Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 22:17
Static task
static1
Behavioral task
behavioral1
Sample
6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe
-
Size
166KB
-
MD5
6031245730bb86ee6c6787883d814de8
-
SHA1
092b50c20b455e17dd8bb45ad920882b4c3d8bde
-
SHA256
dd209b50e0feb6e778d19457d6b8f5f4eeb3d0aec567521cc6688973521d693d
-
SHA512
410d603df8f86936ce1443dc6e115b1124e61ee17afad5abd3f798cb745af17a1b5be583e908d7039f1e6e027a286beb3980365eeb665c2e8736934b390211d9
-
SSDEEP
3072:xsSX7oMV7tP5PO6vLOrn2Nc6UxTgPqKktyZcoiW5AgvFvmt/dvIB9n96t:68h7J5PDCzplxTgCZtyZiW5Ax5dv2a
Malware Config
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/v9J7B6vz
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2832 killisrael.exe -
Loads dropped DLL 1 IoCs
pid Process 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 5 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1304 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2832 killisrael.exe Token: SeDebugPrivilege 2832 killisrael.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1304 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 32 PID 2412 wrote to memory of 1304 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 32 PID 2412 wrote to memory of 1304 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 32 PID 2412 wrote to memory of 1304 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 32 PID 2412 wrote to memory of 2832 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 34 PID 2412 wrote to memory of 2832 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 34 PID 2412 wrote to memory of 2832 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 34 PID 2412 wrote to memory of 2832 2412 6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6031245730bb86ee6c6787883d814de8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\killisrael.exe'"2⤵
- Scheduled Task/Job: Scheduled Task
PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\killisrael.exe"C:\Users\Admin\AppData\Local\Temp\killisrael.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166KB
MD56031245730bb86ee6c6787883d814de8
SHA1092b50c20b455e17dd8bb45ad920882b4c3d8bde
SHA256dd209b50e0feb6e778d19457d6b8f5f4eeb3d0aec567521cc6688973521d693d
SHA512410d603df8f86936ce1443dc6e115b1124e61ee17afad5abd3f798cb745af17a1b5be583e908d7039f1e6e027a286beb3980365eeb665c2e8736934b390211d9