Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 12:31
Static task
static1
Behavioral task
behavioral1
Sample
bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe
-
Size
448KB
-
MD5
bbf176feabfec3ed22ce1261caaf9b4f
-
SHA1
1ecd2fa0d86efcb6b377de7a1d01564190479a85
-
SHA256
2a2fcbc4dba7678968198e402b7832d0b7beb8e98e1cb052ba89e9786d2726a7
-
SHA512
d9097d1b79843a595b4c2c2af96869a3f2511e7369f94aaab37bc2f8438e229cc9b474950a810ef71598397afda43b2f83b0aa85ef1487d9327675be4fd5127b
-
SSDEEP
12288:FfzaBuiszJbE9mO4sl9kVlAOyQkNvOzxMrB:FbMmO4sl9sR2Otq
Malware Config
Extracted
emotet
Epoch2
75.139.38.211:80
69.30.203.214:8080
67.205.85.243:8080
190.160.53.126:80
183.101.175.193:80
137.59.187.107:8080
168.235.67.138:7080
209.143.35.232:80
180.92.239.110:8080
167.86.90.214:8080
85.66.181.138:80
95.213.236.64:8080
83.169.36.251:8080
157.245.99.39:8080
79.98.24.39:8080
70.167.215.250:8080
93.51.50.171:8080
174.102.48.180:80
24.179.13.119:80
41.60.200.34:80
188.83.220.2:443
91.211.88.52:7080
24.43.99.75:80
47.144.21.12:443
37.187.72.193:8080
104.131.44.150:8080
199.101.86.142:8080
116.203.32.252:8080
85.152.162.105:80
83.110.223.58:443
78.24.219.147:8080
62.75.141.82:80
152.168.248.128:443
157.147.76.151:80
24.137.76.62:80
121.124.124.40:7080
62.138.26.28:8080
173.62.217.22:443
107.185.211.16:80
103.86.49.11:8080
113.160.130.116:8443
72.12.127.184:443
181.211.11.242:80
204.197.146.48:80
176.111.60.55:8080
104.236.246.93:8080
97.82.79.83:80
74.208.45.104:8080
87.106.136.232:8080
209.141.54.221:8080
169.239.182.217:8080
110.145.77.103:80
222.214.218.37:4143
165.165.171.160:8080
47.146.117.214:80
139.59.60.244:8080
203.153.216.189:7080
5.196.74.210:8080
37.139.21.175:8080
201.173.217.124:443
47.153.182.47:80
2.58.16.85:7080
109.116.214.124:443
200.41.121.90:80
95.179.229.244:8080
142.105.151.124:443
5.39.91.110:7080
185.94.252.104:443
189.212.199.126:443
109.74.5.95:8080
37.70.8.161:80
190.55.181.54:443
61.19.246.238:443
74.120.55.163:80
85.105.205.77:8080
181.230.116.163:80
104.131.11.150:443
81.2.235.111:8080
203.117.253.142:80
24.233.112.152:80
47.146.32.175:80
76.27.179.47:80
87.106.139.101:8080
46.105.131.79:8080
139.130.242.43:80
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3688-4-0x00000000022E0000-0x00000000022E9000-memory.dmp emotet behavioral2/memory/3688-0-0x0000000002300000-0x000000000230C000-memory.dmp emotet behavioral2/memory/3412-7-0x0000000002710000-0x000000000271C000-memory.dmp emotet behavioral2/memory/3412-11-0x0000000002710000-0x000000000271C000-memory.dmp emotet -
Executes dropped EXE 1 IoCs
Processes:
WindowsCodecsExt.exepid process 3412 WindowsCodecsExt.exe -
Drops file in System32 directory 1 IoCs
Processes:
bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\uxtheme\WindowsCodecsExt.exe bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WindowsCodecsExt.exepid process 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exepid process 3688 bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exeWindowsCodecsExt.exepid process 3688 bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe 3688 bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe 3412 WindowsCodecsExt.exe 3412 WindowsCodecsExt.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exedescription pid process target process PID 3688 wrote to memory of 3412 3688 bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe WindowsCodecsExt.exe PID 3688 wrote to memory of 3412 3688 bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe WindowsCodecsExt.exe PID 3688 wrote to memory of 3412 3688 bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe WindowsCodecsExt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bbf176feabfec3ed22ce1261caaf9b4f_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uxtheme\WindowsCodecsExt.exe"C:\Windows\SysWOW64\uxtheme\WindowsCodecsExt.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\uxtheme\WindowsCodecsExt.exeFilesize
448KB
MD5bbf176feabfec3ed22ce1261caaf9b4f
SHA11ecd2fa0d86efcb6b377de7a1d01564190479a85
SHA2562a2fcbc4dba7678968198e402b7832d0b7beb8e98e1cb052ba89e9786d2726a7
SHA512d9097d1b79843a595b4c2c2af96869a3f2511e7369f94aaab37bc2f8438e229cc9b474950a810ef71598397afda43b2f83b0aa85ef1487d9327675be4fd5127b
-
memory/3412-7-0x0000000002710000-0x000000000271C000-memory.dmpFilesize
48KB
-
memory/3412-11-0x0000000002710000-0x000000000271C000-memory.dmpFilesize
48KB
-
memory/3688-4-0x00000000022E0000-0x00000000022E9000-memory.dmpFilesize
36KB
-
memory/3688-0-0x0000000002300000-0x000000000230C000-memory.dmpFilesize
48KB
-
memory/3688-6-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB