Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 08:26
Static task
static1
Behavioral task
behavioral1
Sample
2e38119954558630507e341fe03f2022_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
2e38119954558630507e341fe03f2022_JaffaCakes118.exe
-
Size
338KB
-
MD5
2e38119954558630507e341fe03f2022
-
SHA1
20cb37e9d62a093333d6e678b8763ad4e2197907
-
SHA256
4e6c3f32c4ef36e69182e054a01645694a113c1c039d2a33e3059801de002ad6
-
SHA512
008a6cff3046ece3326b9e41fcb34cce5efa56ba300e47e048bc7bab15acac1ac519e418c3c483dbc2b21e409d30df7371006e31832388d3a67682d66af9c5bd
-
SSDEEP
6144:VseEVxpKTp7HAIlbzeDoqPoBzKy0DtplL/T3zlcmRsC5JLOvzObPQaHNs33m:qeRTpTAIcoqEOFP1olaHmH
Malware Config
Extracted
remcos
2.2.0 Pro
Surge
shellgang.gleeze.com:2112
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-CEXU81
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
remcos
Surge
shellgang.gleeze.com:2112
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-CEXU81
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2572 svhost.exe -
Loads dropped DLL 2 IoCs
pid Process 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2712 set thread context of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2572 svhost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2376 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 28 PID 2712 wrote to memory of 2376 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 28 PID 2712 wrote to memory of 2376 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 28 PID 2712 wrote to memory of 2376 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 28 PID 2376 wrote to memory of 2116 2376 cmd.exe 30 PID 2376 wrote to memory of 2116 2376 cmd.exe 30 PID 2376 wrote to memory of 2116 2376 cmd.exe 30 PID 2376 wrote to memory of 2116 2376 cmd.exe 30 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31 PID 2712 wrote to memory of 2572 2712 2e38119954558630507e341fe03f2022_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e38119954558630507e341fe03f2022_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e38119954558630507e341fe03f2022_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵PID:2116
-
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
338KB
MD52e38119954558630507e341fe03f2022
SHA120cb37e9d62a093333d6e678b8763ad4e2197907
SHA2564e6c3f32c4ef36e69182e054a01645694a113c1c039d2a33e3059801de002ad6
SHA512008a6cff3046ece3326b9e41fcb34cce5efa56ba300e47e048bc7bab15acac1ac519e418c3c483dbc2b21e409d30df7371006e31832388d3a67682d66af9c5bd
-
Filesize
79B
MD58b78f6ef0a399c80c9d87f690549cfe8
SHA1ca8bda54270fdb0ac874aaa406d3a2807b43cc5e
SHA2563c6738caa4b90ee91e0888ce5f3f1f7d131c826d0a8e2f427345206c23f6ce6f
SHA51235a30f7237ed8d9c27c1777df0ffcc943e483708ed942e61bc9a62f02df8388f66ac6bdc11b7b90c7934e39f0fa38e1c8bb9a2ac67f845afd83cb7dfb8a5f589
-
Filesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5