Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 04:53

General

  • Target

    28615260996f2ee3bf717734f6714014_JaffaCakes118.exe

  • Size

    344KB

  • MD5

    28615260996f2ee3bf717734f6714014

  • SHA1

    4d974c30ad0b91bbb81a3f4684d4c8216b602608

  • SHA256

    b312190adff333d7172e87d01dbb298ad7dbac987a6ad489fca561366161ee98

  • SHA512

    af93cc53e0b2299c63247e44c9ad25d065f23a7409657d40e2326f578c10022f58bc2344574c85caad1bfdf3fce65ac18742726b1ed0983a91898a2d30ee75af

  • SSDEEP

    3072:9iyYjwU1EjxKqX3Q+V1r851fKI9kG5yl+9nyiPPkD2Io9McfOOgPSCzHi8eklllL:jYrqXn1r8fK+/k+9nvki1Bj4

Score
10/10

Malware Config

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28615260996f2ee3bf717734f6714014_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\28615260996f2ee3bf717734f6714014_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Rem5\Rem5.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\AppData\Roaming\Rem5\Rem5.exe
          C:\Users\Admin\AppData\Roaming\Rem5\Rem5.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2468
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe
            5⤵
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\install.vbs

    Filesize

    410B

    MD5

    4b309959125fb954b68968bad5bed9ac

    SHA1

    b2b805fa81f1b82fa07b718031c9a89046731146

    SHA256

    109742373d7cca30b46ef4b05d9b86694e2a54f862afd891e7bba50cf0f18830

    SHA512

    9d90d6f5085ac7103aee6679272b677589afe3a50835152f3c1f799080e38b975f3c246d6649926a80a7ee3bbcabf755d6a20cf768083714a359bc9a5af9cf92

  • C:\Users\Admin\AppData\Roaming\Rem5\Rem5.exe

    Filesize

    344KB

    MD5

    28615260996f2ee3bf717734f6714014

    SHA1

    4d974c30ad0b91bbb81a3f4684d4c8216b602608

    SHA256

    b312190adff333d7172e87d01dbb298ad7dbac987a6ad489fca561366161ee98

    SHA512

    af93cc53e0b2299c63247e44c9ad25d065f23a7409657d40e2326f578c10022f58bc2344574c85caad1bfdf3fce65ac18742726b1ed0983a91898a2d30ee75af

  • C:\Users\Admin\AppData\Roaming\Rem5\logs.dat

    Filesize

    79B

    MD5

    92f856c65b267b7d3aad33c26fb0d690

    SHA1

    eb1bb43829613f9013af46793784c67d4a8faad1

    SHA256

    9cbcaa5d0bf91bdb48c540d45cd5d3c257f3ec56de6f40b01c8ed5d19b73ddf9

    SHA512

    384bee97278cbd1f19717a1eb35b32c73b8ae34f4746c1782330c3328c5eea7d9cfb55051856c997cb55e7853e1050c8363c334d9dee127eaf2453775ddaac40

  • C:\Windows\win.ini

    Filesize

    506B

    MD5

    8e6100faa270f8b935ebba91ae814491

    SHA1

    1b5d16ec7d3f2ed289fc4c079fed992275578257

    SHA256

    293b109535400cdd3eb36c8a47dcdda245e8f48200aa59bfddb21d105923e93b

    SHA512

    78b36ef3fd77d991d7ef9aa4f900f653edb1df5ab6ddbc369e0b3b3430fba9074673bf67d208cbb885b41afd3a9cd26ae9c2b392c70df7d08f055a41318469e7

  • memory/2432-5-0x0000000002B90000-0x0000000002C90000-memory.dmp

    Filesize

    1024KB

  • memory/2432-6-0x00000000771A1000-0x00000000772A2000-memory.dmp

    Filesize

    1.0MB

  • memory/2432-7-0x00000000771A0000-0x0000000077349000-memory.dmp

    Filesize

    1.7MB

  • memory/2432-8-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2432-3-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2468-26-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2628-37-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2628-28-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2628-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2628-32-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2628-30-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2628-44-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2628-38-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB