Analysis
-
max time kernel
1799s -
max time network
1800s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 15:51
Static task
static1
Behavioral task
behavioral1
Sample
f657465b2e5d79a92995cde32d5a376e_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
12 signatures
1800 seconds
Behavioral task
behavioral2
Sample
f657465b2e5d79a92995cde32d5a376e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
1800 seconds
General
-
Target
f657465b2e5d79a92995cde32d5a376e_JaffaCakes118.dll
-
Size
330KB
-
MD5
f657465b2e5d79a92995cde32d5a376e
-
SHA1
d5a03a38071a440cb7aa120957e455ac19db1bb9
-
SHA256
76b1c2cd3bce3c9964b8efd2ba92edd30d660fc2e7c4e3de291967cb527e8cbf
-
SHA512
7e54d613b4a32656cb34027f994514751797d889e4e8b2e1f64dfa99f85e63c7b00bf5150622d7ace87985e41acf825462ed8f2fe99f4789a0a35004da977373
-
SSDEEP
3072:SRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Mq1sFAwgwmBv3wnIgG4oAYxvU54eu
Malware Config
Extracted
Family
emotet
Botnet
Epoch3
C2
190.55.186.229:80
203.157.152.9:7080
157.245.145.87:443
109.99.146.210:8080
116.202.10.123:8080
172.96.190.154:8080
163.53.204.180:443
190.107.118.125:80
91.93.3.85:8080
185.142.236.163:443
115.79.195.246:80
120.51.34.254:80
192.210.217.94:8080
198.20.228.9:8080
91.75.75.46:80
54.38.143.245:8080
161.49.84.2:80
162.144.145.58:8080
178.33.167.120:8080
201.193.160.196:80
143.95.101.72:8080
37.205.9.252:7080
178.62.254.156:8080
103.80.51.61:8080
74.208.173.91:8080
203.153.216.178:7080
152.32.75.74:443
37.46.129.215:8080
70.32.89.105:8080
179.233.3.89:80
132.248.38.158:80
103.229.73.17:8080
2.58.16.86:8080
82.78.179.117:443
139.59.61.215:443
75.127.14.170:8080
78.90.78.210:80
122.116.104.238:8443
5.79.70.250:8080
182.73.7.59:8080
192.163.221.191:8080
139.59.12.63:8080
190.19.169.69:443
58.27.215.3:8080
201.163.74.204:80
175.103.38.146:80
139.5.101.203:80
201.212.61.66:80
117.2.139.117:443
186.96.170.61:80
50.116.78.109:8080
68.133.75.203:8080
183.91.3.63:80
65.32.168.171:80
172.104.46.84:8080
27.78.27.110:443
172.193.14.201:80
103.93.220.182:80
49.206.16.156:80
223.17.215.76:80
203.56.191.129:8080
195.159.28.244:8080
195.201.56.70:8080
110.37.224.243:80
110.172.180.180:8080
188.166.220.180:7080
180.148.4.130:8080
157.7.164.178:8081
88.58.209.2:80
91.83.93.103:443
24.230.124.78:80
8.4.9.137:8080
203.160.167.243:80
192.241.220.183:8080
79.133.6.236:8080
186.146.229.172:80
46.105.131.68:8080
178.254.36.182:8080
46.32.229.152:8080
202.29.237.113:8080
185.208.226.142:8080
2.82.75.215:80
190.85.46.52:7080
190.18.184.113:80
188.226.165.170:8080
rsa_pubkey.plain
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 4 3016 rundll32.exe 7 3016 rundll32.exe 8 3016 rundll32.exe 9 3016 rundll32.exe 12 3016 rundll32.exe 13 3016 rundll32.exe 15 3016 rundll32.exe 16 3016 rundll32.exe 17 3016 rundll32.exe 21 3016 rundll32.exe 24 3016 rundll32.exe 25 3016 rundll32.exe 28 3016 rundll32.exe 29 3016 rundll32.exe 30 3016 rundll32.exe 34 3016 rundll32.exe 37 3016 rundll32.exe 38 3016 rundll32.exe 41 3016 rundll32.exe 42 3016 rundll32.exe 45 3016 rundll32.exe 47 3016 rundll32.exe 48 3016 rundll32.exe 51 3016 rundll32.exe 52 3016 rundll32.exe 53 3016 rundll32.exe 54 3016 rundll32.exe 55 3016 rundll32.exe 57 3016 rundll32.exe 59 3016 rundll32.exe 61 3016 rundll32.exe 62 3016 rundll32.exe 65 3016 rundll32.exe 68 3016 rundll32.exe 70 3016 rundll32.exe 71 3016 rundll32.exe 72 3016 rundll32.exe 75 3016 rundll32.exe 76 3016 rundll32.exe 77 3016 rundll32.exe 81 3016 rundll32.exe 82 3016 rundll32.exe 83 3016 rundll32.exe 86 3016 rundll32.exe 87 3016 rundll32.exe 88 3016 rundll32.exe 92 3016 rundll32.exe 95 3016 rundll32.exe 96 3016 rundll32.exe 99 3016 rundll32.exe 100 3016 rundll32.exe 101 3016 rundll32.exe 103 3016 rundll32.exe 106 3016 rundll32.exe 107 3016 rundll32.exe 108 3016 rundll32.exe 109 3016 rundll32.exe 112 3016 rundll32.exe 114 3016 rundll32.exe 117 3016 rundll32.exe 118 3016 rundll32.exe 121 3016 rundll32.exe 122 3016 rundll32.exe 123 3016 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 19002f433a5c000000000000000000000000000000000000000000 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 52003100000000002359c32b100057696e646f7773003c0008000400efbeee3a851a2359c32b2a0000008a020000000001000000000000000000000000000000570069006e0064006f0077007300000016000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 = 56003100000000003959647e100053797374656d333200003e0008000400efbeee3a861a3959647e2a00000027090000000001000000000000000000000000000000530079007300740065006d0033003200000018000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 taskmgr.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\NodeSlot = "3" taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags taskmgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3016 rundll32.exe 3016 rundll32.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 3016 rundll32.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2772 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2772 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe 2772 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2772 taskmgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1928 wrote to memory of 3016 1928 rundll32.exe 30 PID 1928 wrote to memory of 3016 1928 rundll32.exe 30 PID 1928 wrote to memory of 3016 1928 rundll32.exe 30 PID 1928 wrote to memory of 3016 1928 rundll32.exe 30 PID 1928 wrote to memory of 3016 1928 rundll32.exe 30 PID 1928 wrote to memory of 3016 1928 rundll32.exe 30 PID 1928 wrote to memory of 3016 1928 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f657465b2e5d79a92995cde32d5a376e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f657465b2e5d79a92995cde32d5a376e_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2384
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b