Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 16:52

General

  • Target

    7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe

  • Size

    652KB

  • MD5

    7625b18518f0ff9b42b4d95b93cc5d82

  • SHA1

    2ac608221610e1e3bbdf28a60ac9cac798604798

  • SHA256

    82fd827a828f7eb4c9683707910a8f4d135c7f2107c33dd94196a09a92e31898

  • SHA512

    2bd93eaa1f8835496919d9b5f0cec0e1c0bd63f7d58b59a92778af721cc9005b741ae99426232232bc5d141cd11f9b9d7574c90d7904a3b595c15043df7ea2ba

  • SSDEEP

    6144:M1kldizdOT/pS0MIt7YRU6f5+StXzXYbnnuCYUvaJqqjbGdIBJxmA++j90TTofwz:VplfofXYbjYUvaVaCn++O4ZV4o6L

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

72.69.99.47:80

190.5.162.204:80

123.142.37.165:80

50.63.13.135:8080

222.239.249.166:443

192.161.190.171:8080

80.93.48.49:7080

195.201.56.68:7080

181.44.166.242:80

161.18.233.114:80

51.38.134.203:8080

212.129.14.27:8080

172.90.70.168:443

45.129.121.222:443

189.180.105.125:443

186.66.224.182:990

122.11.164.183:80

138.197.140.163:8080

211.218.105.101:80

212.112.113.235:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe
      --d5592189
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:1920
  • C:\Windows\SysWOW64\halwrap.exe
    "C:\Windows\SysWOW64\halwrap.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\SysWOW64\halwrap.exe
      --55204bf3
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3440

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\01edac8cae020cd42786e051ebe37b67_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
    Filesize

    50B

    MD5

    5f22af36aff2e43cacf9a56ba4166900

    SHA1

    914ede992f5edd5523a3a127a88f7bca60c69665

    SHA256

    e0671a7dbf4fca7d937ff1300471c5823a57786710faba9f85daf9e843281e3a

    SHA512

    f7fd666c6dcdae2bf235bb2b00791cf00519579e3181e5e3fd67e70c9a4027d48335b6498f6116efa5e513b7750b0eebeb484a63555d277939923bb48d4f3bc8

  • memory/1920-6-0x00000000007B0000-0x00000000007C7000-memory.dmp
    Filesize

    92KB

  • memory/1920-17-0x0000000000400000-0x00000000004A7000-memory.dmp
    Filesize

    668KB

  • memory/3440-19-0x0000000000DB0000-0x0000000000DC7000-memory.dmp
    Filesize

    92KB

  • memory/4116-12-0x0000000000EB0000-0x0000000000EC7000-memory.dmp
    Filesize

    92KB

  • memory/4284-0-0x0000000002120000-0x0000000002137000-memory.dmp
    Filesize

    92KB

  • memory/4284-5-0x0000000000760000-0x0000000000771000-memory.dmp
    Filesize

    68KB