Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
13-05-2024 19:03
General
-
Target
3c50bceb888b29de23acb71e9554b815_JaffaCakes118.exe
-
Size
5.0MB
-
MD5
3c50bceb888b29de23acb71e9554b815
-
SHA1
3cf639bdd4e10621ca5c38cae10364b4ce99ecf6
-
SHA256
5e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718
-
SHA512
a1977b3ce3cbe5b943001d7befc92dece3df8ecf992f3242584770654715c3a8e049fccc7ebe720574875c803a5d3a369a3ad89e7b7e5a8679a2226e6a40952a
-
SSDEEP
98304:kPcea/pk89+y68+LNxZgMd8ghalIQGx4XY6+j7xN4kxEN9Q9E7pKYFjAD9c:kPfaRB+y6hxcxGqoj7D4kt9E7ppU+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
-
RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs .reg file with regedit 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c50bceb888b29de23acb71e9554b815_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c50bceb888b29de23acb71e9554b815_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System64\1svnhost.exe"C:\Windows\System64\1svnhost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"3⤵
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Windows\Zont911\Tupe.bat" "3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comChcp 12514⤵
-
-
C:\Windows\System64\rutserv.exe"C:\Windows\System64\rutserv.exe" /silentinstall4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System64\rutserv.exe"C:\Windows\System64\rutserv.exe" /firewall4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System64\rutserv.exe"C:\Windows\System64\rutserv.exe" /start4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System64\rfusclient.exe"C:\Windows\System64\rfusclient.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System64\rutserv.exeC:\Windows\System64\rutserv.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System64\rfusclient.exeC:\Windows\System64\rfusclient.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System64\rfusclient.exeC:\Windows\System64\rfusclient.exe /tray2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD549de7b4f614b538be1d092fe32c6de6e
SHA1f7dd55b5f5a91313fe232c1c2ca7ab229b4115e5
SHA256ea38b489d3125e709cf6d022a77a7bbb09088c31616c23e05137231a3fddf679
SHA5120129a9b92e9d53b7dc0665b4f50079bad35befa8a7e2179e37256060c44e5f1afb4f79a418ea10dc4b220c8a163d5993f298fa43467aaddb8bdaa8f4ddb1d833
-
Filesize
378KB
MD5d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
Filesize
1.6MB
MD5dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
-
Filesize
11KB
MD59eebf9cac83b328bf19f9f43647681af
SHA164ead13700bc3b8fa907cd8f3647e1baf8f49bb0
SHA256375f3d89a1f53d3e0b6d605d1b274f723ba46aedd4d8bc649775b0e7e28f9723
SHA512960d7c3a3de5ed68e3f2af89624b9b9874666b2c1328b77616752cffc039da19f99349a7a67fd54b09680c4b3ae8697bb320fecc7b82b15727281a339515033f
-
Filesize
278B
MD52aae081f3acb9615cd58a9a05a24bc3f
SHA182386fc85643d0aedfddb39a8f628ff1f51de8be
SHA2564438fb1637120602efbe98aca834c02365b9132fe36ffd8c26d7f5c22d9ec1bd
SHA51247a68649c4f01e9d084fa2838a7b79fd9719c4bf1dfa35d6efac92423c7423cd01fb9944610b88c73a82a2968aeb956e127308a4b5cc39fd9d8e1ede1bbff958
-
Filesize
5.0MB
MD53c50bceb888b29de23acb71e9554b815
SHA13cf639bdd4e10621ca5c38cae10364b4ce99ecf6
SHA2565e549de7d674bf8a75e399633cfed6d97f87cda9d3821a8716f25ca3ffb50718
SHA512a1977b3ce3cbe5b943001d7befc92dece3df8ecf992f3242584770654715c3a8e049fccc7ebe720574875c803a5d3a369a3ad89e7b7e5a8679a2226e6a40952a
-
Filesize
1.8MB
MD517354995a6a1baad7e97936dcb29742d
SHA169926dfe0f80c4bc48cb566d1e28dbcce2afc797
SHA256b12fcd0782eea0b0cd8d46ea49ad864aac835dd982161929a72ad34b05f52067
SHA512854c92f1068212a6f92d0832aa71b1f0fa3c37895534b904b0225421c484ccb1fe90cff6c5e79f99bc1d43f6250eab9c4a5fe62f7dc8ef8853eabbcf15b7896d
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
5.7MB
-
Filesize
6.7MB