Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe
-
Size
368KB
-
MD5
728689e0227a9d06c06764ee6e51d6ee
-
SHA1
07f06518365724eb2c675b919b12b362668d1103
-
SHA256
b41e065f5cc030b6ef06ce8c42f4ac1f4cfcc2b059cce602f81e9f0872371542
-
SHA512
0335a9eaf63d5e1d3dea3369a3bc04da25ba9b06f391ee424f6638ec95cda66e0092e574d8fbf5e197516bb72b6ef9ea11ead11feb0ec6605b1c510cb834b80d
-
SSDEEP
6144:8pNhFtYtpGQddLK3FGpMhRWYzyZfaDBZtMXYtJ02TjL+e9k9R:CN6GQdoFM2Jy2nXLt9k3
Malware Config
Extracted
emotet
Epoch3
190.38.252.45:443
105.225.77.21:80
181.167.35.84:80
164.68.115.146:8080
5.189.148.98:8080
46.105.128.215:8080
69.30.205.162:7080
190.161.67.63:80
81.82.247.216:80
72.69.99.47:80
172.90.70.168:443
91.117.31.181:80
200.71.112.158:53
51.77.113.97:8080
190.101.87.170:80
96.234.38.186:8080
190.146.14.143:443
86.70.224.211:80
88.247.26.78:80
175.103.239.50:80
187.233.220.93:443
85.235.219.74:80
87.9.181.247:80
162.144.46.90:8080
58.185.224.18:80
37.59.24.25:8080
138.197.140.163:8080
124.150.175.129:8080
82.79.244.92:80
91.117.131.122:80
185.244.167.25:443
77.245.12.212:80
220.78.29.88:80
95.255.140.89:443
124.150.175.133:80
95.216.207.86:7080
113.52.135.33:7080
177.103.240.93:80
201.196.15.79:990
192.161.190.171:8080
153.190.41.185:80
217.181.139.237:443
110.142.161.90:80
95.9.217.200:8080
189.61.200.9:443
176.58.93.123:80
128.92.54.20:80
195.250.143.182:80
181.46.176.38:80
181.47.235.26:993
192.210.217.94:8080
210.224.65.117:80
139.59.12.63:8080
203.153.216.178:7080
98.15.140.226:80
41.77.74.214:443
50.116.78.109:8080
58.93.151.148:80
78.187.204.70:80
165.100.148.200:443
210.111.160.220:80
59.158.164.66:443
163.172.97.112:8080
119.57.36.54:8080
72.27.212.209:8080
86.98.157.3:80
211.218.105.101:80
72.51.153.27:80
51.38.134.203:8080
123.142.37.165:80
212.129.14.27:8080
37.46.129.215:8080
119.159.150.176:443
95.216.212.157:8080
115.179.91.58:80
191.100.24.201:50000
190.171.135.235:80
24.28.178.71:80
200.41.121.69:443
177.103.201.23:80
174.57.150.13:8080
172.104.70.207:8080
92.16.222.156:80
86.6.123.109:80
110.2.118.164:80
82.146.55.23:7080
178.134.1.238:80
182.176.116.139:995
46.105.131.68:8080
67.254.196.78:443
67.171.182.231:80
175.127.140.68:80
216.75.37.196:8080
37.70.131.107:80
24.27.122.202:80
188.230.134.205:80
201.183.251.100:80
212.112.113.235:80
120.51.83.89:443
193.33.38.208:443
108.184.9.44:80
187.250.92.82:80
83.156.88.159:80
85.109.190.235:443
46.17.6.116:8080
78.46.87.133:8080
89.215.225.15:80
190.5.162.204:80
221.154.59.110:80
189.225.211.171:443
186.84.173.136:8080
78.186.102.195:80
192.241.220.183:8080
158.69.167.246:8080
23.253.207.142:8080
142.93.87.198:8080
100.38.11.243:80
42.51.192.231:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
footerhant.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat footerhant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 29 IoCs
Processes:
footerhant.exefooterhant.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections footerhant.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix footerhant.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\WinDir\Recent File List footerhant.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21375391-3F4D-4558-8330-637CD890942A}\WpadDecisionTime = f092fe66beaeda01 footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications footerhant.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21375391-3F4D-4558-8330-637CD890942A}\96-43-0f-be-be-1b footerhant.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21375391-3F4D-4558-8330-637CD890942A}\WpadDecisionReason = "1" footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-43-0f-be-be-1b footerhant.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-43-0f-be-be-1b\WpadDecisionTime = f092fe66beaeda01 footerhant.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-43-0f-be-be-1b\WpadDecision = "0" footerhant.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" footerhant.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21375391-3F4D-4558-8330-637CD890942A} footerhant.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-43-0f-be-be-1b\WpadDecisionReason = "1" footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\WinDir footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\WinDir\Settings footerhant.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 footerhant.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21375391-3F4D-4558-8330-637CD890942A}\WpadDecision = "0" footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\WinDir\Recent File List footerhant.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" footerhant.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\WinDir\Settings footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings footerhant.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\WinDir footerhant.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" footerhant.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21375391-3F4D-4558-8330-637CD890942A}\WpadNetworkName = "Network 3" footerhant.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
footerhant.exepid process 2880 footerhant.exe 2880 footerhant.exe 2880 footerhant.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exepid process 2196 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exefooterhant.exefooterhant.exepid process 2320 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe 2196 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe 2980 footerhant.exe 2880 footerhant.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exefooterhant.exedescription pid process target process PID 2320 wrote to memory of 2196 2320 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe PID 2320 wrote to memory of 2196 2320 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe PID 2320 wrote to memory of 2196 2320 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe PID 2320 wrote to memory of 2196 2320 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe 728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe PID 2980 wrote to memory of 2880 2980 footerhant.exe footerhant.exe PID 2980 wrote to memory of 2880 2980 footerhant.exe footerhant.exe PID 2980 wrote to memory of 2880 2980 footerhant.exe footerhant.exe PID 2980 wrote to memory of 2880 2980 footerhant.exe footerhant.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\728689e0227a9d06c06764ee6e51d6ee_JaffaCakes118.exe--aff43ef52⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2196
-
C:\Windows\SysWOW64\footerhant.exe"C:\Windows\SysWOW64\footerhant.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\footerhant.exe--ea62c22c2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2196-5-0x0000000000380000-0x0000000000397000-memory.dmpFilesize
92KB
-
memory/2196-15-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2320-0-0x0000000000310000-0x0000000000327000-memory.dmpFilesize
92KB
-
memory/2980-10-0x00000000003B0000-0x00000000003C7000-memory.dmpFilesize
92KB