Overview

overview

10

Static

static

1

3f3ad2ecae...18.exe

windows7-x64

10

3f3ad2ecae...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    12-07-2024 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe

  • Size

    7.4MB

  • MD5

    3f3ad2ecae96a7640ec6f0272a7626b9

  • SHA1

    cfe1ca816755f04c055a8d238a0077aeb3b22cf1

  • SHA256

    f7d20a05b51c7896cd9a716f55e983e43b02390d042642c0969bffff478e14b3

  • SHA512

    64a3d9519d3c5ba92ef738a17313900516fbad977f32d7549b1ec47373d8ca8dac5cfef493b924664738d42e489a59c95ee01a40a57b1e3f34e655eed374f2ea

  • SSDEEP

    768:xvEk/bzQ7RlxhvtpjRR7ePoxBz1d4oJoobHYJJSmjppwIiSTsWbR3b+xhv97jZ6L:xJF

Score
10/10
orcusevasionexecutionpersistenceratspywarestealertrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Windows security bypass 2 TTPs 3 IoCs
    evasiontrojan
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Orcurs Rat Executable 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Windows security modification 2 TTPs 9 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Drops startup file
    • Windows security modification
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2984
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1596
    • C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3f3ad2ecae96a7640ec6f0272a7626b9_JaffaCakes118.exe"
      2⤵
        PID:1472

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Defense Evasion

    Impair Defenses

    3
    T1562

    Disable or Modify Tools

    3
    T1562.001

    Modify Registry

    5
    T1112

    Virtualization/Sandbox Evasion

    2
    T1497

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    4
    T1012

    System Information Discovery

    3
    T1082

    Virtualization/Sandbox Evasion

    2
    T1497

    Lateral Movement

    Collection

    Command and Control

    Web Service

    1
    T1102

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      f34e711402c4a1b1f861bf07bc32c611

      SHA1

      d090b1919b30012a531813b7bd97596da9c1d78f

      SHA256

      49147dbf193a5250422af519502dc6b5767f8f0955c590e9ee680221754cce40

      SHA512

      ebfdfcff5f17a553449bd0257211387b0405e36f5a2e18211420763fd097c1404549166c01c96433ac0d92b0122488da76b114e600015322158b650053eec755

      Download Submit

    • memory/1160-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1160-1-0x0000000000A20000-0x0000000001180000-memory.dmp

      Filesize

      7.4MB

      Download

    • memory/1160-2-0x0000000007290000-0x00000000073A2000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/1472-21-0x0000000000400000-0x00000000004FA000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/1472-30-0x0000000000400000-0x00000000004FA000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/1472-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1472-26-0x0000000000400000-0x00000000004FA000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/1472-23-0x0000000000400000-0x00000000004FA000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/1472-27-0x0000000000400000-0x00000000004FA000-memory.dmp

      Filesize

      1000KB

      Download