Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 17:42
Static task
static1
Behavioral task
behavioral1
Sample
aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe
-
Size
292KB
-
MD5
aaf5f266a90d1451895c0d94b4e514fc
-
SHA1
d06183fd79be3843ed23328e26183eb0eef2bf57
-
SHA256
c6563c7ca6abb8f7a31847fc4588894cc178d1e7d48e8f53de8cebe9b4f775f7
-
SHA512
a7735cd46758ff49ff42f31f910ce53fa070e3ef7cfa3ce73d9d6d7ee10ac2d9486ab27714133432a1f852ed057a1ce12258920f6a431b24fb898c89d2a9995e
-
SSDEEP
3072:MVwGs+K2E4uoG+CFT7xtNX0o9g1zrXBlC5eTFQqibjYSPC0u8OMGeIkSJxDNZ6E5:hG8+UnFT9IAg1X4eTqqFuu8Qefyx3N5
Malware Config
Extracted
emotet
Epoch2
71.72.196.159:80
134.209.36.254:8080
120.138.30.150:8080
94.23.216.33:80
157.245.99.39:8080
137.59.187.107:8080
94.23.237.171:443
61.19.246.238:443
156.155.166.221:80
50.35.17.13:80
153.137.36.142:80
91.211.88.52:7080
209.141.54.221:8080
185.94.252.104:443
174.45.13.118:80
87.106.136.232:8080
62.75.141.82:80
213.196.135.145:80
188.219.31.12:80
82.80.155.43:80
187.161.206.24:80
172.91.208.86:80
124.41.215.226:80
107.5.122.110:80
200.123.150.89:443
95.179.229.244:8080
83.169.36.251:8080
1.221.254.82:80
95.213.236.64:8080
181.169.34.190:80
47.144.21.12:443
203.153.216.189:7080
89.216.122.92:80
84.39.182.7:80
94.200.114.161:80
104.236.246.93:8080
139.99.158.11:443
176.111.60.55:8080
78.24.219.147:8080
220.245.198.194:80
62.30.7.67:443
139.162.108.71:8080
104.32.141.43:80
153.232.188.106:80
93.147.212.206:80
79.137.83.50:443
96.249.236.156:443
24.43.99.75:80
75.80.124.4:80
42.200.107.142:80
110.5.16.198:80
5.196.74.210:8080
110.145.77.103:80
200.114.213.233:8080
85.152.162.105:80
5.39.91.110:7080
109.74.5.95:8080
140.186.212.146:80
37.187.72.193:8080
97.82.79.83:80
139.130.242.43:80
201.173.217.124:443
123.176.25.234:80
104.131.44.150:8080
74.208.45.104:8080
139.59.60.244:8080
120.150.60.189:80
74.219.172.26:80
219.75.128.166:80
82.225.49.121:80
85.105.205.77:8080
24.179.13.119:80
74.120.55.163:80
174.102.48.180:443
219.74.18.66:443
168.235.67.138:7080
194.187.133.160:443
78.187.156.31:80
103.86.49.11:8080
61.92.17.12:80
24.137.76.62:80
104.131.11.150:443
79.98.24.39:8080
75.139.38.211:80
162.241.242.173:8080
195.251.213.56:80
37.139.21.175:8080
46.105.131.79:8080
50.91.114.38:80
121.124.124.40:7080
74.134.41.124:80
68.188.112.97:80
137.119.36.33:80
121.7.127.163:80
87.106.139.101:8080
94.1.108.190:443
169.239.182.217:8080
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4588-4-0x00000000006B0000-0x00000000006C0000-memory.dmp emotet behavioral2/memory/4588-0-0x0000000000690000-0x00000000006A2000-memory.dmp emotet behavioral2/memory/4588-7-0x0000000000680000-0x000000000068F000-memory.dmp emotet behavioral2/memory/2512-14-0x0000000002090000-0x00000000020A0000-memory.dmp emotet behavioral2/memory/2512-10-0x0000000000500000-0x0000000000512000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
Processes:
Windows.Perception.Stub.exepid process 2512 Windows.Perception.Stub.exe -
Drops file in System32 directory 1 IoCs
Processes:
aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\TCPSVCS\Windows.Perception.Stub.exe aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Windows.Perception.Stub.exepid process 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe 2512 Windows.Perception.Stub.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exepid process 4588 aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exeWindows.Perception.Stub.exepid process 4588 aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe 2512 Windows.Perception.Stub.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exedescription pid process target process PID 4588 wrote to memory of 2512 4588 aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe Windows.Perception.Stub.exe PID 4588 wrote to memory of 2512 4588 aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe Windows.Perception.Stub.exe PID 4588 wrote to memory of 2512 4588 aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe Windows.Perception.Stub.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aaf5f266a90d1451895c0d94b4e514fc_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TCPSVCS\Windows.Perception.Stub.exe"C:\Windows\SysWOW64\TCPSVCS\Windows.Perception.Stub.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\TCPSVCS\Windows.Perception.Stub.exeFilesize
292KB
MD5aaf5f266a90d1451895c0d94b4e514fc
SHA1d06183fd79be3843ed23328e26183eb0eef2bf57
SHA256c6563c7ca6abb8f7a31847fc4588894cc178d1e7d48e8f53de8cebe9b4f775f7
SHA512a7735cd46758ff49ff42f31f910ce53fa070e3ef7cfa3ce73d9d6d7ee10ac2d9486ab27714133432a1f852ed057a1ce12258920f6a431b24fb898c89d2a9995e
-
memory/2512-14-0x0000000002090000-0x00000000020A0000-memory.dmpFilesize
64KB
-
memory/2512-10-0x0000000000500000-0x0000000000512000-memory.dmpFilesize
72KB
-
memory/4588-4-0x00000000006B0000-0x00000000006C0000-memory.dmpFilesize
64KB
-
memory/4588-0-0x0000000000690000-0x00000000006A2000-memory.dmpFilesize
72KB
-
memory/4588-7-0x0000000000680000-0x000000000068F000-memory.dmpFilesize
60KB
-
memory/4588-8-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB