Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe
-
Size
195KB
-
MD5
5de15f2a06e9fb2727c3a351164a8288
-
SHA1
cdf63bbe5f06e7bd663b59ee9c69c3d51666db12
-
SHA256
cd04dc2e3ab620a174d395f2df44f5d3568762e86f1af9f00e4a27e144b2d975
-
SHA512
3283758e7c22726f123da8adf08ef7f920463fc69f32492c0e11a264b89f45cc49386453d8a9b3c5fcdeee46e4a6e1843c7b6819922d303eda2b3176a33f2042
-
SSDEEP
3072:bkgyzbBp52B0ym2O7kXi42TFI57Z2kgn9UnJcyBaoqBuBhh6U74AZeH4vwt3:b9Ytp52B0Taif+0UnfaoqBihh175Fa
Malware Config
Extracted
emotet
Epoch1
189.173.113.67:443
200.123.101.90:80
170.130.31.177:8080
51.255.165.160:8080
45.56.79.249:443
185.86.148.222:8080
190.4.50.26:80
187.188.166.192:80
94.177.183.28:8080
201.213.32.59:80
76.69.29.42:80
190.96.118.15:443
81.213.215.216:50000
80.85.87.122:8080
186.1.41.111:443
183.82.97.25:80
220.241.38.226:50000
14.160.93.230:80
200.58.83.179:80
138.68.106.4:7080
77.245.101.134:8080
178.79.163.131:8080
200.113.106.18:80
181.16.17.210:443
190.146.131.105:8080
51.15.8.192:8080
45.79.95.107:443
79.127.57.43:80
88.250.223.190:8080
62.75.160.178:8080
46.101.212.195:8080
190.182.161.7:8080
77.55.211.77:8080
217.199.160.224:8080
163.172.40.218:7080
68.183.190.199:8080
212.71.237.140:8080
201.163.74.202:443
201.190.133.235:8080
91.83.93.124:7080
89.188.124.145:443
181.135.153.203:443
46.29.183.211:8080
94.183.71.206:7080
190.79.228.89:443
203.25.159.3:8080
207.154.204.40:8080
68.183.170.114:8080
139.5.237.27:443
62.75.143.100:7080
154.120.227.206:8080
144.139.158.155:80
109.169.86.13:8080
60.52.64.122:80
87.106.77.40:7080
142.93.114.137:8080
42.190.4.92:443
119.59.124.163:8080
82.196.15.205:8080
149.62.173.247:8080
46.28.111.142:7080
79.143.182.254:8080
190.38.14.52:80
81.169.140.14:443
46.41.151.103:8080
111.119.233.65:80
5.196.35.138:7080
69.163.33.84:8080
187.131.128.238:50000
86.42.166.147:80
178.249.187.151:8080
159.203.204.126:8080
41.75.135.93:7080
91.205.215.57:7080
186.23.132.93:990
50.28.51.143:8080
190.97.30.167:990
91.204.163.19:8090
104.131.58.132:8080
190.210.184.138:995
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
changesnav.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE changesnav.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies changesnav.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 changesnav.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 changesnav.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
changesnav.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix changesnav.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" changesnav.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" changesnav.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
changesnav.exepid process 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe 3844 changesnav.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exepid process 1980 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exechangesnav.exedescription pid process target process PID 4536 wrote to memory of 1980 4536 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe PID 4536 wrote to memory of 1980 4536 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe PID 4536 wrote to memory of 1980 4536 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe 5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe PID 316 wrote to memory of 3844 316 changesnav.exe changesnav.exe PID 316 wrote to memory of 3844 316 changesnav.exe changesnav.exe PID 316 wrote to memory of 3844 316 changesnav.exe changesnav.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5de15f2a06e9fb2727c3a351164a8288_JaffaCakes118.exe--125496912⤵
- Suspicious behavior: RenamesItself
PID:1980
-
C:\Windows\SysWOW64\changesnav.exe"C:\Windows\SysWOW64\changesnav.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\changesnav.exe--cffa21f22⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\5847f796e40b24ab4b196e9bf5777c79_5a32ead2-14a8-4b34-b6a3-85cfb28e2fbdFilesize
50B
MD5c14842e691d2aa61b9d595e1be388f4d
SHA1f7c1944b8c0d66b7e946fa9f203d6c2e8ff40725
SHA256e4727b1d8ab8799bf1b4bb1e93e89482f1a6a6a890d8ef894c1b966168422de9
SHA5122c9406f1c18d6518bc7c6f59e5f6cdc284e4858ccdc3c47bcbe56c43e16977305bb2c21b4e0ec43a072429bfb66a20af342b6197b678f606f61a6f779c6ccce6
-
memory/316-13-0x00000000007F0000-0x0000000000807000-memory.dmpFilesize
92KB
-
memory/316-18-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1980-7-0x00000000006E0000-0x00000000006F7000-memory.dmpFilesize
92KB
-
memory/1980-19-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3844-21-0x0000000000CC0000-0x0000000000CD7000-memory.dmpFilesize
92KB
-
memory/3844-26-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4536-0-0x0000000000710000-0x0000000000727000-memory.dmpFilesize
92KB
-
memory/4536-5-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/4536-6-0x00000000006F0000-0x0000000000701000-memory.dmpFilesize
68KB