4978fa7667d4e14b8d44f034c703a968b
-
SSDEEP
6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTstJ:BViYC3aZU53QuIjLKdwGgH
Malware Config
Extracted
emotet
Epoch1
68.187.160.28:443
97.120.32.227:80
187.188.166.192:8080
144.217.117.207:8080
96.126.121.64:443
104.236.137.72:8080
85.234.143.94:8080
68.174.15.223:80
63.246.252.234:80
93.148.252.90:80
74.59.187.94:80
185.160.212.3:80
46.28.111.142:7080
183.99.239.141:80
68.129.203.162:443
144.139.56.105:80
191.183.21.190:80
81.157.234.90:8080
138.68.106.4:7080
203.130.0.69:80
181.36.42.205:443
190.97.30.167:990
94.200.114.162:80
149.62.173.247:8080
188.216.24.204:80
85.152.208.146:80
116.48.138.115:80
50.28.51.143:8080
190.210.184.138:995
83.165.78.227:80
68.183.170.114:8080
186.15.83.52:8080
93.67.154.252:443
74.79.103.55:80
152.170.108.99:443
111.125.71.22:8080
68.183.190.199:8080
93.144.226.57:80
82.8.232.51:80
37.187.6.63:8080
200.58.83.179:80
217.199.160.224:8080
86.42.166.147:80
91.74.175.46:80
97.81.12.153:80
125.99.61.162:7080
207.154.204.40:8080
14.160.93.230:80
87.106.77.40:7080
109.169.86.13:8080
91.205.215.57:7080
82.196.15.205:8080
96.61.113.203:80
181.198.203.45:443
130.204.247.253:80
5.88.27.67:8080
82.36.103.14:80
2.45.112.134:80
190.6.193.152:8080
63.248.198.8:80
51.255.165.160:8080
189.19.81.181:443
186.68.48.204:443
2.44.167.52:80
163.172.40.218:7080
201.213.32.59:80
151.237.36.220:80
77.55.211.77:8080
37.183.121.32:80
112.218.134.227:80
77.27.221.24:443
190.186.164.23:80
175.114.178.83:443
45.50.177.164:80
87.106.46.107:8080
91.204.163.19:8090
188.135.15.49:80
190.195.129.227:8090
159.203.204.126:8080
104.131.58.132:8080
185.86.148.222:8080
46.101.212.195:8080
223.255.148.134:80
79.7.114.1:80
80.11.158.65:8080
190.100.153.162:443
203.25.159.3:8080
2.139.158.136:443
72.29.55.174:80
73.60.8.210:80
37.211.49.127:80
212.71.237.140:8080
5.196.35.138:7080
185.160.229.26:80
91.83.93.124:7080
69.163.33.84:8080
45.8.136.201:80
83.248.141.198:80
200.119.11.118:443
219.75.66.103:80
118.36.70.245:80
192.241.146.84:8080
45.79.95.107:443
116.48.148.32:80
62.75.160.178:8080
142.127.57.63:8080
62.75.143.100:7080
119.59.124.163:8080
181.61.143.177:80
200.124.225.32:80
5.32.41.106:80
37.120.185.153:443
96.38.234.10:80
110.170.65.146:80
190.146.131.105:8080
2.42.173.240:80
191.103.76.34:443
91.117.83.59:80
58.171.38.26:80
178.79.163.131:8080
113.61.76.239:80
99.252.27.6:80
139.162.118.88:8080
165.228.195.93:80
212.237.50.61:8080
142.93.114.137:8080
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
shadestexas.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE shadestexas.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies shadestexas.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 shadestexas.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 shadestexas.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
shadestexas.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix shadestexas.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" shadestexas.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" shadestexas.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
shadestexas.exepid process 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
54267330bcd69f6767510d1c10572a09_JaffaCakes118.exepid process 2756 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe54267330bcd69f6767510d1c10572a09_JaffaCakes118.exeshadestexas.exeshadestexas.exepid process 3400 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe 3400 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe 2756 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe 2756 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe 3796 shadestexas.exe 3796 shadestexas.exe 3852 shadestexas.exe 3852 shadestexas.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
54267330bcd69f6767510d1c10572a09_JaffaCakes118.exeshadestexas.exedescription pid process target process PID 3400 wrote to memory of 2756 3400 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe PID 3400 wrote to memory of 2756 3400 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe PID 3400 wrote to memory of 2756 3400 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe 54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe PID 3796 wrote to memory of 3852 3796 shadestexas.exe shadestexas.exe PID 3796 wrote to memory of 3852 3796 shadestexas.exe shadestexas.exe PID 3796 wrote to memory of 3852 3796 shadestexas.exe shadestexas.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54267330bcd69f6767510d1c10572a09_JaffaCakes118.exe--78ff58252⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\shadestexas.exe"C:\Windows\SysWOW64\shadestexas.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shadestexas.exe--899cfe092⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\4bd2907d2e0afb20e1193e2292377f44_a47c70d8-7adc-4ad7-994f-644a8c84c176Filesize
50B
MD5531d9bc2297289ce9b2144d0e78e77d8
SHA1e69557ab8db39ceea4557d322cab2ce8f4b61888
SHA256b4c777ec60d20aced83997482ad62fa0482734cffa67f4a5bf327f5c15d93ae0
SHA5124bd8bffea131b8b5302ffba45bf651aba71a6235bff78c08b5bad78ebe88794cba13bb6712411764b7c0e821ecca4283862dc8b243eda25f6966c3b6292df636
-
memory/2756-7-0x00000000026E0000-0x00000000026F7000-memory.dmpFilesize
92KB
-
memory/2756-18-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3400-1-0x00000000024E0000-0x00000000024F7000-memory.dmpFilesize
92KB
-
memory/3400-0-0x0000000002390000-0x0000000002391000-memory.dmpFilesize
4KB
-
memory/3400-6-0x00000000023A0000-0x00000000023B1000-memory.dmpFilesize
68KB
-
memory/3796-13-0x0000000000E60000-0x0000000000E77000-memory.dmpFilesize
92KB
-
memory/3852-20-0x0000000000E10000-0x0000000000E27000-memory.dmpFilesize
92KB