Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
18/05/2024, 00:07
General
- Target 522dfea93a76a9903776deddf02ad475_JaffaCakes118.exe
- Size 856KB
- Sample240518-aehr8aac67
- SHA256 6fab25a8710f11d1aa6617eef386bdc8143585e80124f414a82db3406b2f5d92
Malware Config
Signatures
- Luminosity 1 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
- Adds Run key to start application 2 TTPs 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\522dfea93a76a9903776deddf02ad475_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\522dfea93a76a9903776deddf02ad475_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest2⤵
- Luminosity
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:642⤵
- Adds Run key to start application
-
-
C:\Program Files (x86)\Client\client.exe"C:\Program Files (x86)\Client\client.exe" /startup1⤵
-
C:\Program Files (x86)\Client\client.exe"C:\Program Files (x86)\Client\client.exe" /startup1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
client.exe.log
memory/884-0-0x0000000075202000-0x0000000075203000-memory.dmp
memory/884-1-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/884-2-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/884-3-0x0000000075202000-0x0000000075203000-memory.dmp
memory/884-4-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/884-5-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/4324-10-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/4324-11-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/4324-12-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/5024-6-0x0000000075200000-0x00000000757B1000-memory.dmp
memory/5024-8-0x0000000075200000-0x00000000757B1000-memory.dmp