Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
6982a6a0f6630f4b31b7628a1536df70
-
SHA1
a287fa0c3b2723ca9c1be48d8d84654e49992b70
-
SHA256
d90a3a1cb68bd1dd434e0a48d8e03bc3fc3d0a239339efde8ec2f7f7fa56c0a2
-
SHA512
1bcfd793e85e8d8e592890e6b4403be29e2ed0bfc6e19a132520e951020644953cecdd036a1cd824930e52c8c33c7891e855b839e4955006d43a6dd3546d3555
-
SSDEEP
24576:ukfVYrF1v6rWVHIIXII94ZvTrQg8jzVSSwjFTp0Twt24TyE:uryruOSkSSFTKKXyE
Malware Config
Extracted
orcus
188.227.85.44:6969
efff1791714c4747aed207dd6b736e25
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
%localappdata%\IsolatedStorage\covhh4rz.3f1\ry2mde3m.m5t\DNSServicePack.exe
-
reconnect_delay
10000
-
registry_keyname
DNSServicePack
-
taskscheduler_taskname
DNSServicePack
-
watchdog_path
AppData\DNSServicePacker.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2328-2-0x0000000004380000-0x000000000446A000-memory.dmp orcus -
Executes dropped EXE 1 IoCs
Processes:
DNSServicePack.exepid process 2660 DNSServicePack.exe -
Loads dropped DLL 1 IoCs
Processes:
6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exepid process 2328 6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exedescription pid process target process PID 2328 wrote to memory of 2660 2328 6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe DNSServicePack.exe PID 2328 wrote to memory of 2660 2328 6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe DNSServicePack.exe PID 2328 wrote to memory of 2660 2328 6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe DNSServicePack.exe PID 2328 wrote to memory of 2660 2328 6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe DNSServicePack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6982a6a0f6630f4b31b7628a1536df70_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\IsolatedStorage\covhh4rz.3f1\ry2mde3m.m5t\DNSServicePack.exe"C:\Users\Admin\AppData\Local\IsolatedStorage\covhh4rz.3f1\ry2mde3m.m5t\DNSServicePack.exe"2⤵
- Executes dropped EXE
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\IsolatedStorage\covhh4rz.3f1\ry2mde3m.m5t\DNSServicePack.exeFilesize
1.2MB
MD56982a6a0f6630f4b31b7628a1536df70
SHA1a287fa0c3b2723ca9c1be48d8d84654e49992b70
SHA256d90a3a1cb68bd1dd434e0a48d8e03bc3fc3d0a239339efde8ec2f7f7fa56c0a2
SHA5121bcfd793e85e8d8e592890e6b4403be29e2ed0bfc6e19a132520e951020644953cecdd036a1cd824930e52c8c33c7891e855b839e4955006d43a6dd3546d3555
-
C:\Users\Admin\AppData\Local\IsolatedStorage\covhh4rz.3f1\ry2mde3m.m5t\DNSServicePack.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
memory/2328-20-0x00000000747A0000-0x0000000074E8E000-memory.dmpFilesize
6.9MB
-
memory/2328-1-0x0000000000F70000-0x0000000000F78000-memory.dmpFilesize
32KB
-
memory/2328-2-0x0000000004380000-0x000000000446A000-memory.dmpFilesize
936KB
-
memory/2328-3-0x00000000747A0000-0x0000000074E8E000-memory.dmpFilesize
6.9MB
-
memory/2328-4-0x00000000005A0000-0x00000000005AE000-memory.dmpFilesize
56KB
-
memory/2328-5-0x00000000009E0000-0x0000000000A3C000-memory.dmpFilesize
368KB
-
memory/2328-6-0x0000000000660000-0x0000000000672000-memory.dmpFilesize
72KB
-
memory/2328-0-0x00000000747AE000-0x00000000747AF000-memory.dmpFilesize
4KB
-
memory/2660-19-0x0000000000F20000-0x0000000000F28000-memory.dmpFilesize
32KB
-
memory/2660-18-0x00000000747A0000-0x0000000074E8E000-memory.dmpFilesize
6.9MB
-
memory/2660-21-0x0000000000920000-0x0000000000932000-memory.dmpFilesize
72KB
-
memory/2660-22-0x0000000000BA0000-0x0000000000BEE000-memory.dmpFilesize
312KB
-
memory/2660-23-0x0000000004700000-0x0000000004718000-memory.dmpFilesize
96KB
-
memory/2660-24-0x0000000004770000-0x0000000004780000-memory.dmpFilesize
64KB
-
memory/2660-25-0x00000000747A0000-0x0000000074E8E000-memory.dmpFilesize
6.9MB