Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 00:32
General
-
Target
d55f3c3170a59d8af564984b04ba5877_JaffaCakes118.exe
-
Size
100KB
-
MD5
d55f3c3170a59d8af564984b04ba5877
-
SHA1
8399976585187b13a848b12ae4bf20f5a068531e
-
SHA256
4c49c949d51831367b51f0d91415e5f93d7814fe58ee891ca69673c6d245f154
-
SHA512
f2c35f1af885b2948ab46ff23c0cea885cd1126863c1565e68daf087cee710cfee18c3820ace9146b3aa978b084ac7a23d2112327675b254693311e84cf23bf7
-
SSDEEP
1536:+tKTS1S4NjLEewIKoYhSV2XNkBjouidEXR:+tKTS5LEewIKBh+uW2uGg
Malware Config
Extracted
emotet
Epoch3
118.110.236.121:8080
149.202.5.139:443
153.92.4.96:8080
51.75.163.68:7080
46.32.229.152:8080
192.241.220.183:8080
173.94.215.84:80
188.0.135.237:80
45.182.161.17:80
74.208.173.91:8080
81.214.253.80:443
157.7.164.178:8081
162.249.220.190:80
192.163.221.191:8080
77.74.78.80:443
175.29.183.2:80
190.190.15.20:80
188.251.213.180:443
222.159.240.58:80
175.139.144.229:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d55f3c3170a59d8af564984b04ba5877_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d55f3c3170a59d8af564984b04ba5877_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
48KB