Analysis
-
max time kernel
1798s -
max time network
1800s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 07:46
Static task
static1
Behavioral task
behavioral1
Sample
b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe
-
Size
304KB
-
MD5
b267a08d8e8549d97a43a812795c6574
-
SHA1
2c08e0add27dfba945195f74d28918fd7b3d3818
-
SHA256
3f958042bb23e821df3e9a3a95c6fc27be6655d1bd89e2c4bb859aecd92c6ae5
-
SHA512
3fe6fb4d1a85e6c6518c07c2ff29ee7817ec7e96f8d269f6262485b3cf7a794aa4661e40231c65eb31b2ea18f8f6950260e81b22e3250bb5a955432b7607b9a8
-
SSDEEP
3072:J9zXQj0GpJ4viKir9bXpakjnUvbx8ZlVxCM2B7p2V3++1qyqL5M+X6lppI17:J5XQgGpJKkVXJTk7p2/x46lpK
Malware Config
Extracted
emotet
Epoch2
24.43.32.186:80
38.111.46.46:8080
134.209.36.254:8080
162.241.242.173:8080
74.120.55.163:80
61.92.17.12:80
219.74.18.66:443
156.155.166.221:80
104.131.44.150:8080
37.139.21.175:8080
94.1.108.190:443
169.239.182.217:8080
220.245.198.194:80
139.99.158.11:443
91.211.88.52:7080
62.75.141.82:80
174.45.13.118:80
137.119.36.33:80
188.219.31.12:80
103.86.49.11:8080
104.131.11.150:443
124.41.215.226:80
78.187.156.31:80
104.32.141.43:80
47.144.21.12:443
93.147.212.206:80
200.123.150.89:443
121.7.127.163:80
200.114.213.233:8080
94.200.114.161:80
24.179.13.119:80
84.39.182.7:80
97.82.79.83:80
87.106.136.232:8080
5.196.74.210:8080
24.43.99.75:80
213.196.135.145:80
94.23.237.171:443
74.134.41.124:80
96.249.236.156:443
95.213.236.64:8080
137.59.187.107:8080
75.139.38.211:80
82.225.49.121:80
123.176.25.234:80
194.187.133.160:443
62.30.7.67:443
109.74.5.95:8080
176.111.60.55:8080
24.137.76.62:80
37.187.72.193:8080
110.145.77.103:80
153.137.36.142:80
1.221.254.82:80
195.7.12.8:80
110.5.16.198:80
185.94.252.104:443
104.236.246.93:8080
78.24.219.147:8080
85.152.162.105:80
85.105.205.77:8080
139.59.60.244:8080
79.137.83.50:443
50.91.114.38:80
172.91.208.86:80
74.219.172.26:80
83.169.36.251:8080
153.232.188.106:80
209.141.54.221:8080
168.235.67.138:7080
139.130.242.43:80
121.124.124.40:7080
89.216.122.92:80
203.153.216.189:7080
187.161.206.24:80
157.245.99.39:8080
195.251.213.56:80
71.72.196.159:80
174.102.48.180:443
181.169.34.190:80
140.186.212.146:80
201.173.217.124:443
42.200.107.142:80
79.98.24.39:8080
5.39.91.110:7080
139.162.108.71:8080
74.208.45.104:8080
61.19.246.238:443
50.35.17.13:80
95.179.229.244:8080
216.139.123.119:80
120.150.60.189:80
219.75.128.166:80
68.188.112.97:80
107.5.122.110:80
87.106.139.101:8080
46.105.131.79:8080
82.80.155.43:80
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2872-0-0x0000000000240000-0x0000000000252000-memory.dmp emotet behavioral1/memory/2872-4-0x0000000000260000-0x0000000000270000-memory.dmp emotet behavioral1/memory/2872-7-0x0000000000230000-0x000000000023F000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
Processes:
winsockhc.exepid process 2640 winsockhc.exe -
Drops file in System32 directory 1 IoCs
Processes:
b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\dmdskmgr\winsockhc.exe b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
winsockhc.exepid process 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe 2640 winsockhc.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exepid process 2872 b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exedescription pid process target process PID 2872 wrote to memory of 2640 2872 b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe winsockhc.exe PID 2872 wrote to memory of 2640 2872 b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe winsockhc.exe PID 2872 wrote to memory of 2640 2872 b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe winsockhc.exe PID 2872 wrote to memory of 2640 2872 b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe winsockhc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b267a08d8e8549d97a43a812795c6574_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dmdskmgr\winsockhc.exe"C:\Windows\SysWOW64\dmdskmgr\winsockhc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\dmdskmgr\winsockhc.exeFilesize
304KB
MD5b267a08d8e8549d97a43a812795c6574
SHA12c08e0add27dfba945195f74d28918fd7b3d3818
SHA2563f958042bb23e821df3e9a3a95c6fc27be6655d1bd89e2c4bb859aecd92c6ae5
SHA5123fe6fb4d1a85e6c6518c07c2ff29ee7817ec7e96f8d269f6262485b3cf7a794aa4661e40231c65eb31b2ea18f8f6950260e81b22e3250bb5a955432b7607b9a8
-
memory/2872-0-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2872-4-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/2872-7-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/2872-9-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB