Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 00:43

General

  • Target

    5c51795853e77f806174a130eaf39694_JaffaCakes118.exe

  • Size

    624KB

  • MD5

    5c51795853e77f806174a130eaf39694

  • SHA1

    0dcd2f714f81ec0c166f5f0f8f65fa6c7da4ae3e

  • SHA256

    181e4423a1bec894471cf972cac0f4d297838621f97a3fdba1392534919b9eac

  • SHA512

    0b790b63f92ea3c6477cf212ac125d10d5f09588d7036b0c4cc2c27ede7d237d508b9ccdc47d49695c711d857ffa20d9d236f49526cf283772a0eeec4662a4ef

  • SSDEEP

    12288:xZJlHuFhjaXQ8goculZ4/Hfvuxw0f9wyMzzstdpwifaha2jjj6FqgCw4JW:xNuWgx0pUW

Score
10/10

Malware Config

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c51795853e77f806174a130eaf39694_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c51795853e77f806174a130eaf39694_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:4516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\VFGRBTR\logs.dat

    Filesize

    79B

    MD5

    ae6c7a354691325ae0efe85cf4e06790

    SHA1

    e444c17eabde96a891b969cc621c7e429293271b

    SHA256

    947279feac65b47b4e2d75234ada44816b19b43f65b902f26b61c556f26793ec

    SHA512

    531d5ed92125ffb30b9a9c4c6a8a62999496061df28cfbd5e600cf807e317b2cde0a64426b6d3b3656adb39d2d122b471cd03c4aff523e369722398a0e984097

  • memory/1636-13-0x0000000074960000-0x0000000075110000-memory.dmp

    Filesize

    7.7MB

  • memory/1636-0-0x000000007496E000-0x000000007496F000-memory.dmp

    Filesize

    4KB

  • memory/1636-3-0x0000000000FA0000-0x0000000000FB4000-memory.dmp

    Filesize

    80KB

  • memory/1636-5-0x0000000004E70000-0x0000000004F0C000-memory.dmp

    Filesize

    624KB

  • memory/1636-2-0x0000000000F70000-0x0000000000FA6000-memory.dmp

    Filesize

    216KB

  • memory/1636-1-0x00000000003F0000-0x000000000047A000-memory.dmp

    Filesize

    552KB

  • memory/1636-17-0x0000000074960000-0x0000000075110000-memory.dmp

    Filesize

    7.7MB

  • memory/1636-16-0x000000007496E000-0x000000007496F000-memory.dmp

    Filesize

    4KB

  • memory/4516-6-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4516-14-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4516-9-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4516-12-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4516-19-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4516-8-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB