Analysis
-
max time kernel
93s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 03:57
Static task
static1
Behavioral task
behavioral1
Sample
7f16562c1286daca9bf2552430e12699_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
7f16562c1286daca9bf2552430e12699_JaffaCakes118.dll
-
Size
340KB
-
MD5
7f16562c1286daca9bf2552430e12699
-
SHA1
74dee34888c1f70176af8a1de8815a6f375f199e
-
SHA256
5acee6181ff4d3d06afa73c9c5c7f6828a2c8091a2b613e43d907855a96cd5ff
-
SHA512
9b618235f30f8a7aeb65f893598f594883a60b7456a13f1759f22a1c22cdf58c54cab15ababf8ffe455af3c81c705979c79b996b9e0d22213b42b6f8586db1ec
-
SSDEEP
3072:+vA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:+206xWgGxLxWN40PDKR/JnX2P
Malware Config
Extracted
emotet
Epoch2
69.38.130.14:80
195.159.28.230:8080
162.241.204.233:8080
115.21.224.117:80
78.189.148.42:80
181.165.68.127:80
78.188.225.105:80
161.0.153.60:80
89.106.251.163:80
172.125.40.123:80
5.39.91.110:7080
110.145.11.73:80
190.251.200.206:80
144.217.7.207:7080
75.109.111.18:80
75.177.207.146:80
139.59.60.244:8080
70.183.211.3:80
95.213.236.64:8080
61.19.246.238:443
174.118.202.24:443
71.72.196.159:80
138.68.87.218:443
24.164.79.147:8080
49.205.182.134:80
24.231.88.85:80
121.124.124.40:7080
95.9.5.93:80
118.83.154.64:443
78.24.219.147:8080
104.131.11.150:443
85.105.205.77:8080
108.53.88.101:443
187.161.206.24:80
203.153.216.189:7080
37.187.72.193:8080
185.94.252.104:443
157.245.99.39:8080
50.91.114.38:80
87.106.139.101:8080
74.128.121.17:80
62.75.141.82:80
37.139.21.175:8080
190.103.228.24:80
134.209.144.106:443
78.182.254.231:80
186.74.215.34:80
180.222.161.85:80
69.49.88.46:80
202.134.4.211:8080
75.113.193.72:80
139.162.60.124:8080
79.137.83.50:443
123.176.25.234:80
172.105.13.66:443
93.146.48.84:80
109.116.245.80:80
41.185.28.84:8080
98.109.133.80:80
194.190.67.75:80
110.145.101.66:443
136.244.110.184:8080
24.179.13.119:80
89.216.122.92:80
139.99.158.11:443
172.86.188.251:8080
74.40.205.197:443
62.171.142.179:8080
167.114.153.111:8080
119.59.116.21:8080
74.58.215.226:80
188.165.214.98:8080
172.104.97.173:8080
197.211.245.21:80
66.57.108.14:443
188.219.31.12:80
168.235.67.138:7080
24.69.65.8:8080
173.70.61.180:80
110.142.236.207:80
51.89.36.180:443
46.105.131.79:8080
194.4.58.192:7080
220.245.198.194:80
109.74.5.95:8080
24.178.90.49:80
181.171.209.241:443
59.21.235.119:80
94.23.237.171:443
12.175.220.98:80
217.20.166.178:7080
50.116.111.59:8080
176.111.60.55:8080
200.116.145.225:443
120.150.60.189:80
185.201.9.197:8080
202.134.4.216:8080
120.150.218.241:443
2.58.16.89:8080
70.92.118.112:80
74.208.45.104:8080
79.130.130.240:8080
190.240.194.77:443
85.105.111.166:80
115.94.207.99:443
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3728 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Gbzjnuwcxzf\vnuwejkpdd.akx rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4312 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3908 wrote to memory of 4312 3908 rundll32.exe 85 PID 3908 wrote to memory of 4312 3908 rundll32.exe 85 PID 3908 wrote to memory of 4312 3908 rundll32.exe 85 PID 4312 wrote to memory of 3728 4312 rundll32.exe 97 PID 4312 wrote to memory of 3728 4312 rundll32.exe 97 PID 4312 wrote to memory of 3728 4312 rundll32.exe 97
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f16562c1286daca9bf2552430e12699_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f16562c1286daca9bf2552430e12699_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gbzjnuwcxzf\vnuwejkpdd.akx",tRgjwJCbSiS3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3728
-
-
Network
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.28.10150.171.27.10
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
92.12.20.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD57f16562c1286daca9bf2552430e12699
SHA174dee34888c1f70176af8a1de8815a6f375f199e
SHA2565acee6181ff4d3d06afa73c9c5c7f6828a2c8091a2b613e43d907855a96cd5ff
SHA5129b618235f30f8a7aeb65f893598f594883a60b7456a13f1759f22a1c22cdf58c54cab15ababf8ffe455af3c81c705979c79b996b9e0d22213b42b6f8586db1ec