Analysis
- max time kernel
137s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
02/06/2024, 16:08
General
- Target 8ea76c5c4f2c268eecf02e3604a4f7a6_JaffaCakes118.exe
- Size 132KB
- Sample240602-tk8qdagc2y
- SHA256 0580bc4c8a8f68147b4f64fb388f4d0392dc6c88f38e9e6a6b862e61da3fb6e5
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Drops file in System32 directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ea76c5c4f2c268eecf02e3604a4f7a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea76c5c4f2c268eecf02e3604a4f7a6_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8ea76c5c4f2c268eecf02e3604a4f7a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ea76c5c4f2c268eecf02e3604a4f7a6_JaffaCakes118.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\servicehome.exeC:\Windows\SysWOW64\servicehome.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\servicehome.exe"C:\Windows\SysWOW64\servicehome.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1584-4-0x0000000000EA0000-0x0000000000EAE000-memory.dmp
memory/1584-5-0x0000000000E90000-0x0000000000E9E000-memory.dmp
memory/1584-6-0x0000000000EB0000-0x0000000000EC0000-memory.dmp
memory/1584-0-0x0000000000EA0000-0x0000000000EAE000-memory.dmp
memory/1584-14-0x0000000000E90000-0x0000000000E9E000-memory.dmp
memory/1648-19-0x0000000000F30000-0x0000000000F3E000-memory.dmp
memory/1648-29-0x0000000000F20000-0x0000000000F2E000-memory.dmp
memory/1648-20-0x0000000000F20000-0x0000000000F2E000-memory.dmp
memory/1648-21-0x0000000000F40000-0x0000000000F50000-memory.dmp
memory/1648-15-0x0000000000F30000-0x0000000000F3E000-memory.dmp
memory/3432-11-0x0000000000F00000-0x0000000000F0E000-memory.dmp
memory/3432-12-0x0000000000990000-0x000000000099E000-memory.dmp
memory/3432-13-0x0000000000F10000-0x0000000000F20000-memory.dmp
memory/3432-7-0x0000000000F00000-0x0000000000F0E000-memory.dmp
memory/3432-30-0x0000000000F90000-0x0000000000FB2000-memory.dmp
memory/3432-31-0x0000000000990000-0x000000000099E000-memory.dmp
memory/4840-26-0x00000000010B0000-0x00000000010BE000-memory.dmp
memory/4840-22-0x00000000010B0000-0x00000000010BE000-memory.dmp
memory/4840-28-0x00000000010C0000-0x00000000010D0000-memory.dmp
memory/4840-27-0x0000000000F80000-0x0000000000F8E000-memory.dmp
memory/4840-32-0x0000000000F80000-0x0000000000F8E000-memory.dmp