Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
18/06/2024, 10:35
General
- Target bb7aa6f71e44ebf22dca008d7357b8ca_JaffaCakes118.exe
- Size 208KB
- Sample240618-mmsnlstern
- SHA256 d19978a6f118c4ae9a2b9d21f6bcc03b35b22d91f306465512f774d082af59d4
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb7aa6f71e44ebf22dca008d7357b8ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bb7aa6f71e44ebf22dca008d7357b8ca_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb7aa6f71e44ebf22dca008d7357b8ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bb7aa6f71e44ebf22dca008d7357b8ca_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\tracediagram.exe"C:\Windows\SysWOW64\tracediagram.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tracediagram.exe"C:\Windows\SysWOW64\tracediagram.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/884-10-0x0000000002090000-0x00000000020A6000-memory.dmp
memory/884-16-0x00000000020B0000-0x00000000020D0000-memory.dmp
memory/884-15-0x0000000000400000-0x0000000000435000-memory.dmp
memory/884-14-0x0000000002090000-0x00000000020A6000-memory.dmp
memory/884-38-0x0000000000400000-0x0000000000435000-memory.dmp
memory/884-17-0x0000000000690000-0x00000000006A6000-memory.dmp
memory/884-39-0x0000000000690000-0x00000000006A6000-memory.dmp
memory/1684-6-0x0000000002670000-0x0000000002686000-memory.dmp
memory/1684-7-0x0000000002650000-0x0000000002666000-memory.dmp
memory/1684-8-0x0000000002690000-0x00000000026B0000-memory.dmp
memory/1684-2-0x0000000002670000-0x0000000002686000-memory.dmp
memory/1684-18-0x0000000000400000-0x0000000000435000-memory.dmp
memory/1684-0-0x0000000000400000-0x0000000000435000-memory.dmp
memory/3228-25-0x00000000005F0000-0x0000000000606000-memory.dmp
memory/3228-27-0x0000000000610000-0x0000000000630000-memory.dmp
memory/3228-26-0x00000000005D0000-0x00000000005E6000-memory.dmp
memory/3228-37-0x00000000005D0000-0x00000000005E6000-memory.dmp
memory/3228-36-0x0000000000400000-0x0000000000435000-memory.dmp
memory/3228-19-0x0000000000400000-0x0000000000435000-memory.dmp
memory/3228-21-0x00000000005F0000-0x0000000000606000-memory.dmp
memory/4592-29-0x0000000000600000-0x0000000000616000-memory.dmp
memory/4592-33-0x0000000000600000-0x0000000000616000-memory.dmp
memory/4592-35-0x0000000000620000-0x0000000000640000-memory.dmp
memory/4592-34-0x00000000005E0000-0x00000000005F6000-memory.dmp
memory/4592-40-0x00000000005E0000-0x00000000005F6000-memory.dmp