Overview

overview

10

Static

static

3

1a2e8337a1...18.exe

windows7-x64

6

1a2e8337a1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe

  • Size

    707KB

  • MD5

    1a2e8337a1f608a6fad4539851794a92

  • SHA1

    c9c61f2c601e81585cd6a4e60391455b4b3c8cc6

  • SHA256

    736d3e74969be31c25e54b97d8755f564c331c9f741bfacd0db31242bd199dcb

  • SHA512

    6ce1bf2eced942eec7f56190f307397f73cb56de3dbafca86b1aee642aa0fca190d16f4bc63681e772354972d9ba8bf21234f3e2403e018e2d33ed4128461d53

  • SSDEEP

    12288:JTZDOyEY1aw+Tg65CTai02bbyqUVlZXwDV3WckLFia5oO:ldOYoWbfCXXwDorZi9O

Score
10/10
luminositypersistencerat

Malware Config

Signatures

  • Luminosity 2 IoCs

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

    ratluminosity
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe"
    1⤵
    • Luminosity
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe"
      2⤵
        PID:5336
      • C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe"
        2⤵
          PID:5560
        • C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\1a2e8337a1f608a6fad4539851794a92_JaffaCakes118.exe"
          2⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1260
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc onlogon /tn "Clientx" /rl highest /tr "'C:\Program Files (x86)\Clientx\client.exe' /startup" /f
            3⤵
            • Luminosity
            • Creates scheduled task(s)
            PID:2732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1160
          2⤵
          • Program crash
          PID:1072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4780 -ip 4780
        1⤵
          PID:1196

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1260-5-0x0000000000400000-0x0000000000478000-memory.dmp
          Filesize

          480KB

          Download
        • memory/1260-6-0x00000000752E0000-0x0000000075891000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/1260-7-0x00000000752E0000-0x0000000075891000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/1260-8-0x00000000752E0000-0x0000000075891000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/1260-11-0x00000000752E0000-0x0000000075891000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/4780-0-0x00000000752E2000-0x00000000752E3000-memory.dmp
          Filesize

          4KB

          Download
        • memory/4780-1-0x00000000752E0000-0x0000000075891000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/4780-2-0x00000000752E0000-0x0000000075891000-memory.dmp
          Filesize

          5.7MB

          Download
        • memory/4780-10-0x00000000752E0000-0x0000000075891000-memory.dmp
          Filesize

          5.7MB

          Download