Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
31/05/2024, 19:57
General
- Target 882b0f99136eccdd6112928dc4c1cfd6_JaffaCakes118.exe
- Size 485KB
- Sample240531-ype13sca86
- SHA256 23e529de1409e7d3ce461bcef68bbcfc99101b6b6d3d0884df5363e579d6791b
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\882b0f99136eccdd6112928dc4c1cfd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\882b0f99136eccdd6112928dc4c1cfd6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\882b0f99136eccdd6112928dc4c1cfd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\882b0f99136eccdd6112928dc4c1cfd6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\reswpolic.exe"C:\Windows\SysWOW64\reswpolic.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reswpolic.exe"C:\Windows\SysWOW64\reswpolic.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1864-18-0x0000000000DA0000-0x0000000000DBA000-memory.dmp
memory/1864-28-0x00000000009E0000-0x00000000009FA000-memory.dmp
memory/1864-19-0x00000000009E0000-0x00000000009FA000-memory.dmp
memory/1864-20-0x0000000000500000-0x0000000000510000-memory.dmp
memory/1864-14-0x0000000000DA0000-0x0000000000DBA000-memory.dmp
memory/2676-25-0x0000000000920000-0x000000000093A000-memory.dmp
memory/2676-27-0x0000000000940000-0x0000000000950000-memory.dmp
memory/2676-26-0x0000000000530000-0x000000000054A000-memory.dmp
memory/2676-31-0x0000000000530000-0x000000000054A000-memory.dmp
memory/2676-21-0x0000000000920000-0x000000000093A000-memory.dmp
memory/2920-4-0x0000000000660000-0x000000000067A000-memory.dmp
memory/2920-5-0x0000000000640000-0x000000000065A000-memory.dmp
memory/2920-6-0x0000000000680000-0x0000000000690000-memory.dmp
memory/2920-0-0x0000000000660000-0x000000000067A000-memory.dmp
memory/3052-11-0x0000000000720000-0x000000000073A000-memory.dmp
memory/3052-30-0x0000000000700000-0x000000000071A000-memory.dmp
memory/3052-29-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3052-13-0x0000000000740000-0x0000000000750000-memory.dmp
memory/3052-12-0x0000000000700000-0x000000000071A000-memory.dmp
memory/3052-7-0x0000000000720000-0x000000000073A000-memory.dmp