Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 08:09
Behavioral task
behavioral1
Sample
6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe
-
Size
905KB
-
MD5
6a4c7f153db18e3e1436fc7d95608de8
-
SHA1
5c0a97fbeb4e462d4317da91f0899005f8aae5e8
-
SHA256
e36f88aaa4c8dde85f5b5523a5cc27e5e280663cf90f4365f2870d54b4d52fd8
-
SHA512
dce2d18ef0bb818c18d1a25507f8632be13941df065ed3b754cd8017c8f60ffee390d00936304447cd5996daea5ad205ab95ebd5efa3223febecc7cb030b94f7
-
SSDEEP
24576:HIJu4MROxnFEptJS4rrcI0AilFEvxHPZwooH:H6MiCTS4rrcI0AilFEvxHPZ
Malware Config
Extracted
orcus
eta.ne.virus.ne.trogaj.mena.kstati.putinso.site:1604
a8eb49efd6574c7c9e16af35ceef1888
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%appdata%\regedit.exe
-
reconnect_delay
10000
-
registry_keyname
Disc0rd
-
taskscheduler_taskname
Overlay
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\regedit.exe family_orcus -
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-1-0x0000000000AB0000-0x0000000000B98000-memory.dmp orcus \Users\Admin\AppData\Roaming\regedit.exe orcus behavioral1/memory/2972-17-0x0000000001360000-0x0000000001448000-memory.dmp orcus -
Executes dropped EXE 2 IoCs
Processes:
regedit.exeregedit.exepid process 2972 regedit.exe 2844 regedit.exe -
Loads dropped DLL 1 IoCs
Processes:
6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exepid process 2244 6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs regedit.exe 2 IoCs
Processes:
regedit.exeregedit.exepid process 2972 regedit.exe 2844 regedit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regedit.exedescription pid process Token: SeDebugPrivilege 2972 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
regedit.exepid process 2972 regedit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exetaskeng.exedescription pid process target process PID 2244 wrote to memory of 2972 2244 6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe regedit.exe PID 2244 wrote to memory of 2972 2244 6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe regedit.exe PID 2244 wrote to memory of 2972 2244 6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe regedit.exe PID 2244 wrote to memory of 2972 2244 6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe regedit.exe PID 2672 wrote to memory of 2844 2672 taskeng.exe regedit.exe PID 2672 wrote to memory of 2844 2672 taskeng.exe regedit.exe PID 2672 wrote to memory of 2844 2672 taskeng.exe regedit.exe PID 2672 wrote to memory of 2844 2672 taskeng.exe regedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a4c7f153db18e3e1436fc7d95608de8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\regedit.exe"C:\Users\Admin\AppData\Roaming\regedit.exe"2⤵
- Executes dropped EXE
- Runs regedit.exe
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {F1A52845-C395-4B69-A699-B4822D84CAFA} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\regedit.exeC:\Users\Admin\AppData\Roaming\regedit.exe2⤵
- Executes dropped EXE
- Runs regedit.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\regedit.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\Users\Admin\AppData\Roaming\regedit.exeFilesize
905KB
MD56a4c7f153db18e3e1436fc7d95608de8
SHA15c0a97fbeb4e462d4317da91f0899005f8aae5e8
SHA256e36f88aaa4c8dde85f5b5523a5cc27e5e280663cf90f4365f2870d54b4d52fd8
SHA512dce2d18ef0bb818c18d1a25507f8632be13941df065ed3b754cd8017c8f60ffee390d00936304447cd5996daea5ad205ab95ebd5efa3223febecc7cb030b94f7
-
memory/2244-1-0x0000000000AB0000-0x0000000000B98000-memory.dmpFilesize
928KB
-
memory/2244-2-0x0000000000280000-0x000000000028E000-memory.dmpFilesize
56KB
-
memory/2244-3-0x00000000007C0000-0x000000000081C000-memory.dmpFilesize
368KB
-
memory/2244-4-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/2244-5-0x0000000000530000-0x0000000000542000-memory.dmpFilesize
72KB
-
memory/2244-15-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/2244-0-0x000000007448E000-0x000000007448F000-memory.dmpFilesize
4KB
-
memory/2972-17-0x0000000001360000-0x0000000001448000-memory.dmpFilesize
928KB
-
memory/2972-18-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/2972-19-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/2972-20-0x00000000006E0000-0x000000000072E000-memory.dmpFilesize
312KB
-
memory/2972-21-0x0000000000C20000-0x0000000000C38000-memory.dmpFilesize
96KB
-
memory/2972-22-0x0000000001120000-0x0000000001130000-memory.dmpFilesize
64KB
-
memory/2972-24-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB