Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 21:38
Static task
static1
Behavioral task
behavioral1
Sample
64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe
-
Size
228KB
-
MD5
64d9acbff6273f7442edac49f9eec054
-
SHA1
7694e133c4f47a597544a8419c4ce88218841d72
-
SHA256
7271b9b7dbcd1b2b17f7662d65b2fec44cfb378ef43fd8a03fccd7fb463fbe87
-
SHA512
55797d8012613e282f6630d931d47572c24680fc70144e98d662f14a5a772eb73b46acb5badd567b8cb1866b8f6101575fd8a3d9301bb495897319091fd3c2c6
-
SSDEEP
6144:kyj2MoeAfMzd+PUnXmCcWGJPV0z+bbDH0COUj8:1joeAfMVQP5bbbY
Malware Config
Extracted
emotet
Epoch2
45.33.54.74:443
209.141.41.136:8080
104.236.246.93:8080
198.199.114.69:8080
152.89.236.214:8080
87.106.136.232:8080
178.210.51.222:8080
115.78.95.230:443
201.251.43.69:8080
200.51.94.251:80
31.172.240.91:8080
182.176.132.213:8090
45.33.49.124:443
181.143.53.227:21
186.4.172.5:443
85.104.59.244:20
5.196.74.210:8080
37.157.194.134:443
190.226.44.20:21
86.98.25.30:53
94.177.216.217:8080
104.131.11.150:8080
186.4.172.5:20
189.209.217.49:80
80.11.163.139:21
185.94.252.13:443
67.225.229.55:8080
86.22.221.170:80
92.222.216.44:8080
83.136.245.190:8080
31.12.67.62:7080
200.113.106.18:465
46.105.131.87:80
80.11.163.139:443
206.189.98.125:8080
78.24.219.147:8080
167.71.10.37:8080
200.113.106.18:21
212.71.234.16:8080
190.211.207.11:443
217.160.182.191:8080
169.239.182.217:8080
144.139.247.220:80
190.145.67.134:8090
182.76.6.2:8080
91.205.215.66:8080
162.241.208.52:8080
186.4.172.5:8080
85.54.169.141:8080
186.75.241.230:80
136.243.177.26:8080
133.167.80.63:7080
27.147.163.188:8080
178.79.161.166:443
59.103.164.174:80
159.65.25.128:8080
181.143.194.138:443
95.128.43.213:8080
211.63.71.72:8080
104.131.44.150:8080
103.39.131.88:80
94.205.247.10:80
87.106.139.101:8080
62.75.187.192:8080
190.53.135.159:21
138.201.140.110:8080
47.41.213.2:22
200.71.148.138:8080
149.202.153.252:8080
185.187.198.15:80
190.228.72.244:53
124.240.198.66:80
87.230.19.21:8080
92.233.128.13:143
192.81.213.192:8080
69.164.201.54:8080
173.212.203.26:8080
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
dialogbinder.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE dialogbinder.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies dialogbinder.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 dialogbinder.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 dialogbinder.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
dialogbinder.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dialogbinder.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dialogbinder.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dialogbinder.exe -
Modifies registry class 36 IoCs
Processes:
dialogbinder.exe64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exedialogbinder.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\ = "mfccalc.calculator" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" dialogbinder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID dialogbinder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 dialogbinder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Windows\\SysWOW64\\DIALOG~1.EXE" dialogbinder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\64D9AC~1.EXE" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID dialogbinder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ProgID\ = "mfccalc.calculator" dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 dialogbinder.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7} 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\64D9AC~1.EXE" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32\ = "C:\\Windows\\SysWOW64\\DIALOG~1.EXE" dialogbinder.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\ = "mfccalc.calculator" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mfccalc.calculator\CLSID\ = "{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}" 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\LocalServer32 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62C4DD10-F45E-11CD-8C3D-00AA004BB3B7}\InprocHandler32\ = "ole32.dll" dialogbinder.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
dialogbinder.exepid process 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exepid process 744 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exedialogbinder.exedialogbinder.exepid process 2700 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe 2700 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe 744 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe 744 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe 2332 dialogbinder.exe 2332 dialogbinder.exe 4492 dialogbinder.exe 4492 dialogbinder.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exedialogbinder.exedescription pid process target process PID 2700 wrote to memory of 744 2700 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe PID 2700 wrote to memory of 744 2700 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe PID 2700 wrote to memory of 744 2700 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe 64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe PID 2332 wrote to memory of 4492 2332 dialogbinder.exe dialogbinder.exe PID 2332 wrote to memory of 4492 2332 dialogbinder.exe dialogbinder.exe PID 2332 wrote to memory of 4492 2332 dialogbinder.exe dialogbinder.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\64d9acbff6273f7442edac49f9eec054_JaffaCakes118.exe--9287190d2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dialogbinder.exe"C:\Windows\SysWOW64\dialogbinder.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialogbinder.exe--bc3583e42⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\4bd2907d2e0afb20e1193e2292377f44_a47c70d8-7adc-4ad7-994f-644a8c84c176Filesize
50B
MD5531d9bc2297289ce9b2144d0e78e77d8
SHA1e69557ab8db39ceea4557d322cab2ce8f4b61888
SHA256b4c777ec60d20aced83997482ad62fa0482734cffa67f4a5bf327f5c15d93ae0
SHA5124bd8bffea131b8b5302ffba45bf651aba71a6235bff78c08b5bad78ebe88794cba13bb6712411764b7c0e821ecca4283862dc8b243eda25f6966c3b6292df636
-
memory/744-8-0x0000000002110000-0x0000000002124000-memory.dmpFilesize
80KB
-
memory/744-23-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2332-12-0x0000000000E10000-0x0000000000E24000-memory.dmpFilesize
80KB
-
memory/2700-0-0x0000000002120000-0x0000000002134000-memory.dmpFilesize
80KB
-
memory/2700-5-0x0000000002110000-0x000000000211F000-memory.dmpFilesize
60KB
-
memory/4492-18-0x0000000000E40000-0x0000000000E54000-memory.dmpFilesize
80KB