emotet | 4e5a081de684a1b7dfc94683ee9a9514397b2889669b31480f3a15c122f74d4d

Analysis

max time kernel
139s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
Size

244KB
MD5

1b0bf8a16f6bec1b79b8355a35f040eb
SHA1

0bd77d6a9e9158d897c0b310c6e3225e69e65cdf
SHA256

4e5a081de684a1b7dfc94683ee9a9514397b2889669b31480f3a15c122f74d4d
SHA512

68b1b9b14599a2b8f812e4c80130edd586a013b3aa42386b85c37074395509d4787799c8550ad4a5547344c5ace4984c5c187a5be3d783e1c6deffd784f21aab
SSDEEP

3072:z6nl1RuGUvgeg55WRYrp3s9W3Heu65IZwC5:en7rUvTGBp3qW3Heij5

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Drops file in System32 directory 1 IoCs

Processes:

jerseymfidl.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat jerseymfidl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	jerseymfidl.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

jerseymfidl.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jerseymfidl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	jerseymfidl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadDecisionReason = "1"	jerseymfidl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadDecision = "0"	jerseymfidl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadNetworkName = "Network 3"	jerseymfidl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	jerseymfidl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	jerseymfidl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	jerseymfidl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7\WpadDecision = "0"	jerseymfidl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0064000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jerseymfidl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}	jerseymfidl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\WpadDecisionTime = b09fd59fa6cbda01	jerseymfidl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	jerseymfidl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jerseymfidl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	jerseymfidl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7\WpadDecisionTime = b09fd59fa6cbda01	jerseymfidl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	jerseymfidl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5795B581-5DB6-4FFF-AC52-E33B4B68711D}\62-87-f1-8e-c4-b7	jerseymfidl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7\WpadDecisionReason = "1"	jerseymfidl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	jerseymfidl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-87-f1-8e-c4-b7	jerseymfidl.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exejerseymfidl.exejerseymfidl.exe

pid	process
2976	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
1972	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
2040	jerseymfidl.exe
2648	jerseymfidl.exe
2648	jerseymfidl.exe
2648	jerseymfidl.exe
2648	jerseymfidl.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe

pid process

1972 1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
Suspicious use of UnmapMainImage 4 IoCs

Processes:

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exejerseymfidl.exejerseymfidl.exe

pid process

2976 1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
1972 1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
2040 jerseymfidl.exe
2648 jerseymfidl.exe

pid	process
1972	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exejerseymfidl.exe

description	pid	process	target process
PID 2976 wrote to memory of 1972	2976	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
PID 2976 wrote to memory of 1972	2976	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
PID 2976 wrote to memory of 1972	2976	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
PID 2976 wrote to memory of 1972	2976	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
PID 2040 wrote to memory of 2648	2040	jerseymfidl.exe	jerseymfidl.exe
PID 2040 wrote to memory of 2648	2040	jerseymfidl.exe	jerseymfidl.exe
PID 2040 wrote to memory of 2648	2040	jerseymfidl.exe	jerseymfidl.exe
PID 2040 wrote to memory of 2648	2040	jerseymfidl.exe	jerseymfidl.exe

C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1972

C:\Windows\SysWOW64\jerseymfidl.exe
"C:\Windows\SysWOW64\jerseymfidl.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\jerseymfidl.exe
"C:\Windows\SysWOW64\jerseymfidl.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1972-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1972-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2040-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2648-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2648-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2648-11-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2976-0-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/2976-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2976-4-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download