Analysis

  • max time kernel
    137s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2024 07:59

General

  • Target

    8d6146eed06d626d31499c689dbdacdc_JaffaCakes118.exe

  • Size

    275KB

  • MD5

    8d6146eed06d626d31499c689dbdacdc

  • SHA1

    d85b600d2457a5948e92956d1dbb9160aa05a88e

  • SHA256

    01d06594c1418a2f58d827174255e372848d80a1eb037b9ae733e4b21a918cd2

  • SHA512

    f269aed0b8d1d137bac7b3af8c461b57488b9a41e0fa8f6f0559f12f7c58ffdd0317db8ab1daddc71d1accfafc58dc4b79a4d61841441c071a489d17831e7fa9

  • SSDEEP

    3072:jVFKX2GybFw1w8oayTMtu+5x4Rd17bo5PLF0MNseNI3920h:jTKX2b+a8oRTMY+H4Rv7OPLmMN3NIv

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d6146eed06d626d31499c689dbdacdc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d6146eed06d626d31499c689dbdacdc_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Users\Admin\AppData\Local\Temp\8d6146eed06d626d31499c689dbdacdc_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8d6146eed06d626d31499c689dbdacdc_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:2464
  • C:\Windows\SysWOW64\exampletvout.exe
    "C:\Windows\SysWOW64\exampletvout.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\SysWOW64\exampletvout.exe
      "C:\Windows\SysWOW64\exampletvout.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2464-12-0x0000000000830000-0x0000000000847000-memory.dmp

    Filesize

    92KB

  • memory/2464-30-0x0000000000470000-0x00000000004B9000-memory.dmp

    Filesize

    292KB

  • memory/2464-31-0x0000000000830000-0x0000000000847000-memory.dmp

    Filesize

    92KB

  • memory/2464-8-0x0000000000870000-0x0000000000887000-memory.dmp

    Filesize

    92KB

  • memory/2464-11-0x0000000000870000-0x0000000000887000-memory.dmp

    Filesize

    92KB

  • memory/2464-13-0x0000000000990000-0x00000000009A0000-memory.dmp

    Filesize

    64KB

  • memory/3456-20-0x00000000013F0000-0x0000000001407000-memory.dmp

    Filesize

    92KB

  • memory/3456-21-0x00000000013B0000-0x00000000013C0000-memory.dmp

    Filesize

    64KB

  • memory/3456-29-0x0000000001350000-0x0000000001367000-memory.dmp

    Filesize

    92KB

  • memory/3456-15-0x0000000001350000-0x0000000001367000-memory.dmp

    Filesize

    92KB

  • memory/3456-16-0x00000000013F0000-0x0000000001407000-memory.dmp

    Filesize

    92KB

  • memory/4192-28-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

    Filesize

    64KB

  • memory/4192-22-0x0000000000A70000-0x0000000000A87000-memory.dmp

    Filesize

    92KB

  • memory/4192-23-0x0000000000BC0000-0x0000000000BD7000-memory.dmp

    Filesize

    92KB

  • memory/4192-27-0x0000000000BC0000-0x0000000000BD7000-memory.dmp

    Filesize

    92KB

  • memory/4192-32-0x0000000000A70000-0x0000000000A87000-memory.dmp

    Filesize

    92KB

  • memory/4700-0-0x0000000002980000-0x0000000002997000-memory.dmp

    Filesize

    92KB

  • memory/4700-14-0x0000000002980000-0x0000000002997000-memory.dmp

    Filesize

    92KB

  • memory/4700-6-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/4700-1-0x00000000029D0000-0x00000000029E7000-memory.dmp

    Filesize

    92KB

  • memory/4700-5-0x00000000029D0000-0x00000000029E7000-memory.dmp

    Filesize

    92KB