Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
01/06/2024, 08:50
General
- Target 89eec8e5dd09b35da3e352163a614eee_JaffaCakes118.exe
- Size 281KB
- Sample240601-krp26sfh21
- SHA256 f3cf3d5935d88ab2a437ea66b2ea395fc7bd4873c4123dcbdbcb36da948ec1d0
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Drops file in System32 directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89eec8e5dd09b35da3e352163a614eee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89eec8e5dd09b35da3e352163a614eee_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\89eec8e5dd09b35da3e352163a614eee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89eec8e5dd09b35da3e352163a614eee_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\sharedquota.exe"C:\Windows\SysWOW64\sharedquota.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sharedquota.exe"C:\Windows\SysWOW64\sharedquota.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/216-5-0x0000000000BC0000-0x0000000000BCD000-memory.dmp
memory/216-6-0x0000000000BE0000-0x0000000000BF0000-memory.dmp
memory/216-0-0x0000000000BD0000-0x0000000000BDD000-memory.dmp
memory/216-4-0x0000000000BD0000-0x0000000000BDD000-memory.dmp
memory/216-15-0x0000000000BC0000-0x0000000000BCD000-memory.dmp
memory/216-14-0x0000000000C50000-0x0000000000C9B000-memory.dmp
memory/832-20-0x0000000000C30000-0x0000000000C3D000-memory.dmp
memory/832-30-0x0000000000C20000-0x0000000000C2D000-memory.dmp
memory/832-21-0x0000000000C20000-0x0000000000C2D000-memory.dmp
memory/832-22-0x0000000000C40000-0x0000000000C50000-memory.dmp
memory/832-16-0x0000000000C30000-0x0000000000C3D000-memory.dmp
memory/944-12-0x0000000001850000-0x000000000185D000-memory.dmp
memory/944-7-0x0000000001860000-0x000000000186D000-memory.dmp
memory/944-11-0x0000000001860000-0x000000000186D000-memory.dmp
memory/944-13-0x0000000001870000-0x0000000001880000-memory.dmp
memory/944-32-0x0000000001850000-0x000000000185D000-memory.dmp
memory/944-31-0x0000000000C50000-0x0000000000C9B000-memory.dmp
memory/3832-27-0x0000000000E40000-0x0000000000E4D000-memory.dmp
memory/3832-23-0x0000000000E40000-0x0000000000E4D000-memory.dmp
memory/3832-29-0x0000000000E50000-0x0000000000E60000-memory.dmp
memory/3832-28-0x0000000000E30000-0x0000000000E3D000-memory.dmp
memory/3832-33-0x0000000000E30000-0x0000000000E3D000-memory.dmp