Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 07:18
Static task
static1
Behavioral task
behavioral1
Sample
004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe
-
Size
57KB
-
MD5
004317b8cf9bf0a8595424977cecddd0
-
SHA1
c934425794991d88255a7597118c940066342743
-
SHA256
34d54fc11ec26dc3645995c8cad58d22976293e6af1ec3789cfab640ace146b4
-
SHA512
6e8cffd8784f2c938746f713f0eadf46e6a07c984add2770c24ba6713c789ea6d956660486b3993787cf832a17e4df20f2c95a10a1eb425697e0b5a57080b6e1
-
SSDEEP
768:aWNc4ivigIwf+afPMwngwSGUIYKrBsDK9WL1C/GlI5tOGc9C45uD65R4UDiFHUBI:9zZO7fEwgwyIlrBd+JlcMbItYxxfrO
Malware Config
Extracted
limerat
-
aes_key
fSDFvase32f2@hj5
-
antivm
true
-
c2_url
https://pastebin.com/raw/iRwDeTN3
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Wservices.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/iRwDeTN3
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 31 pastebin.com 32 pastebin.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3116 set thread context of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5092 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe Token: SeDebugPrivilege 5092 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3116 wrote to memory of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88 PID 3116 wrote to memory of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88 PID 3116 wrote to memory of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88 PID 3116 wrote to memory of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88 PID 3116 wrote to memory of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88 PID 3116 wrote to memory of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88 PID 3116 wrote to memory of 5092 3116 004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\004317b8cf9bf0a8595424977cecddd0_JaffaCakes118.exe.log
Filesize617B
MD599e770c0d4043aa84ef3d3cbc7723c25
SHA119829c5c413fccba750a3357f938dfa94486acad
SHA25633c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5
SHA512ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39