Overview

overview

10

Static

static

3

6cafc54eb9...18.exe

windows7-x64

5

6cafc54eb9...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 20:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe

  • Size

    644KB

  • MD5

    6cafc54eb9f1f8edd7a8aba870cccac8

  • SHA1

    7431abbd950d29abae893e55f5d242907d9b573e

  • SHA256

    2dc2c2f771e0e4df28b8b539afd9b6ae71084f4be073b7f3ff0bba98f228e121

  • SHA512

    9b4e8c563e1d67a3ebdb2ed4609f1b68adf155caefbbf8218e54e74e4c9d28d51e380c9791f766cd8ae76f861ec0b4c88bc66002a40220c7b3c05dec61b046e4

  • SSDEEP

    12288:Zl8klHeJTjhAX1T90fw/bTHDV+IZevFlxRLBa7mQj:ZxUC/PD7ea5

Score
10/10
luminositydiscoverypersistencerat

Malware Config

Signatures

  • Luminosity 2 IoCs

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

    ratluminosity
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe"
    1⤵
    • Luminosity
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe"
      2⤵
        PID:516
      • C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe"
        2⤵
          PID:4404
        • C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe"
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3572
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\msdcc.exe' /startup" /f
            3⤵
            • Luminosity
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4060

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\6cafc54eb9f1f8edd7a8aba870cccac8_JaffaCakes118.exe.log
        Filesize

        224B

        MD5

        9c4b66f77f12558c48b620ddfb44029d

        SHA1

        446651db643b943ec37b9b3599655e211a4bc73e

        SHA256

        42f723d18283fda6a0904046cc29ee8d10e562d20c7615259a46ae9c0e4c9708

        SHA512

        983aed0ec15a79b716ac6dc080146e4ed098c117c31167053fb5971649dc621d1db5292fdd76f3010f094b75d57ea0bdb35bc829c6ba37e4d276b266361dee8e

        Download Submit

      • memory/3304-0-0x0000000074E42000-0x0000000074E43000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3304-1-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3304-2-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3304-3-0x0000000074E42000-0x0000000074E43000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3304-4-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3304-9-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3572-5-0x0000000000400000-0x0000000000478000-memory.dmp

        Filesize

        480KB

        Download

      • memory/3572-8-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3572-11-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3572-10-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/3572-12-0x0000000074E40000-0x00000000753F1000-memory.dmp

        Filesize

        5.7MB

        Download