Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2024 04:50
Static task
static1
Behavioral task
behavioral1
Sample
7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe
-
Size
504KB
-
MD5
7b4ffbada337911937d40edae0388b59
-
SHA1
cd0b24bab3e86ae4b8a29adcac0f558a124e9a23
-
SHA256
0d883284405bf63be735b6c21bd0b2387b18b24393b73111eb5eec9898986d26
-
SHA512
0434e78600c73944427f345f4739b60bd3bb54c0c601d3479128fc6b292cb64fa41f337ffcf4691ea79f24ade312e4caf50fac6e7ce78a9a90a678dbae7c1d1d
-
SSDEEP
6144:nBzm/LCCddFxrIT9QmsCeB3QN1KYCOLYQONe68A0HMvfMd6f8I5Ber0CQuhcT0:KdrwHsCIA3KYCOLa8NMHMKa0Ci0
Malware Config
Extracted
emotet
Epoch2
174.106.122.139:80
159.203.116.47:8080
173.249.6.108:443
104.236.246.93:8080
174.45.13.118:80
137.59.187.107:8080
94.200.114.161:80
37.187.72.193:8080
67.10.155.92:80
121.124.124.40:7080
24.43.99.75:80
75.139.38.211:80
109.74.5.95:8080
137.119.36.33:80
74.134.41.124:80
66.65.136.14:80
94.1.108.190:443
181.169.235.7:80
79.137.83.50:443
104.131.44.150:8080
121.7.127.163:80
96.249.236.156:443
120.150.60.189:80
134.209.36.254:8080
110.145.77.103:80
118.83.154.64:443
71.72.196.159:80
50.91.114.38:80
62.75.141.82:80
157.245.99.39:8080
140.186.212.146:80
168.235.67.138:7080
104.131.11.150:443
78.24.219.147:8080
46.105.131.79:8080
104.251.33.179:80
24.43.32.186:80
200.114.213.233:8080
153.137.36.142:80
85.96.199.93:80
94.23.237.171:443
5.39.91.110:7080
85.152.162.105:80
162.241.242.173:8080
213.196.135.145:80
139.99.158.11:443
194.187.133.160:443
78.187.156.31:80
1.221.254.82:80
124.41.215.226:80
139.130.242.43:80
209.141.54.221:8080
87.106.136.232:8080
83.169.36.251:8080
195.7.12.8:80
185.94.252.104:443
95.213.236.64:8080
42.200.107.142:80
203.153.216.189:7080
68.188.112.97:80
5.196.74.210:8080
87.106.139.101:8080
104.32.141.43:80
94.124.59.22:8080
74.219.172.26:80
108.46.29.236:80
93.147.212.206:80
172.104.97.173:8080
190.240.194.77:443
103.86.49.11:8080
74.208.45.104:8080
82.80.155.43:80
61.19.246.238:443
139.162.108.71:8080
121.7.31.214:80
188.219.31.12:80
37.139.21.175:8080
181.169.34.190:80
219.74.18.66:443
123.176.25.234:80
216.139.123.119:80
79.98.24.39:8080
62.30.7.67:443
139.162.60.124:8080
176.111.60.55:8080
91.211.88.52:7080
172.91.208.86:80
139.59.60.244:8080
89.216.122.92:80
142.112.10.95:20
107.5.122.110:80
50.35.17.13:80
97.82.79.83:80
68.252.26.78:80
110.142.236.207:80
47.144.21.12:443
24.137.76.62:80
220.245.198.194:80
74.120.55.163:80
24.179.13.119:80
113.61.66.94:80
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4364-0-0x00000000005B0000-0x00000000005C2000-memory.dmp emotet behavioral2/memory/4364-4-0x00000000005D0000-0x00000000005E0000-memory.dmp emotet behavioral2/memory/4364-7-0x00000000005A0000-0x00000000005AF000-memory.dmp emotet behavioral2/memory/940-14-0x0000000000750000-0x0000000000760000-memory.dmp emotet behavioral2/memory/940-10-0x00000000020C0000-0x00000000020D2000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
Processes:
NcdProp.exepid process 940 NcdProp.exe -
Drops file in System32 directory 1 IoCs
Processes:
7b4ffbada337911937d40edae0388b59_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\perfctrs\NcdProp.exe 7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7b4ffbada337911937d40edae0388b59_JaffaCakes118.exeNcdProp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NcdProp.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
NcdProp.exepid process 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe 940 NcdProp.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
7b4ffbada337911937d40edae0388b59_JaffaCakes118.exepid process 4364 7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7b4ffbada337911937d40edae0388b59_JaffaCakes118.exeNcdProp.exepid process 4364 7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe 940 NcdProp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7b4ffbada337911937d40edae0388b59_JaffaCakes118.exedescription pid process target process PID 4364 wrote to memory of 940 4364 7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe NcdProp.exe PID 4364 wrote to memory of 940 4364 7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe NcdProp.exe PID 4364 wrote to memory of 940 4364 7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe NcdProp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7b4ffbada337911937d40edae0388b59_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\perfctrs\NcdProp.exe"C:\Windows\SysWOW64\perfctrs\NcdProp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD57b4ffbada337911937d40edae0388b59
SHA1cd0b24bab3e86ae4b8a29adcac0f558a124e9a23
SHA2560d883284405bf63be735b6c21bd0b2387b18b24393b73111eb5eec9898986d26
SHA5120434e78600c73944427f345f4739b60bd3bb54c0c601d3479128fc6b292cb64fa41f337ffcf4691ea79f24ade312e4caf50fac6e7ce78a9a90a678dbae7c1d1d