Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 19:47

General

  • Target

    b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe

  • Size

    212KB

  • MD5

    b9b6ed320abb4ae798b19b20ed1ea24b

  • SHA1

    795db75b555ced61d39f399fb0235ac728309634

  • SHA256

    dda9f44bce3400c926aa5263bf9640dbdb6599f5f33db219deac1da0de4568fa

  • SHA512

    4c270baf62183503bd7ba3823ef48de258442c94a47dba8d6324df02d3ef92a1b8951a3b19deb24ea8b34b5dbc2dcb4f61cc844e879bf6a664566f2016bd1205

  • SSDEEP

    3072:YqHuHOn5SmyOMHudWmChnh7oMFHo/BcMir6epWu54tItpR:YqOK5SmyOH8F4cyepWy

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

63.248.198.8:80

189.19.81.181:443

130.204.247.253:80

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

51.255.165.160:8080

118.36.70.245:80

190.210.184.138:995

188.135.15.49:80

139.162.118.88:8080

72.29.55.174:80

68.183.170.114:8080

181.231.62.54:80

192.241.146.84:8080

71.76.45.83:443

63.246.252.234:80

37.211.49.127:80

74.59.187.94:80

5.88.27.67:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Local\Temp\b9b6ed320abb4ae798b19b20ed1ea24b_JaffaCakes118.exe
      --e879b88c
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:2412
  • C:\Windows\SysWOW64\wsatrns.exe
    "C:\Windows\SysWOW64\wsatrns.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\SysWOW64\wsatrns.exe
      --c0e3ccde
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1780-12-0x0000000000340000-0x0000000000357000-memory.dmp
    Filesize

    92KB

  • memory/1992-5-0x00000000002B0000-0x00000000002C1000-memory.dmp
    Filesize

    68KB

  • memory/1992-0-0x00000000002D0000-0x00000000002E7000-memory.dmp
    Filesize

    92KB

  • memory/2412-6-0x00000000002A0000-0x00000000002A1000-memory.dmp
    Filesize

    4KB

  • memory/2412-7-0x00000000002E0000-0x00000000002F7000-memory.dmp
    Filesize

    92KB

  • memory/2412-17-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

  • memory/2440-18-0x00000000003C0000-0x00000000003D7000-memory.dmp
    Filesize

    92KB