Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 10:35

General

  • Target

    b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe

  • Size

    136KB

  • MD5

    b82b6b7a48bf4e049cb4c338b18921eb

  • SHA1

    41b9ee9deac56d3ad5ca11ca2db408ea67567b93

  • SHA256

    c7c64507d9df7bc28d251132cb309b54b86e939d5e2e21894e0573e9a1ec9ddc

  • SHA512

    ed02bf9522a1ff367a68103020242c623520809f168fa2d46202f26e19022bfc5f291cda08dc030e57ae5d7aa7fb356ce71ca74cbf506f97e9fbcb0e60cc6d5b

  • SSDEEP

    1536:ylQ1YOZpCGwKrKNDiVTzHvHTmaNBzkRNwmX2IlpI0cuF/2:h1YMpCGw5pqSaNBzrox2

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b82b6b7a48bf4e049cb4c338b18921eb_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:2132
  • C:\Windows\SysWOW64\pixswim.exe
    "C:\Windows\SysWOW64\pixswim.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\pixswim.exe
      "C:\Windows\SysWOW64\pixswim.exe"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:1680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/216-14-0x00000000005C0000-0x00000000005CD000-memory.dmp

    Filesize

    52KB

  • memory/216-0-0x0000000000600000-0x000000000060D000-memory.dmp

    Filesize

    52KB

  • memory/216-6-0x0000000000610000-0x0000000000620000-memory.dmp

    Filesize

    64KB

  • memory/216-5-0x00000000005C0000-0x00000000005CD000-memory.dmp

    Filesize

    52KB

  • memory/216-4-0x0000000000600000-0x000000000060D000-memory.dmp

    Filesize

    52KB

  • memory/1680-26-0x0000000000EA0000-0x0000000000EAD000-memory.dmp

    Filesize

    52KB

  • memory/1680-22-0x0000000000EA0000-0x0000000000EAD000-memory.dmp

    Filesize

    52KB

  • memory/1712-20-0x00000000004C0000-0x00000000004CD000-memory.dmp

    Filesize

    52KB

  • memory/1712-19-0x00000000004D0000-0x00000000004DD000-memory.dmp

    Filesize

    52KB

  • memory/1712-15-0x00000000004D0000-0x00000000004DD000-memory.dmp

    Filesize

    52KB

  • memory/1712-21-0x00000000004F0000-0x0000000000500000-memory.dmp

    Filesize

    64KB

  • memory/1712-27-0x00000000004C0000-0x00000000004CD000-memory.dmp

    Filesize

    52KB

  • memory/2132-12-0x00000000005F0000-0x00000000005FD000-memory.dmp

    Filesize

    52KB

  • memory/2132-13-0x0000000000740000-0x0000000000750000-memory.dmp

    Filesize

    64KB

  • memory/2132-7-0x0000000000730000-0x000000000073D000-memory.dmp

    Filesize

    52KB

  • memory/2132-11-0x0000000000730000-0x000000000073D000-memory.dmp

    Filesize

    52KB

  • memory/2132-29-0x00000000005F0000-0x00000000005FD000-memory.dmp

    Filesize

    52KB

  • memory/2132-28-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB