Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 17:05
Static task
static1
Behavioral task
behavioral1
Sample
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
ea7b951cd02856e10eb2316f141c5107
-
SHA1
5700aeb775258508491cd7bc735adaee26da67be
-
SHA256
ca9e376c93bcc57e658566cdb0b0f68d6417a6e6e69705f5c9fa883d5c82282f
-
SHA512
570bacaf2e398f31736936350542151cd3cd5e785de5d3a750ceab2ac455b50c22af85042496a846bb18224257fbd7b7b4c02800a04638da0fee1d84415fd15c
-
SSDEEP
12288:FthatZrYWF1dLSBr7QlU2+BbkB1/L8R4jGjeEPMIthO/W1Ad9S2NVvz6Sgq7qrcc:Ft8tuWFOBrc62is8iKXOSQTEcAS
Malware Config
Extracted
remcos
1.7 Pro
Host
gdyhjjdhbvxgsfe.gotdns.ch:1996
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
fsd.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_lrqrjhqsyqtzudh
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
ioa
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
fsd.exefsd.exefsd.exefsd.exefsd.exefsd.exepid process 284 fsd.exe 1384 fsd.exe 1436 fsd.exe 112 fsd.exe 1380 fsd.exe 1336 fsd.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2416 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\ioa = "\"C:\\Users\\Admin\\AppData\\Roaming\\fsd.exe\"" ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exedescription pid process target process PID 2092 set thread context of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
fsd.exepid process 284 fsd.exe 284 fsd.exe 284 fsd.exe 284 fsd.exe 284 fsd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fsd.exedescription pid process Token: SeDebugPrivilege 284 fsd.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exeea7b951cd02856e10eb2316f141c5107_JaffaCakes118.execmd.exefsd.exedescription pid process target process PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2092 wrote to memory of 2612 2092 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 2612 wrote to memory of 2416 2612 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 2612 wrote to memory of 2416 2612 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 2612 wrote to memory of 2416 2612 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 2612 wrote to memory of 2416 2612 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 2612 wrote to memory of 2416 2612 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 2612 wrote to memory of 2416 2612 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 2612 wrote to memory of 2416 2612 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 2416 wrote to memory of 2152 2416 cmd.exe PING.EXE PID 2416 wrote to memory of 2152 2416 cmd.exe PING.EXE PID 2416 wrote to memory of 2152 2416 cmd.exe PING.EXE PID 2416 wrote to memory of 2152 2416 cmd.exe PING.EXE PID 2416 wrote to memory of 284 2416 cmd.exe fsd.exe PID 2416 wrote to memory of 284 2416 cmd.exe fsd.exe PID 2416 wrote to memory of 284 2416 cmd.exe fsd.exe PID 2416 wrote to memory of 284 2416 cmd.exe fsd.exe PID 284 wrote to memory of 1384 284 fsd.exe fsd.exe PID 284 wrote to memory of 1384 284 fsd.exe fsd.exe PID 284 wrote to memory of 1384 284 fsd.exe fsd.exe PID 284 wrote to memory of 1384 284 fsd.exe fsd.exe PID 284 wrote to memory of 1436 284 fsd.exe fsd.exe PID 284 wrote to memory of 1436 284 fsd.exe fsd.exe PID 284 wrote to memory of 1436 284 fsd.exe fsd.exe PID 284 wrote to memory of 1436 284 fsd.exe fsd.exe PID 284 wrote to memory of 1380 284 fsd.exe fsd.exe PID 284 wrote to memory of 1380 284 fsd.exe fsd.exe PID 284 wrote to memory of 1380 284 fsd.exe fsd.exe PID 284 wrote to memory of 1380 284 fsd.exe fsd.exe PID 284 wrote to memory of 112 284 fsd.exe fsd.exe PID 284 wrote to memory of 112 284 fsd.exe fsd.exe PID 284 wrote to memory of 112 284 fsd.exe fsd.exe PID 284 wrote to memory of 112 284 fsd.exe fsd.exe PID 284 wrote to memory of 1336 284 fsd.exe fsd.exe PID 284 wrote to memory of 1336 284 fsd.exe fsd.exe PID 284 wrote to memory of 1336 284 fsd.exe fsd.exe PID 284 wrote to memory of 1336 284 fsd.exe fsd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
89B
MD50ba9b63278e8f4ffce5472db6801fe6e
SHA1a547eb08912c77ceb378326c635b53f1bd32f91b
SHA25650f2f595594020af4a3aa65fb42b0b999f28869c2bf44b4dedbc1bfd683a167f
SHA5127a2b354c9ce47d9e7912797ab0b1d78b514266adca3c376d3344b6cd6a0a1f6d9fe4784153013ca67dd93bf3daf22a09ee359668ce2e09449bc7c71b882d07d2
-
\Users\Admin\AppData\Roaming\fsd.exeFilesize
1.0MB
MD5ea7b951cd02856e10eb2316f141c5107
SHA15700aeb775258508491cd7bc735adaee26da67be
SHA256ca9e376c93bcc57e658566cdb0b0f68d6417a6e6e69705f5c9fa883d5c82282f
SHA512570bacaf2e398f31736936350542151cd3cd5e785de5d3a750ceab2ac455b50c22af85042496a846bb18224257fbd7b7b4c02800a04638da0fee1d84415fd15c
-
memory/284-38-0x00000000070E0000-0x0000000007120000-memory.dmpFilesize
256KB
-
memory/284-34-0x00000000003A0000-0x00000000004A8000-memory.dmpFilesize
1.0MB
-
memory/284-35-0x0000000074510000-0x0000000074BFE000-memory.dmpFilesize
6.9MB
-
memory/284-36-0x00000000070E0000-0x0000000007120000-memory.dmpFilesize
256KB
-
memory/284-37-0x0000000074510000-0x0000000074BFE000-memory.dmpFilesize
6.9MB
-
memory/284-44-0x0000000074510000-0x0000000074BFE000-memory.dmpFilesize
6.9MB
-
memory/2092-4-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2092-6-0x0000000007C10000-0x0000000007CCC000-memory.dmpFilesize
752KB
-
memory/2092-5-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/2092-3-0x00000000003C0000-0x00000000003CA000-memory.dmpFilesize
40KB
-
memory/2092-0-0x0000000000D30000-0x0000000000E38000-memory.dmpFilesize
1.0MB
-
memory/2092-2-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/2092-17-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2092-1-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2612-11-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-20-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-29-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-16-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-14-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2612-10-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-9-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-8-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2612-7-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB