Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
odoomv.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
odoomv.dll
Resource
win10v2004-20240802-en
General
-
Target
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe
-
Size
249KB
-
MD5
91389828fe5ae5e5a96983826c0eb0d0
-
SHA1
cd21df962aada5660de39ea828fba2d9b1651041
-
SHA256
5e0414eddc6f66f187a13acfc42cd37568af9f904823e0bceebc5c7f451ea80a
-
SHA512
5c141d6764a853ab4236951ec5875425f8d2c052fb4d26841176d29762d7fcebb5ad914ab2ec317100c3a2c4f9be1d5434f6601125f992cc977f39f5faad4aa5
-
SSDEEP
6144:TqjI4LurUOZx18y+LFy5h7ZMhF7g3sj8+ccXt:O/LurdZx18ye0OG3k8Nc9
Malware Config
Extracted
remcos
2.7.2 Pro
RemoteHost
103.89.88.238:4299
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
excel.exe
-
copy_folder
excel
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
excel
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
excel-8OHAVR
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
excel
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exepid Process 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exedescription pid Process procid_target PID 2712 set thread context of 2780 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exepid Process 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exepid Process 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exepid Process 2780 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exedescription pid Process procid_target PID 2712 wrote to memory of 2780 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2780 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2780 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2780 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 30 PID 2712 wrote to memory of 2780 2712 91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91389828fe5ae5e5a96983826c0eb0d0_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5791b5b4e9636444923a03112bcd4de23
SHA1a99a6985a2cfa4ff2e9171cb330748da5054381d
SHA256d98f8a6e2fb2e874c80f8a974ff777d07d2bee075c8893e1e707b625fb6ec834
SHA512cc64c5a07f8b87718f5e86efa3261af9ee1bca74efab8c42ad13c07a2569b1b8e9402e47d0094bd62f9d16ab740733a833d96369d073c123d5386b7b148ff6a7
-
Filesize
74B
MD5a0af023454bf43e4752ec97a5c6d7aef
SHA1efea56807e51247d8821450948cbea8cde6de0ef
SHA256c449c4d7348dff2bd02694ffe525433229e30499e915a1bc1d9a43ffae335ba0
SHA5126e013dace7ac4fbc522be2afe4db0cc772c4c8df15ef82001feeaad3fbeb2ef937f08d7c4575e642f55c3a6f4e003e69e43e33415eebb0a925fb162a1a0bdd3d
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c