Analysis Overview
SHA256
71c75b5dbf458db4417580caede684dccacece9018036c5528b29d52768b5b43
Threat Level: Known bad
The file 19b3c17149051b163c797e46d6cbad35_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Emotet
Emotet payload
Executes dropped EXE
Drops file in System32 directory
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-28 17:28
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-28 17:28
Reported
2024-07-30 02:50
Platform
win7-20240729-en
Max time kernel
135s
Max time network
145s
Command Line
Signatures
Emotet
Emotet payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\KBDHU\adtschema.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\KBDHU\adtschema.exe | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\KBDHU\adtschema.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\KBDHU\adtschema.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\KBDHU\adtschema.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\KBDHU\adtschema.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\KBDHU\adtschema.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\KBDHU\adtschema.exe | N/A |
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2648 wrote to memory of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | C:\Windows\SysWOW64\KBDHU\adtschema.exe |
| PID 2648 wrote to memory of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | C:\Windows\SysWOW64\KBDHU\adtschema.exe |
| PID 2648 wrote to memory of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | C:\Windows\SysWOW64\KBDHU\adtschema.exe |
| PID 2648 wrote to memory of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | C:\Windows\SysWOW64\KBDHU\adtschema.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe"
C:\Windows\SysWOW64\KBDHU\adtschema.exe
"C:\Windows\SysWOW64\KBDHU\adtschema.exe"
Network
| Country | Destination | Domain | Proto |
| US | 38.18.235.242:80 | tcp | |
| US | 38.18.235.242:80 | tcp | |
| FR | 5.196.108.189:8080 | tcp | |
| FR | 5.196.108.189:8080 | tcp | |
| KR | 121.124.124.40:7080 | tcp | |
| KR | 121.124.124.40:7080 | tcp | |
| US | 104.236.246.93:8080 | tcp | |
| US | 104.236.246.93:8080 | tcp |
Files
memory/2648-4-0x0000000000030000-0x0000000000040000-memory.dmp
memory/2648-7-0x0000000000020000-0x000000000002F000-memory.dmp
memory/2648-0-0x0000000000330000-0x0000000000342000-memory.dmp
memory/2648-8-0x0000000000400000-0x000000000041C000-memory.dmp
C:\Windows\SysWOW64\KBDHU\adtschema.exe
| MD5 | 19b3c17149051b163c797e46d6cbad35 |
| SHA1 | c5b08a58ef162a03fb1a208427d579bbdcfbcebb |
| SHA256 | 71c75b5dbf458db4417580caede684dccacece9018036c5528b29d52768b5b43 |
| SHA512 | 441f26b2176fe48ca4b2102e16721942deb0b28be4f63c6575d979e3e9263aff242e6ee3c935f17c997c0a010b0233fb6e3efb1303ec1f826aa77b6cab74f480 |
memory/2880-10-0x00000000001C0000-0x00000000001D2000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-28 17:28
Reported
2024-07-30 02:48
Platform
win10v2004-20240709-en
Max time kernel
140s
Max time network
149s
Command Line
Signatures
Emotet
Emotet payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Processes
C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19b3c17149051b163c797e46d6cbad35_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 38.18.235.242:80 | tcp | |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| FR | 5.196.108.189:8080 | tcp | |
| KR | 121.124.124.40:7080 | tcp | |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 104.236.246.93:8080 | tcp | |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| AU | 113.61.66.94:80 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | udp | |
| AU | 120.150.60.189:80 | tcp | |
| PL | 91.211.88.52:7080 | tcp |
Files
memory/64-4-0x0000000000710000-0x0000000000720000-memory.dmp
memory/64-0-0x00000000006F0000-0x0000000000702000-memory.dmp
memory/64-7-0x00000000006E0000-0x00000000006EF000-memory.dmp