Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 23:37
General
- Target 96a462e5f978902dbbc9ef678c29d7a6_JaffaCakes118.exe
- Size 204KB
- Sample240604-3mdsfsgb28
- SHA256 5f89899fe13b50da5340cc44f5b7d576e3ff04ee3246cef7959ac46a1561619c
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96a462e5f978902dbbc9ef678c29d7a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96a462e5f978902dbbc9ef678c29d7a6_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96a462e5f978902dbbc9ef678c29d7a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96a462e5f978902dbbc9ef678c29d7a6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\examplepla.exe"C:\Windows\SysWOW64\examplepla.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\examplepla.exe"C:\Windows\SysWOW64\examplepla.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1340-2-0x0000000002520000-0x0000000002536000-memory.dmp
memory/1340-6-0x0000000002520000-0x0000000002536000-memory.dmp
memory/1340-8-0x0000000002540000-0x0000000002560000-memory.dmp
memory/1340-7-0x0000000002500000-0x0000000002516000-memory.dmp
memory/1340-0-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1340-17-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3060-20-0x0000000000D50000-0x0000000000D66000-memory.dmp
memory/3060-35-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3060-26-0x0000000000D70000-0x0000000000D90000-memory.dmp
memory/3060-25-0x0000000000D30000-0x0000000000D46000-memory.dmp
memory/3060-18-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3060-24-0x0000000000D50000-0x0000000000D66000-memory.dmp
memory/3476-10-0x00000000020B0000-0x00000000020C6000-memory.dmp
memory/3476-15-0x0000000002090000-0x00000000020A6000-memory.dmp
memory/3476-16-0x00000000020D0000-0x00000000020F0000-memory.dmp
memory/3476-14-0x00000000020B0000-0x00000000020C6000-memory.dmp
memory/3476-36-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3476-37-0x0000000002090000-0x00000000020A6000-memory.dmp
memory/3764-32-0x0000000000D60000-0x0000000000D76000-memory.dmp
memory/3764-28-0x0000000000D60000-0x0000000000D76000-memory.dmp
memory/3764-34-0x0000000000D80000-0x0000000000DA0000-memory.dmp
memory/3764-33-0x00000000005D0000-0x00000000005E6000-memory.dmp
memory/3764-38-0x00000000005D0000-0x00000000005E6000-memory.dmp