Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 11:53
Static task
static1
Behavioral task
behavioral1
Sample
756517b66f383614847c911c741b5f6b_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
756517b66f383614847c911c741b5f6b_JaffaCakes118.exe
-
Size
616KB
-
MD5
756517b66f383614847c911c741b5f6b
-
SHA1
7809da3ebca6525959ea22e723e4e53add40f856
-
SHA256
1f552efb5aa1cca30b22e3e8eada588387d599188c7895ee79ef6b4cee4d88b3
-
SHA512
0d450537954750516e69cd741d00031bac61940ce9c2362f53798f25fae44f7f95c9c9d5296580b9009e0ffaa89a5465d3d7a2ba56c9966a39717bf734021441
-
SSDEEP
6144:KNyMUE8JKsa4OQu+/Qj/3XonIgmOUPph8HPcSpoS482U7laNytEm:AypE8JhOQu+IzYnIUUG482p
Malware Config
Extracted
emotet
Epoch2
212.186.191.177:80
91.242.138.5:80
173.13.135.102:80
59.110.18.236:443
45.56.88.91:443
51.68.220.244:8080
206.81.10.215:8080
80.11.163.139:21
182.176.132.213:8090
165.227.156.155:443
118.201.230.249:80
138.201.140.110:8080
46.105.131.87:80
87.106.139.101:8080
24.45.193.161:7080
209.97.168.52:8080
190.12.119.180:443
190.147.215.53:22
191.92.209.110:7080
91.205.215.66:8080
190.211.207.11:443
186.75.241.230:80
173.212.203.26:8080
67.225.179.64:8080
31.12.67.62:7080
128.65.154.183:443
189.209.217.49:80
107.2.2.28:80
167.99.105.223:7080
12.229.155.122:80
104.236.246.93:8080
178.209.71.63:8080
212.129.24.79:8080
95.128.43.213:8080
178.210.51.222:8080
5.88.182.250:80
91.231.166.126:8080
176.31.200.130:8080
192.81.213.192:8080
103.39.131.88:80
164.68.101.171:80
201.184.105.242:443
213.179.105.214:8080
149.202.153.252:8080
47.50.251.130:80
93.147.141.5:80
37.157.194.134:443
181.57.193.14:80
45.33.49.124:443
192.241.255.77:8080
62.75.187.192:8080
31.31.77.83:443
181.143.194.138:443
144.139.247.220:80
181.31.213.158:8080
183.102.238.69:465
206.189.112.148:8080
165.228.24.197:80
59.103.164.174:80
83.136.245.190:8080
107.170.24.125:8080
50.116.86.205:8080
197.254.221.174:80
190.108.228.48:990
104.131.11.150:8080
200.71.148.138:8080
120.150.246.241:80
217.160.182.191:8080
159.65.25.128:8080
167.114.242.226:8080
190.226.44.20:21
92.222.216.44:8080
85.104.59.244:20
101.187.247.29:80
169.239.182.217:8080
104.131.44.150:8080
192.241.220.155:8080
91.73.197.90:80
190.145.67.134:8090
116.48.142.21:443
5.196.74.210:8080
87.230.19.21:8080
211.63.71.72:8080
167.71.10.37:8080
195.244.215.206:80
190.53.135.159:21
80.21.182.46:80
78.24.219.147:8080
31.172.240.91:8080
87.106.136.232:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
malertmaker.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat malertmaker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 25 IoCs
Processes:
malertmaker.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad malertmaker.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-5b-62-74-e4 malertmaker.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-5b-62-74-e4\WpadDetectedUrl malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{02FFA379-EAE0-4C23-A05C-D513EEABB480}\WpadDecisionTime = c06839ae63afda01 malertmaker.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings malertmaker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 malertmaker.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-5b-62-74-e4\WpadDecisionReason = "1" malertmaker.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{02FFA379-EAE0-4C23-A05C-D513EEABB480}\WpadNetworkName = "Network 3" malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-5b-62-74-e4\WpadDecisionTime = c0604f7363afda01 malertmaker.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-5b-62-74-e4\WpadDecision = "0" malertmaker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0098000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 malertmaker.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{02FFA379-EAE0-4C23-A05C-D513EEABB480}\WpadDecisionReason = "1" malertmaker.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{02FFA379-EAE0-4C23-A05C-D513EEABB480}\WpadDecision = "0" malertmaker.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" malertmaker.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{02FFA379-EAE0-4C23-A05C-D513EEABB480} malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-5b-62-74-e4\WpadDecisionTime = c06839ae63afda01 malertmaker.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix malertmaker.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" malertmaker.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0098000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 malertmaker.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{02FFA379-EAE0-4C23-A05C-D513EEABB480}\ca-02-5b-62-74-e4 malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 malertmaker.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{02FFA379-EAE0-4C23-A05C-D513EEABB480}\WpadDecisionTime = c0604f7363afda01 malertmaker.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
malertmaker.exepid process 2700 malertmaker.exe 2700 malertmaker.exe 2700 malertmaker.exe 2700 malertmaker.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
756517b66f383614847c911c741b5f6b_JaffaCakes118.exepid process 2944 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
756517b66f383614847c911c741b5f6b_JaffaCakes118.exe756517b66f383614847c911c741b5f6b_JaffaCakes118.exemalertmaker.exemalertmaker.exepid process 2344 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe 2944 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe 2696 malertmaker.exe 2700 malertmaker.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
756517b66f383614847c911c741b5f6b_JaffaCakes118.exemalertmaker.exedescription pid process target process PID 2344 wrote to memory of 2944 2344 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe PID 2344 wrote to memory of 2944 2344 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe PID 2344 wrote to memory of 2944 2344 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe PID 2344 wrote to memory of 2944 2344 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe 756517b66f383614847c911c741b5f6b_JaffaCakes118.exe PID 2696 wrote to memory of 2700 2696 malertmaker.exe malertmaker.exe PID 2696 wrote to memory of 2700 2696 malertmaker.exe malertmaker.exe PID 2696 wrote to memory of 2700 2696 malertmaker.exe malertmaker.exe PID 2696 wrote to memory of 2700 2696 malertmaker.exe malertmaker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\756517b66f383614847c911c741b5f6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\756517b66f383614847c911c741b5f6b_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\756517b66f383614847c911c741b5f6b_JaffaCakes118.exe--6c355abb2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\malertmaker.exe"C:\Windows\SysWOW64\malertmaker.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\malertmaker.exe--2418104b2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2344-0-0x0000000000390000-0x00000000003A7000-memory.dmpFilesize
92KB
-
memory/2344-5-0x0000000000340000-0x0000000000351000-memory.dmpFilesize
68KB
-
memory/2696-11-0x0000000000500000-0x0000000000517000-memory.dmpFilesize
92KB
-
memory/2700-17-0x0000000000530000-0x0000000000547000-memory.dmpFilesize
92KB
-
memory/2944-6-0x0000000000520000-0x0000000000537000-memory.dmpFilesize
92KB
-
memory/2944-16-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB