Malware Analysis Report

2024-11-13 18:52

Sample ID 240519-waclasab3w
Target 5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118
SHA256 668bfc84804f44313ed60e9a4f06eeeedbc009f779f620673025f54cf1d7ac02
Tags
remcos persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

668bfc84804f44313ed60e9a4f06eeeedbc009f779f620673025f54cf1d7ac02

Threat Level: Known bad

The file 5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

remcos persistence rat

Remcos

Modifies WinLogon for persistence

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Modifies WinLogon

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 17:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 17:42

Reported

2024-05-19 17:45

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A

Remcos

rat remcos

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4332 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 4332 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 4332 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 4332 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 4332 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 60 wrote to memory of 1624 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_FB96.tmp.exe
PID 60 wrote to memory of 1624 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_FB96.tmp.exe
PID 60 wrote to memory of 1624 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_FB96.tmp.exe
PID 60 wrote to memory of 2436 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe
PID 60 wrote to memory of 2436 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe
PID 60 wrote to memory of 2436 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe
PID 2436 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe C:\Windows\SysWOW64\WScript.exe
PID 2436 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe C:\Windows\SysWOW64\WScript.exe
PID 2436 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe C:\Windows\SysWOW64\WScript.exe
PID 2784 wrote to memory of 3740 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 3740 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 3740 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3740 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe
PID 3740 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe
PID 3740 wrote to memory of 4532 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4532 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe"

C:\Windows\SysWOW64\diskperf.exe

"C:\Windows\SysWOW64\diskperf.exe"

C:\Users\Admin\AppData\Local\Temp\FB_FB96.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\FB_FB96.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe"

C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe

C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BE 88.221.83.185:443 www.bing.com tcp
US 8.8.8.8:53 185.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 123.dynns.com udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/4332-0-0x0000000002160000-0x0000000002161000-memory.dmp

memory/4332-1-0x0000000000400000-0x00000000004E1000-memory.dmp

memory/4332-3-0x0000000002160000-0x0000000002161000-memory.dmp

memory/60-6-0x0000000000400000-0x0000000000425000-memory.dmp

memory/60-10-0x0000000000400000-0x0000000000425000-memory.dmp

memory/60-12-0x0000000000400000-0x0000000000425000-memory.dmp

memory/4332-13-0x0000000000400000-0x00000000004E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FB_FB96.tmp.exe

MD5 74bafb3e707c7b0c63938ac200f99c7f
SHA1 10c5506337845ed9bf25c73d2506f9c15ab8e608
SHA256 129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689
SHA512 5b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781

C:\Users\Admin\AppData\Local\Temp\FB_FCB0.tmp.exe

MD5 663817126bcbfb5363e1ccf899d7e25c
SHA1 a4ddb193cc750325dc01817966a29b77fbde88c4
SHA256 f08db58c7ae0bf65ecf99e1bb5c1576692172ee59ba2c8f6bfda8580ca443a06
SHA512 b28f7b6b09694e621baac7d02a873fb6775e90b6d1a04acf36d8b94aa49d3b042114c396ef5aff95af4e40c777399a2999a023373d2011fbfaf8c59b91751b7e

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 beb6898a23e3ec9bf013bac14f601daf
SHA1 3137d43d5f5add5517dc9db02482a6fe965b8e0d
SHA256 875ef0f499ebce8f9381c8fcdc6140c9daa10efff86076682a8e8f9f05b6e63c
SHA512 3abc30353f8baf847b226aebb48b11d0e34930a11c40a0a22513a6d6176fbf7ca84a884fd6e2d93af0d9010515c1ade51e5f6aea12cf1ed70ec56c4a7aacda32

memory/1628-38-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Roaming\20mcoslogs\logs.dat

MD5 4d10ff778c0db3c328f4d554105ad447
SHA1 3e967f220d0d7eb8ff31169dc63cbee3184b972e
SHA256 c7d1fcad547fa014b9f486bc72c01a5fe40ff68f0238da7f76df8f9944bd0029
SHA512 705a563d1d09ae2fb059027fe48ef2e25c7240304acbc21e61bf36720b501509f2b0065c62b525e9d8edbc524986253856f77d8be0758be220da41397bf12761

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 17:42

Reported

2024-05-19 17:45

Platform

win7-20240508-en

Max time kernel

149s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe N/A

Remcos

rat remcos

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\20mcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\20mcos\\20mcos.exe\"" C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2472 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 2472 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 2472 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 2472 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 2472 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 2472 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe C:\Windows\SysWOW64\diskperf.exe
PID 2756 wrote to memory of 2468 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D153.tmp.exe
PID 2756 wrote to memory of 2468 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D153.tmp.exe
PID 2756 wrote to memory of 2468 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D153.tmp.exe
PID 2756 wrote to memory of 2468 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D153.tmp.exe
PID 2756 wrote to memory of 2564 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe
PID 2756 wrote to memory of 2564 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe
PID 2756 wrote to memory of 2564 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe
PID 2756 wrote to memory of 2564 N/A C:\Windows\SysWOW64\diskperf.exe C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe
PID 2564 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe C:\Windows\SysWOW64\WScript.exe
PID 2564 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe C:\Windows\SysWOW64\WScript.exe
PID 2564 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe C:\Windows\SysWOW64\WScript.exe
PID 2564 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe C:\Windows\SysWOW64\WScript.exe
PID 1612 wrote to memory of 832 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 832 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 832 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 832 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 832 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe
PID 832 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe
PID 832 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe
PID 832 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2680 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\5aa3e5eafe9fe3da717d5996a830cd14_JaffaCakes118.exe"

C:\Windows\SysWOW64\diskperf.exe

"C:\Windows\SysWOW64\diskperf.exe"

C:\Users\Admin\AppData\Local\Temp\FB_D153.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\FB_D153.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe"

C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe

C:\Users\Admin\AppData\Roaming\20mcos\20mcos.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 123.dynns.com udp

Files

memory/2472-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2472-1-0x0000000000400000-0x00000000004E1000-memory.dmp

memory/2472-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2756-7-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2472-14-0x0000000000400000-0x00000000004E1000-memory.dmp

memory/2756-15-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2756-17-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2756-10-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2756-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FB_D153.tmp.exe

MD5 74bafb3e707c7b0c63938ac200f99c7f
SHA1 10c5506337845ed9bf25c73d2506f9c15ab8e608
SHA256 129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689
SHA512 5b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781

C:\Users\Admin\AppData\Local\Temp\FB_D1A2.tmp.exe

MD5 663817126bcbfb5363e1ccf899d7e25c
SHA1 a4ddb193cc750325dc01817966a29b77fbde88c4
SHA256 f08db58c7ae0bf65ecf99e1bb5c1576692172ee59ba2c8f6bfda8580ca443a06
SHA512 b28f7b6b09694e621baac7d02a873fb6775e90b6d1a04acf36d8b94aa49d3b042114c396ef5aff95af4e40c777399a2999a023373d2011fbfaf8c59b91751b7e

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 ab204a194535707e8bca051e71731700
SHA1 df8aae24bca6f9f09a79c30db419ac91a922cf8e
SHA256 b1cd941e515461c9fa7cb85cd95bff3b8dafe64369990d642088bdb67a3949d4
SHA512 8a8da7b29b4f6a071c59faa96a12fd6186475d419ceaf9a97018f916cc7c43c12815bbcde78edf2b728e65bcded9209d3d4c4689f898e1de66bc96ef0bc2f143

memory/1600-46-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Roaming\20mcoslogs\logs.dat

MD5 65e4fb1c8168a56188f48f0f407573cd
SHA1 32f4fa34c0a390d6ff4ef8ea7a8c8a15bfd6deed
SHA256 7d52c288b8a2d78f5eb802ce01f9118ff6bf8effef0dd3f88abceea2b8b285a3
SHA512 a0de29fd9c107318e623e938bf129e2b4d3b4d6d5f8fedc8bfbda7290e12f2628a8392669685af5ed7a7e274b350385bc0c292265387633a3215dcecd4e11402