Analysis
-
max time kernel
128s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 04:27
Static task
static1
Behavioral task
behavioral1
Sample
b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe
-
Size
364KB
-
MD5
b6befef4fe35518e6ec139eb90b549db
-
SHA1
1059dd200927f4da7cc4be9a182488a00e5b12ce
-
SHA256
e4c250d5484cb84c9bb0932f55491edee4904997f065e7e492ae823ed5e94cfd
-
SHA512
c11291da8b8d11c1e8daf3fcefca88573d0d027c1900c85b97cf5ac03bd3a297c7f1e05ff2a08a587f4dd17fb64f7a9b1b0cf8e20a519bbfa7ed86cd4d7efaa8
-
SSDEEP
6144:1y2JRLj6K2gxsKRTVJO/W5TXfU4qH9qbTebas8PZTwBM:1LJpj6UxTV8/+f00LW
Malware Config
Extracted
emotet
Epoch2
185.234.72.64:443
51.68.220.244:8080
206.81.10.215:8080
206.189.112.148:8080
85.104.59.244:20
37.157.194.134:443
31.172.240.91:8080
87.230.19.21:8080
178.209.71.63:8080
95.128.43.213:8080
190.53.135.159:21
144.139.247.220:80
190.211.207.11:443
181.143.194.138:443
87.106.136.232:8080
200.71.148.138:8080
217.160.182.191:8080
50.116.86.205:8080
167.114.242.226:8080
46.105.131.87:80
171.101.153.86:990
209.97.168.52:8080
92.222.216.44:8080
190.145.67.134:8090
65.23.154.17:8080
183.102.238.69:465
173.212.203.26:8080
186.75.241.230:80
90.77.228.193:8090
91.205.215.66:8080
176.31.200.130:8080
103.39.131.88:80
67.225.179.64:8080
181.31.213.158:8080
94.192.228.255:80
191.92.209.110:7080
5.196.74.210:8080
211.63.71.72:8080
104.236.246.93:8080
149.202.153.252:8080
87.106.139.101:8080
178.210.51.222:8080
138.201.140.110:8080
201.184.105.242:443
62.75.187.192:8080
212.129.24.79:8080
31.31.77.83:443
165.227.156.155:443
192.241.255.77:8080
182.176.132.213:8090
31.12.67.62:7080
169.239.182.217:8080
159.65.25.128:8080
190.147.215.53:22
192.81.213.192:8080
190.226.44.20:21
181.57.193.14:80
45.33.49.124:443
104.131.44.150:8080
107.170.24.125:8080
83.136.245.190:8080
80.11.163.139:21
115.78.95.230:443
104.131.11.150:8080
192.241.220.155:8080
167.71.10.37:8080
59.103.164.174:80
24.45.193.161:7080
78.24.219.147:8080
189.209.217.49:80
167.99.105.223:7080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
sitkalua.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat sitkalua.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 25 IoCs
Processes:
sitkalua.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84740C32-7556-44DF-993D-F05C7562AC87}\WpadNetworkName = "Network 3" sitkalua.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84740C32-7556-44DF-993D-F05C7562AC87}\fe-a3-50-a3-bf-31 sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84740C32-7556-44DF-993D-F05C7562AC87}\WpadDecisionTime = c0d101f26ec0da01 sitkalua.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84740C32-7556-44DF-993D-F05C7562AC87}\WpadDecisionTime = a00233ce6ec0da01 sitkalua.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-a3-50-a3-bf-31\WpadDetectedUrl sitkalua.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84740C32-7556-44DF-993D-F05C7562AC87} sitkalua.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84740C32-7556-44DF-993D-F05C7562AC87}\WpadDecisionReason = "1" sitkalua.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections sitkalua.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84740C32-7556-44DF-993D-F05C7562AC87}\WpadDecision = "0" sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sitkalua.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-a3-50-a3-bf-31 sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-a3-50-a3-bf-31\WpadDecisionTime = c0d101f26ec0da01 sitkalua.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings sitkalua.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" sitkalua.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-a3-50-a3-bf-31\WpadDecision = "0" sitkalua.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" sitkalua.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sitkalua.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-a3-50-a3-bf-31\WpadDecisionReason = "1" sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ee000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sitkalua.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-a3-50-a3-bf-31\WpadDecisionTime = a00233ce6ec0da01 sitkalua.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sitkalua.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ee000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sitkalua.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
sitkalua.exepid process 2704 sitkalua.exe 2704 sitkalua.exe 2704 sitkalua.exe 2704 sitkalua.exe 2704 sitkalua.exe 2704 sitkalua.exe 2704 sitkalua.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exepid process 2344 b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exeb6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exesitkalua.exesitkalua.exepid process 2880 b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe 2344 b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe 2052 sitkalua.exe 2704 sitkalua.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exesitkalua.exedescription pid process target process PID 2880 wrote to memory of 2344 2880 b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe PID 2880 wrote to memory of 2344 2880 b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe PID 2880 wrote to memory of 2344 2880 b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe PID 2880 wrote to memory of 2344 2880 b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe PID 2052 wrote to memory of 2704 2052 sitkalua.exe sitkalua.exe PID 2052 wrote to memory of 2704 2052 sitkalua.exe sitkalua.exe PID 2052 wrote to memory of 2704 2052 sitkalua.exe sitkalua.exe PID 2052 wrote to memory of 2704 2052 sitkalua.exe sitkalua.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b6befef4fe35518e6ec139eb90b549db_JaffaCakes118.exe--c01563a72⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\sitkalua.exe"C:\Windows\SysWOW64\sitkalua.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sitkalua.exe--f7bddfb62⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2052-11-0x00000000003E0000-0x00000000003F7000-memory.dmpFilesize
92KB
-
memory/2344-6-0x0000000000240000-0x0000000000257000-memory.dmpFilesize
92KB
-
memory/2344-16-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2880-0-0x00000000003C0000-0x00000000003D7000-memory.dmpFilesize
92KB
-
memory/2880-5-0x00000000003A0000-0x00000000003B1000-memory.dmpFilesize
68KB