Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 11:56
Static task
static1
Behavioral task
behavioral1
Sample
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe
-
Size
600KB
-
MD5
672e7bfd74c6bfcae7a45b3eef091a89
-
SHA1
f15a1f1265fa4b2f73620cf4b1c0fbe68756a94f
-
SHA256
d0ce7284573bd0b16c06d34bdfcd6c1960738c0e8e39a6327c178523ce412f44
-
SHA512
ef6551a467da3e1b0d122cb393ce6bad21c25c88507585d0671ec5fde1d0f306317a3c59bde617f11c24c594da1f505ad31fc167ef79403c9c333e77ae8552e6
-
SSDEEP
12288:wmjIjUK9OJBC+DHRny6vi98eiSdaQCDQM0mnLpMoMwTkf:HnTp96da0MxpM5f
Malware Config
Extracted
emotet
Epoch2
201.184.105.242:443
24.45.195.162:7080
24.45.195.162:8443
94.192.225.46:80
80.11.163.139:443
133.167.80.63:7080
198.199.114.69:8080
80.79.23.144:443
192.254.173.31:8080
67.225.229.55:8080
190.108.228.48:990
62.75.187.192:8080
185.94.252.13:443
94.205.247.10:80
211.63.71.72:8080
59.103.164.174:80
192.81.213.192:8080
27.4.80.183:443
190.145.67.134:8090
115.78.95.230:443
104.131.11.150:8080
95.128.43.213:8080
212.71.234.16:8080
178.254.6.27:7080
86.98.25.30:53
91.205.215.66:8080
188.166.253.46:8080
80.11.163.139:21
186.75.241.230:80
190.106.97.230:443
78.24.219.147:8080
217.160.182.191:8080
173.212.203.26:8080
92.222.216.44:8080
136.243.177.26:8080
37.157.194.134:443
190.211.207.11:443
104.236.246.93:8080
190.18.146.70:80
103.255.150.84:80
138.201.140.110:8080
41.220.119.246:80
200.71.148.138:8080
85.54.169.141:8080
144.139.247.220:80
149.202.153.252:8080
31.172.240.91:8080
186.4.172.5:443
178.79.161.166:443
186.4.172.5:8080
206.189.98.125:8080
87.106.139.101:8080
46.105.131.87:80
45.123.3.54:443
222.214.218.192:8080
85.106.1.166:50000
83.136.245.190:8080
179.32.19.219:22
152.89.236.214:8080
181.31.213.158:8080
87.106.136.232:8080
47.41.213.2:22
201.251.43.69:8080
24.51.106.145:21
87.230.19.21:8080
190.228.72.244:53
181.143.194.138:443
182.176.106.43:995
31.12.67.62:7080
182.76.6.2:8080
190.226.44.20:21
181.143.53.227:21
189.209.217.49:80
190.186.203.55:80
27.147.163.188:8080
159.65.25.128:8080
101.187.237.217:20
182.176.132.213:8090
199.19.237.192:80
124.240.198.66:80
5.196.74.210:8080
190.53.135.159:21
186.4.172.5:20
45.33.49.124:443
92.233.128.13:143
85.104.59.244:20
169.239.182.217:8080
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
definecpls.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 definecpls.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE definecpls.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies definecpls.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 definecpls.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 13 IoCs
Processes:
definecpls.exedefinecpls.exesplwow64.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany\Drawcli Application\Recent File List definecpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany\Drawcli Application\Settings definecpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany\Drawcli Application\Settings definecpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\splwow64.exe splwow64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\splwow64.exe\JScriptSetScriptStateStarted = "240614328" splwow64.exe Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany definecpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany\Drawcli Application\Recent File List definecpls.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix definecpls.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" definecpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany definecpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany\Drawcli Application definecpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\YourCompany\Drawcli Application definecpls.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" definecpls.exe -
Modifies registry class 64 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exedefinecpls.exedefinecpls.exe672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command\ = "C:\\Windows\\SysWOW64\\DEFINE~1.EXE /dde" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon\ = "C:\\Windows\\SysWOW64\\DEFINE~1.EXE,0" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE,0" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.drw 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon\ = "C:\\Windows\\SysWOW64\\DEFINE~1.EXE,0" definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.drw\ = "Drawcl.Document" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.drw\ShellNew 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command\ = "C:\\Windows\\SysWOW64\\DEFINE~1.EXE /dde" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.drw\ShellNew\NullFile 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command\ = "C:\\Windows\\SysWOW64\\DEFINE~1.EXE /dde" definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command\ = "C:\\Windows\\SysWOW64\\DEFINE~1.EXE /dde" definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command definecpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command\ = "C:\\Windows\\SysWOW64\\DEFINE~1.EXE /dde" definecpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
definecpls.exepid process 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exepid process 1532 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exedefinecpls.exedefinecpls.exepid process 1568 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 1568 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 1532 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe 1532 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe 5056 definecpls.exe 5056 definecpls.exe 2032 definecpls.exe 2032 definecpls.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exedefinecpls.exedescription pid process target process PID 1568 wrote to memory of 2024 1568 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe splwow64.exe PID 1568 wrote to memory of 2024 1568 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe splwow64.exe PID 1568 wrote to memory of 1532 1568 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe PID 1568 wrote to memory of 1532 1568 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe PID 1568 wrote to memory of 1532 1568 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe PID 5056 wrote to memory of 3044 5056 definecpls.exe splwow64.exe PID 5056 wrote to memory of 3044 5056 definecpls.exe splwow64.exe PID 5056 wrote to memory of 2032 5056 definecpls.exe definecpls.exe PID 5056 wrote to memory of 2032 5056 definecpls.exe definecpls.exe PID 5056 wrote to memory of 2032 5056 definecpls.exe definecpls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe--b5ca9b7a2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\SysWOW64\definecpls.exe"C:\Windows\SysWOW64\definecpls.exe"1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 163842⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\definecpls.exe--9a2ce9e12⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1532-5-0x0000000002770000-0x0000000002784000-memory.dmpFilesize
80KB
-
memory/1532-15-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/1568-0-0x0000000002790000-0x00000000027A4000-memory.dmpFilesize
80KB
-
memory/2032-16-0x0000000000EA0000-0x0000000000EB4000-memory.dmpFilesize
80KB
-
memory/5056-10-0x0000000000F30000-0x0000000000F44000-memory.dmpFilesize
80KB