Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 07:56

General

  • Target

    668d1d7c39af8906ed862ae9ff645a63_JaffaCakes118.exe

  • Size

    187KB

  • MD5

    668d1d7c39af8906ed862ae9ff645a63

  • SHA1

    35644070d27bde9f87a5552becc4b18d017d9faf

  • SHA256

    a1a6a9070efc72cd197cb8d27342f0cd6ba8f15e706b308f164fcafd6f561258

  • SHA512

    b5f0ad76de4110445fb978c13c9d1c76676ff541f5d0721b2303765c44ac5bb2037e92914e5d0dae8c7dc16c8fe5bb376e17e3e039df6383d7a9374472b13a2e

  • SSDEEP

    3072:2D8qMHPIFIhK2kwVP5YdShdXlkkaK/PngcfS3CYo7RWa5A+:2DhMHPThK2x5WSXl6K/lS3CdY

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\668d1d7c39af8906ed862ae9ff645a63_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\668d1d7c39af8906ed862ae9ff645a63_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Users\Admin\AppData\Local\Temp\668d1d7c39af8906ed862ae9ff645a63_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\668d1d7c39af8906ed862ae9ff645a63_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:4664
  • C:\Windows\SysWOW64\swimcrash.exe
    "C:\Windows\SysWOW64\swimcrash.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\SysWOW64\swimcrash.exe
      "C:\Windows\SysWOW64\swimcrash.exe"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:3732
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1980

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2896-15-0x00000000014F0000-0x00000000014FD000-memory.dmp

      Filesize

      52KB

    • memory/2896-29-0x00000000014F0000-0x00000000014FD000-memory.dmp

      Filesize

      52KB

    • memory/2896-16-0x0000000001620000-0x000000000162D000-memory.dmp

      Filesize

      52KB

    • memory/2896-21-0x0000000001630000-0x0000000001640000-memory.dmp

      Filesize

      64KB

    • memory/2896-20-0x0000000001620000-0x000000000162D000-memory.dmp

      Filesize

      52KB

    • memory/3732-28-0x0000000000660000-0x0000000000670000-memory.dmp

      Filesize

      64KB

    • memory/3732-22-0x00000000005A0000-0x00000000005AD000-memory.dmp

      Filesize

      52KB

    • memory/3732-32-0x00000000005A0000-0x00000000005AD000-memory.dmp

      Filesize

      52KB

    • memory/3732-23-0x0000000000640000-0x000000000064D000-memory.dmp

      Filesize

      52KB

    • memory/3732-27-0x0000000000640000-0x000000000064D000-memory.dmp

      Filesize

      52KB

    • memory/4176-0-0x0000000002320000-0x000000000232D000-memory.dmp

      Filesize

      52KB

    • memory/4176-6-0x0000000002460000-0x0000000002470000-memory.dmp

      Filesize

      64KB

    • memory/4176-1-0x0000000002450000-0x000000000245D000-memory.dmp

      Filesize

      52KB

    • memory/4176-14-0x0000000002320000-0x000000000232D000-memory.dmp

      Filesize

      52KB

    • memory/4176-5-0x0000000002450000-0x000000000245D000-memory.dmp

      Filesize

      52KB

    • memory/4664-7-0x0000000002DD0000-0x0000000002DDD000-memory.dmp

      Filesize

      52KB

    • memory/4664-12-0x0000000002E00000-0x0000000002E0D000-memory.dmp

      Filesize

      52KB

    • memory/4664-8-0x0000000002E00000-0x0000000002E0D000-memory.dmp

      Filesize

      52KB

    • memory/4664-31-0x0000000002DD0000-0x0000000002DDD000-memory.dmp

      Filesize

      52KB

    • memory/4664-30-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/4664-13-0x0000000002E10000-0x0000000002E20000-memory.dmp

      Filesize

      64KB