Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 19:08
Static task
static1
Behavioral task
behavioral1
Sample
e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
-
Size
267KB
-
MD5
e56bc5b4d75edb4fc828e96295ed7393
-
SHA1
e80f5d5b4c5ba6c56ae4a984d9c2c7ca83ddef26
-
SHA256
49c7a0dc3be0defefcc2b1a0ca5b30a3365434cd018973c076af69e953f41d9c
-
SHA512
2f85af18a060f9540c5430dadb5beb04b3df72f7d9589dc7861a3c23da5ab3f121432e5265e9b70535a007d5b967ff4164a70b97cb7c75adbc187adea3448688
-
SSDEEP
6144:ed8GfgPu1jnIm2rJ3Rbn7lqCc1dLe0XYg27TyOJWmaTlBcdpPk+UyY:ed8o1jCIXLe0P2ndWzlfD
Malware Config
Extracted
emotet
Epoch1
172.104.233.225:8080
70.32.78.99:8080
213.189.36.51:8080
107.170.27.84:443
181.135.153.203:443
94.183.71.206:7080
87.118.70.69:8080
69.163.33.84:8080
86.42.166.147:80
181.16.17.210:443
111.119.233.65:80
81.169.140.14:443
119.59.124.163:8080
186.15.83.52:8080
163.172.40.218:7080
62.75.143.100:7080
181.91.215.151:990
5.196.35.138:7080
14.160.93.230:80
68.183.190.199:8080
51.255.165.160:8080
85.234.143.94:8080
181.231.62.54:80
68.183.170.114:8080
207.154.204.40:8080
217.199.160.224:8080
110.93.247.98:443
203.25.159.3:8080
185.86.148.222:8080
144.139.158.155:80
183.82.97.25:80
91.205.215.57:7080
178.79.163.131:8080
187.230.99.192:443
46.28.111.142:7080
186.1.41.111:443
77.55.211.77:8080
190.97.30.167:990
91.83.93.124:7080
190.4.50.26:80
154.120.227.206:8080
46.41.151.103:8080
60.54.37.25:80
82.196.15.205:8080
92.169.250.229:8080
50.28.51.143:8080
81.213.215.216:50000
201.190.133.235:8080
201.163.74.202:443
212.71.237.140:8080
190.195.129.227:8090
104.131.58.132:8080
186.23.132.93:990
149.62.173.247:8080
134.209.214.126:8080
51.15.8.192:8080
190.38.14.52:80
189.141.224.163:443
201.213.32.59:80
181.36.42.205:443
190.146.131.105:8080
80.85.87.122:8080
88.250.223.190:8080
138.68.106.4:7080
77.245.101.134:8080
45.79.95.107:443
89.188.124.145:443
170.130.31.177:8080
203.130.0.69:80
76.69.29.42:80
159.203.204.126:8080
181.198.203.45:443
91.204.163.19:8090
190.210.184.138:995
62.75.160.178:8080
125.99.61.162:7080
139.5.237.27:443
142.93.114.137:8080
109.169.86.13:8080
46.101.212.195:8080
96.20.84.254:7080
200.113.106.18:80
87.106.77.40:7080
200.58.83.179:80
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 sensorfill.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE sensorfill.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies sensorfill.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 sensorfill.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sensorfill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sensorfill.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sensorfill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" sensorfill.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" sensorfill.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe 3160 sensorfill.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 788 e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2672 wrote to memory of 788 2672 e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe 84 PID 2672 wrote to memory of 788 2672 e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe 84 PID 2672 wrote to memory of 788 2672 e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe 84 PID 4408 wrote to memory of 3160 4408 sensorfill.exe 91 PID 4408 wrote to memory of 3160 4408 sensorfill.exe 91 PID 4408 wrote to memory of 3160 4408 sensorfill.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe--1122cc3b2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:788
-
-
C:\Windows\SysWOW64\sensorfill.exe"C:\Windows\SysWOW64\sensorfill.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\sensorfill.exe--56baf68f2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\e33aec243fbda420976c3735c1f68a0d_c186ecc3-67e4-4d2b-8682-b6c322da87aa
Filesize50B
MD5d3b2072f22c54a987baf5b09bc63a002
SHA1e405a097074ca95e27198f3f5279be9aa01536ff
SHA256c6af0c5856ec37ae236b3086cae6caeba8b637db0144d3581d53cf65cf5013e8
SHA512d76f5e53fc0568ec48fb67ae02974fb9832e821a34683f56348c15aeaaf3a03312e3fa2e27579ac94145967ae221c2dc8e322ce0fe3c4d9242505b44c05ddbdf