Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
06/05/2024, 02:48
General
- Target 1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe
- Size 6.3MB
- Sample240506-dalj4ahe67
- SHA256 310a090e8c001419cdcb694d92a3ab2f8356eae8467a3317a2bdee8e3b9c8e60
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
- RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Drops file in Windows directory 13 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs .reg file with regedit 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a677c62a46e22491dd7723687ebb212_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System64\1systemsmss.exe"C:\Windows\System64\1systemsmss.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"3⤵
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Zont911\Tupe.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comChcp 12514⤵
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /silentinstall4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /firewall4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /start4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System64\svnhost.exeC:\Windows\System64\svnhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe /tray2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1systemsmss.exe
svnhost.exe
systemsmss.exe
vp8decoder.dll
vp8encoder.dll
Regedit.reg
Tupe.bat
memory/1360-77-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/1360-56-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/1360-86-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/1360-73-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/1360-65-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/1360-46-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/1360-60-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/1556-0-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/1556-9-0x0000000000400000-0x0000000000A50000-memory.dmp
memory/1652-31-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/2092-42-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/2468-33-0x0000000000400000-0x0000000000AA3000-memory.dmp
memory/2556-50-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/2556-45-0x0000000000400000-0x0000000000A50000-memory.dmp
memory/2556-10-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/2716-48-0x0000000000400000-0x00000000009A8000-memory.dmp
memory/3212-57-0x0000000000400000-0x00000000009A8000-memory.dmp
memory/3212-47-0x0000000000400000-0x00000000009A8000-memory.dmp
memory/3212-66-0x0000000000400000-0x00000000009A8000-memory.dmp
memory/3212-74-0x0000000000400000-0x00000000009A8000-memory.dmp