Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 07:30
Static task
static1
Behavioral task
behavioral1
Sample
593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
-
Size
267KB
-
MD5
593f33b5ab1a83bfdd8dc1b52c9b4709
-
SHA1
3fbd1b61716acd1f5bc4e8efcf2e30626f58e6f3
-
SHA256
5638332978984303342b0e7f6d86b6d2a0122c166c6184414b75a40c64b96990
-
SHA512
c5a13ac20fb29c192061f72b52b6070f0e9e487b53f34aa7bb6ea673963dfb0d836c1211ce64654584acdad958a7380cf440e893dbcc3cda1815fb09566093d4
-
SSDEEP
6144:RQTvKi6ThBpY+cerayRzcEXOi8oAqUkc0lHZ68GC:RKekkra47X0qUkc0cC
Malware Config
Extracted
emotet
Epoch3
186.84.173.153:80
181.36.42.205:443
190.166.25.99:80
131.0.103.200:8080
78.46.103.90:7080
94.177.253.126:80
120.138.101.250:80
200.55.168.82:20
75.154.163.1:8090
95.216.207.86:7080
190.96.118.15:443
144.76.62.10:8080
212.112.113.235:80
184.82.233.15:80
157.7.164.178:8081
113.52.135.33:7080
176.58.93.123:80
51.38.134.203:8080
190.228.212.165:50000
203.99.188.11:443
181.61.143.177:80
216.70.88.55:8080
181.47.235.26:993
190.113.146.128:8080
216.75.37.196:8080
83.169.33.157:8080
201.196.15.79:990
91.109.5.28:8080
70.32.94.58:8080
186.109.91.136:80
186.146.110.108:8080
181.99.223.250:8080
192.241.220.183:8080
5.189.148.98:8080
190.117.206.153:443
186.92.11.143:8080
203.99.188.203:990
138.197.140.163:8080
190.13.146.47:443
185.45.24.254:7080
143.95.101.72:8080
203.99.182.135:443
201.217.113.58:8080
203.99.187.137:443
178.249.187.150:7080
154.120.227.206:8080
152.170.220.95:80
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
typebchunker.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 typebchunker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE typebchunker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies typebchunker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 typebchunker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
typebchunker.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix typebchunker.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" typebchunker.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" typebchunker.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
typebchunker.exepid process 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exepid process 1916 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exetypebchunker.exetypebchunker.exepid process 220 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe 220 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe 1916 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe 1916 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe 1840 typebchunker.exe 1840 typebchunker.exe 4216 typebchunker.exe 4216 typebchunker.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exetypebchunker.exedescription pid process target process PID 220 wrote to memory of 1916 220 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe PID 220 wrote to memory of 1916 220 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe PID 220 wrote to memory of 1916 220 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe 593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe PID 1840 wrote to memory of 4216 1840 typebchunker.exe typebchunker.exe PID 1840 wrote to memory of 4216 1840 typebchunker.exe typebchunker.exe PID 1840 wrote to memory of 4216 1840 typebchunker.exe typebchunker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe--a5f914b92⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1916
-
C:\Windows\SysWOW64\typebchunker.exe"C:\Windows\SysWOW64\typebchunker.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\typebchunker.exe--64611ee42⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4216