Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12-05-2024 09:23
General
-
Target
39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
39628f6572e6bf8683a71f66014933a5
-
SHA1
b4641f32159cb0de61e077566e027707b8429569
-
SHA256
046fa33ef56688e34c5aa9dbaf8b673cbec5fbc2712196674403dfafd9f700ef
-
SHA512
56c30c2f86d7b08aae9bd96e93e7305a2c26b90749fd7110315ff86370a2dd0f3352be1b2b1e715d6cbdb6d9364016dacdbcf9b1d18b7c5ce523d2dfa3b34e70
-
SSDEEP
24576:I4KxV8f6044+c12Ny3tMDI0l+GjMZijmcpjjjjQnOjWLghlKh6w34kcCSC9Bzv85:6E9euqNScU+vPtSRotkDWef/Dbyp
Malware Config
Extracted
orcus
192.168.1.135:2410
7fa2f818413f42a2990b40d91a249534
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39628f6572e6bf8683a71f66014933a5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
368KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
928KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
1000KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
624KB