Analysis

  • max time kernel
    131s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 04:26

General

  • Target

    ef109e318eac0febf15b25f850c79d4f_JaffaCakes118.exe

  • Size

    132KB

  • MD5

    ef109e318eac0febf15b25f850c79d4f

  • SHA1

    4a41a4e6029f9ee640922cf13c48311a7c7bc9ed

  • SHA256

    5a276f6be10c865870b8530bfe23d89d7d8849bccbe07a6552b95f3b888291b9

  • SHA512

    668b63525b813b25de0df9174e5ca1f52088136d3fdda4f107022f21b0d2b0eaf60f6f209daca41d5813ec0373da70ed5ed3f52304d42386b1b6a325f1fc2f0f

  • SSDEEP

    3072:ZVpq/s1jBK3dVMyppP21kJHGrLd7wDTHgWL3hPhSwhv:ZVpqkZGdaU2GG7WHgWLxpB

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef109e318eac0febf15b25f850c79d4f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef109e318eac0febf15b25f850c79d4f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\ef109e318eac0febf15b25f850c79d4f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\ef109e318eac0febf15b25f850c79d4f_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      PID:2668
  • C:\Windows\SysWOW64\wcsalaska.exe
    "C:\Windows\SysWOW64\wcsalaska.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\SysWOW64\wcsalaska.exe
      "C:\Windows\SysWOW64\wcsalaska.exe"
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2768

Network

    No results found
  • 96.20.172.107:8443
    wcsalaska.exe
    152 B
    3
  • 96.20.172.107:8443
    wcsalaska.exe
    152 B
    3
  • 64.19.74.49:8080
    wcsalaska.exe
    152 B
    3
  • 64.19.74.49:8080
    wcsalaska.exe
    152 B
    3
  • 99.139.140.129:80
    wcsalaska.exe
    152 B
    3
  • 99.139.140.129:80
    wcsalaska.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2484-18-0x0000000000390000-0x00000000003A8000-memory.dmp

    Filesize

    96KB

  • memory/2484-17-0x0000000000350000-0x000000000036A000-memory.dmp

    Filesize

    104KB

  • memory/2484-13-0x0000000000370000-0x000000000038A000-memory.dmp

    Filesize

    104KB

  • memory/2668-26-0x00000000000D0000-0x00000000000EA000-memory.dmp

    Filesize

    104KB

  • memory/2668-25-0x0000000000320000-0x0000000000343000-memory.dmp

    Filesize

    140KB

  • memory/2668-11-0x00000000002A0000-0x00000000002B8000-memory.dmp

    Filesize

    96KB

  • memory/2668-10-0x00000000000D0000-0x00000000000EA000-memory.dmp

    Filesize

    104KB

  • memory/2668-6-0x0000000000100000-0x000000000011A000-memory.dmp

    Filesize

    104KB

  • memory/2768-24-0x0000000000150000-0x0000000000168000-memory.dmp

    Filesize

    96KB

  • memory/2768-19-0x0000000000110000-0x000000000012A000-memory.dmp

    Filesize

    104KB

  • memory/2768-20-0x0000000000130000-0x000000000014A000-memory.dmp

    Filesize

    104KB

  • memory/2768-27-0x0000000000110000-0x000000000012A000-memory.dmp

    Filesize

    104KB

  • memory/2972-12-0x0000000000100000-0x000000000011A000-memory.dmp

    Filesize

    104KB

  • memory/2972-4-0x0000000000100000-0x000000000011A000-memory.dmp

    Filesize

    104KB

  • memory/2972-5-0x0000000000140000-0x0000000000158000-memory.dmp

    Filesize

    96KB

  • memory/2972-0-0x0000000000120000-0x000000000013A000-memory.dmp

    Filesize

    104KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.