Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe
-
Size
195KB
-
MD5
5de15f2a06e9fb2727c3a351164a8288
-
SHA1
cdf63bbe5f06e7bd663b59ee9c69c3d51666db12
-
SHA256
cd04dc2e3ab620a174d395f2df44f5d3568762e86f1af9f00e4a27e144b2d975
-
SHA512
3283758e7c22726f123da8adf08ef7f920463fc69f32492c0e11a264b89f45cc49386453d8a9b3c5fcdeee46e4a6e1843c7b6819922d303eda2b3176a33f2042
-
SSDEEP
3072:bkgyzbBp52B0ym2O7kXi42TFI57Z2kgn9UnJcyBaoqBuBhh6U74AZeH4vwt3:b9Ytp52B0Taif+0UnfaoqBihh175Fa
Malware Config
Extracted
emotet
Epoch1
189.173.113.67:443
200.123.101.90:80
170.130.31.177:8080
51.255.165.160:8080
45.56.79.249:443
185.86.148.222:8080
190.4.50.26:80
187.188.166.192:80
94.177.183.28:8080
201.213.32.59:80
76.69.29.42:80
190.96.118.15:443
81.213.215.216:50000
80.85.87.122:8080
186.1.41.111:443
183.82.97.25:80
220.241.38.226:50000
14.160.93.230:80
200.58.83.179:80
138.68.106.4:7080
77.245.101.134:8080
178.79.163.131:8080
200.113.106.18:80
181.16.17.210:443
190.146.131.105:8080
51.15.8.192:8080
45.79.95.107:443
79.127.57.43:80
88.250.223.190:8080
62.75.160.178:8080
46.101.212.195:8080
190.182.161.7:8080
77.55.211.77:8080
217.199.160.224:8080
163.172.40.218:7080
68.183.190.199:8080
212.71.237.140:8080
201.163.74.202:443
201.190.133.235:8080
91.83.93.124:7080
89.188.124.145:443
181.135.153.203:443
46.29.183.211:8080
94.183.71.206:7080
190.79.228.89:443
203.25.159.3:8080
207.154.204.40:8080
68.183.170.114:8080
139.5.237.27:443
62.75.143.100:7080
154.120.227.206:8080
144.139.158.155:80
109.169.86.13:8080
60.52.64.122:80
87.106.77.40:7080
142.93.114.137:8080
42.190.4.92:443
119.59.124.163:8080
82.196.15.205:8080
149.62.173.247:8080
46.28.111.142:7080
79.143.182.254:8080
190.38.14.52:80
81.169.140.14:443
46.41.151.103:8080
111.119.233.65:80
5.196.35.138:7080
69.163.33.84:8080
187.131.128.238:50000
86.42.166.147:80
178.249.187.151:8080
159.203.204.126:8080
41.75.135.93:7080
91.205.215.57:7080
186.23.132.93:990
50.28.51.143:8080
190.97.30.167:990
91.204.163.19:8090
104.131.58.132:8080
190.210.184.138:995
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
techgrp.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat techgrp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
techgrp.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-a7-b3-49-09-f6\WpadDecision = "0" techgrp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 techgrp.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" techgrp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-a7-b3-49-09-f6 techgrp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-a7-b3-49-09-f6\WpadDecisionReason = "1" techgrp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0105000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 techgrp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections techgrp.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" techgrp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings techgrp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 techgrp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-a7-b3-49-09-f6\WpadDecisionTime = f070fa1788aada01 techgrp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings techgrp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad techgrp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3C6DBAA-3E27-41F0-BC06-E85420196CAE}\WpadDecisionReason = "1" techgrp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3C6DBAA-3E27-41F0-BC06-E85420196CAE}\WpadDecision = "0" techgrp.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3C6DBAA-3E27-41F0-BC06-E85420196CAE}\WpadNetworkName = "Network 2" techgrp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3C6DBAA-3E27-41F0-BC06-E85420196CAE}\0a-a7-b3-49-09-f6 techgrp.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix techgrp.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" techgrp.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3C6DBAA-3E27-41F0-BC06-E85420196CAE} techgrp.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C3C6DBAA-3E27-41F0-BC06-E85420196CAE}\WpadDecisionTime = f070fa1788aada01 techgrp.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
techgrp.exepid process 2284 techgrp.exe 2284 techgrp.exe 2284 techgrp.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exepid process 760 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exetechgrp.exedescription pid process target process PID 2156 wrote to memory of 760 2156 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe PID 2156 wrote to memory of 760 2156 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe PID 2156 wrote to memory of 760 2156 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe PID 2156 wrote to memory of 760 2156 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe PID 2444 wrote to memory of 2284 2444 techgrp.exe techgrp.exe PID 2444 wrote to memory of 2284 2444 techgrp.exe techgrp.exe PID 2444 wrote to memory of 2284 2444 techgrp.exe techgrp.exe PID 2444 wrote to memory of 2284 2444 techgrp.exe techgrp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe--125496912⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\techgrp.exe"C:\Windows\SysWOW64\techgrp.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\techgrp.exe--34ce14652⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-18-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2156-0-0x0000000000340000-0x0000000000357000-memory.dmpFilesize
92KB
-
memory/2156-6-0x0000000000320000-0x0000000000331000-memory.dmpFilesize
68KB
-
memory/2156-5-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2284-19-0x00000000004A0000-0x00000000004B7000-memory.dmpFilesize
92KB
-
memory/2284-24-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2444-12-0x00000000003D0000-0x00000000003E7000-memory.dmpFilesize
92KB
-
memory/2444-17-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB