Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 17:05
Static task
static1
Behavioral task
behavioral1
Sample
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
ea7b951cd02856e10eb2316f141c5107
-
SHA1
5700aeb775258508491cd7bc735adaee26da67be
-
SHA256
ca9e376c93bcc57e658566cdb0b0f68d6417a6e6e69705f5c9fa883d5c82282f
-
SHA512
570bacaf2e398f31736936350542151cd3cd5e785de5d3a750ceab2ac455b50c22af85042496a846bb18224257fbd7b7b4c02800a04638da0fee1d84415fd15c
-
SSDEEP
12288:FthatZrYWF1dLSBr7QlU2+BbkB1/L8R4jGjeEPMIthO/W1Ad9S2NVvz6Sgq7qrcc:Ft8tuWFOBrc62is8iKXOSQTEcAS
Malware Config
Extracted
remcos
1.7 Pro
Host
gdyhjjdhbvxgsfe.gotdns.ch:1996
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
fsd.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_lrqrjhqsyqtzudh
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
ioa
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
Processes:
fsd.exefsd.exefsd.exepid process 880 fsd.exe 464 fsd.exe 1048 fsd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fsd.exeea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ioa = "\"C:\\Users\\Admin\\AppData\\Roaming\\fsd.exe\"" fsd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ioa = "\"C:\\Users\\Admin\\AppData\\Roaming\\fsd.exe\"" ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exefsd.exedescription pid process target process PID 4516 set thread context of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 880 set thread context of 1048 880 fsd.exe fsd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fsd.exepid process 880 fsd.exe 880 fsd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fsd.exedescription pid process Token: SeDebugPrivilege 880 fsd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fsd.exepid process 1048 fsd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exeea7b951cd02856e10eb2316f141c5107_JaffaCakes118.execmd.exefsd.exedescription pid process target process PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 4516 wrote to memory of 1228 4516 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe PID 1228 wrote to memory of 4168 1228 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 1228 wrote to memory of 4168 1228 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 1228 wrote to memory of 4168 1228 ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe cmd.exe PID 4168 wrote to memory of 3492 4168 cmd.exe PING.EXE PID 4168 wrote to memory of 3492 4168 cmd.exe PING.EXE PID 4168 wrote to memory of 3492 4168 cmd.exe PING.EXE PID 4168 wrote to memory of 880 4168 cmd.exe fsd.exe PID 4168 wrote to memory of 880 4168 cmd.exe fsd.exe PID 4168 wrote to memory of 880 4168 cmd.exe fsd.exe PID 880 wrote to memory of 464 880 fsd.exe fsd.exe PID 880 wrote to memory of 464 880 fsd.exe fsd.exe PID 880 wrote to memory of 464 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe PID 880 wrote to memory of 1048 880 fsd.exe fsd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea7b951cd02856e10eb2316f141c5107_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\fsd.exe"C:\Users\Admin\AppData\Roaming\fsd.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
89B
MD50ba9b63278e8f4ffce5472db6801fe6e
SHA1a547eb08912c77ceb378326c635b53f1bd32f91b
SHA25650f2f595594020af4a3aa65fb42b0b999f28869c2bf44b4dedbc1bfd683a167f
SHA5127a2b354c9ce47d9e7912797ab0b1d78b514266adca3c376d3344b6cd6a0a1f6d9fe4784153013ca67dd93bf3daf22a09ee359668ce2e09449bc7c71b882d07d2
-
C:\Users\Admin\AppData\Roaming\fsd.exeFilesize
1.0MB
MD5ea7b951cd02856e10eb2316f141c5107
SHA15700aeb775258508491cd7bc735adaee26da67be
SHA256ca9e376c93bcc57e658566cdb0b0f68d6417a6e6e69705f5c9fa883d5c82282f
SHA512570bacaf2e398f31736936350542151cd3cd5e785de5d3a750ceab2ac455b50c22af85042496a846bb18224257fbd7b7b4c02800a04638da0fee1d84415fd15c
-
memory/880-30-0x00000000075F0000-0x0000000007600000-memory.dmpFilesize
64KB
-
memory/880-38-0x0000000074A00000-0x00000000751B0000-memory.dmpFilesize
7.7MB
-
memory/880-29-0x0000000074A00000-0x00000000751B0000-memory.dmpFilesize
7.7MB
-
memory/880-28-0x00000000075F0000-0x0000000007600000-memory.dmpFilesize
64KB
-
memory/880-27-0x0000000074A00000-0x00000000751B0000-memory.dmpFilesize
7.7MB
-
memory/1048-39-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1048-36-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1048-41-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1048-44-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1228-22-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1228-11-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1228-14-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1228-19-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4516-6-0x0000000008890000-0x000000000892C000-memory.dmpFilesize
624KB
-
memory/4516-15-0x0000000074A10000-0x00000000751C0000-memory.dmpFilesize
7.7MB
-
memory/4516-10-0x0000000008D70000-0x0000000008E2C000-memory.dmpFilesize
752KB
-
memory/4516-9-0x00000000070E0000-0x00000000070F0000-memory.dmpFilesize
64KB
-
memory/4516-8-0x0000000074A10000-0x00000000751C0000-memory.dmpFilesize
7.7MB
-
memory/4516-7-0x0000000002690000-0x000000000269A000-memory.dmpFilesize
40KB
-
memory/4516-0-0x0000000000180000-0x0000000000288000-memory.dmpFilesize
1.0MB
-
memory/4516-5-0x0000000007130000-0x000000000713A000-memory.dmpFilesize
40KB
-
memory/4516-4-0x00000000070E0000-0x00000000070F0000-memory.dmpFilesize
64KB
-
memory/4516-3-0x0000000007150000-0x00000000071E2000-memory.dmpFilesize
584KB
-
memory/4516-2-0x0000000007660000-0x0000000007C04000-memory.dmpFilesize
5.6MB
-
memory/4516-1-0x0000000074A10000-0x00000000751C0000-memory.dmpFilesize
7.7MB