Analysis
- max time kernel
143s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
15/06/2024, 09:48
General
- Target add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118.exe
- Size 458KB
- Sample240615-ls3v4awdkf
- SHA256 f9a68d9d091f067c91039866f4460ffdef9f5fa13f3329cf7e349857bca89016
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\mhegoobe.exe"C:\Windows\SysWOW64\mhegoobe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mhegoobe.exe"C:\Windows\SysWOW64\mhegoobe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2884-26-0x00000000009D0000-0x00000000009E6000-memory.dmp
memory/2884-36-0x00000000009D0000-0x00000000009E6000-memory.dmp
memory/2884-32-0x0000000000A10000-0x0000000000A20000-memory.dmp
memory/2884-31-0x00000000009F0000-0x0000000000A06000-memory.dmp
memory/2884-27-0x00000000009F0000-0x0000000000A06000-memory.dmp
memory/4884-13-0x0000000000C00000-0x0000000000C16000-memory.dmp
memory/4884-14-0x0000000000BE0000-0x0000000000BF6000-memory.dmp
memory/4884-15-0x0000000002810000-0x0000000002820000-memory.dmp
memory/4884-35-0x0000000000BE0000-0x0000000000BF6000-memory.dmp
memory/4884-34-0x0000000000C20000-0x0000000000C96000-memory.dmp
memory/4884-9-0x0000000000C00000-0x0000000000C16000-memory.dmp
memory/4964-7-0x00000000026C0000-0x00000000026D0000-memory.dmp
memory/4964-16-0x0000000002680000-0x0000000002696000-memory.dmp
memory/4964-6-0x00000000026A0000-0x00000000026B6000-memory.dmp
memory/4964-1-0x0000000002680000-0x0000000002696000-memory.dmp
memory/4964-2-0x00000000026A0000-0x00000000026B6000-memory.dmp
memory/4980-18-0x0000000000520000-0x0000000000536000-memory.dmp
memory/4980-33-0x0000000000520000-0x0000000000536000-memory.dmp
memory/4980-24-0x0000000000540000-0x0000000000550000-memory.dmp
memory/4980-19-0x0000000000560000-0x0000000000576000-memory.dmp
memory/4980-23-0x0000000000560000-0x0000000000576000-memory.dmp