Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 20:34

General

  • Target

    b9ebda873738c0085d326db3fb580585_JaffaCakes118.exe

  • Size

    174KB

  • MD5

    b9ebda873738c0085d326db3fb580585

  • SHA1

    9784d374e7835547ece6de252a7d16057d90bc7d

  • SHA256

    ec61ad3dc501ed0fdecfe3abd8916e1ce6246ceb99cfa9f8f9736aad0ac5529b

  • SHA512

    7064065b2b09dab685399058ffe78a72fd1e333e59cd00c98159edd28c2d98f09cad6155442c7dc27cec5af578eebf17b02b7fa952f024e4984f199eb33ba8f5

  • SSDEEP

    3072:XP+zlbNH/1l+JSPR+vjl9WTddK/mAcbTVe7UFtK:WzlbZe0PU59WnGUEAFt

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: LoadsDriver 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9ebda873738c0085d326db3fb580585_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9ebda873738c0085d326db3fb580585_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Users\Admin\AppData\Local\Temp\b9ebda873738c0085d326db3fb580585_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b9ebda873738c0085d326db3fb580585_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:3732
  • C:\Windows\SysWOW64\catchsketch.exe
    "C:\Windows\SysWOW64\catchsketch.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Windows\SysWOW64\catchsketch.exe
      "C:\Windows\SysWOW64\catchsketch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1440-4-0x0000000002530000-0x0000000002547000-memory.dmp

    Filesize

    92KB

  • memory/1440-1-0x0000000002530000-0x0000000002547000-memory.dmp

    Filesize

    92KB

  • memory/1440-6-0x0000000002550000-0x0000000002560000-memory.dmp

    Filesize

    64KB

  • memory/1440-5-0x0000000002510000-0x0000000002527000-memory.dmp

    Filesize

    92KB

  • memory/1440-14-0x0000000002510000-0x0000000002527000-memory.dmp

    Filesize

    92KB

  • memory/3732-11-0x0000000000740000-0x0000000000757000-memory.dmp

    Filesize

    92KB

  • memory/3732-7-0x0000000000740000-0x0000000000757000-memory.dmp

    Filesize

    92KB

  • memory/3732-13-0x0000000000760000-0x0000000000770000-memory.dmp

    Filesize

    64KB

  • memory/3732-12-0x0000000000720000-0x0000000000737000-memory.dmp

    Filesize

    92KB

  • memory/3732-30-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/3732-31-0x0000000000720000-0x0000000000737000-memory.dmp

    Filesize

    92KB

  • memory/3952-28-0x0000000000780000-0x0000000000790000-memory.dmp

    Filesize

    64KB

  • memory/3952-26-0x0000000000B60000-0x0000000000B77000-memory.dmp

    Filesize

    92KB

  • memory/3952-22-0x0000000000B60000-0x0000000000B77000-memory.dmp

    Filesize

    92KB

  • memory/3952-27-0x0000000000760000-0x0000000000777000-memory.dmp

    Filesize

    92KB

  • memory/3952-32-0x0000000000760000-0x0000000000777000-memory.dmp

    Filesize

    92KB

  • memory/4568-20-0x0000000001230000-0x0000000001247000-memory.dmp

    Filesize

    92KB

  • memory/4568-21-0x00000000004E0000-0x00000000004F0000-memory.dmp

    Filesize

    64KB

  • memory/4568-29-0x0000000001230000-0x0000000001247000-memory.dmp

    Filesize

    92KB

  • memory/4568-15-0x0000000001250000-0x0000000001267000-memory.dmp

    Filesize

    92KB

  • memory/4568-19-0x0000000001250000-0x0000000001267000-memory.dmp

    Filesize

    92KB