Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 16:08
Behavioral task
behavioral1
Sample
a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe
-
Size
47KB
-
MD5
a750d5f19524e4431550930c4e8a0a95
-
SHA1
4e20317001a8da032d85e12ee9a41fa570485daf
-
SHA256
aa8308e986d53702e8674ec11140bf6244deafd679135bb5c1b6dbe20475a125
-
SHA512
a1bd14d2575423cce68d224dc00e359841521443eb0dff8516f442cbb38221105b7de1816b995469d554f5574a1188d50df210593e6f4128ca5d04e64c0d369f
-
SSDEEP
768:iuyKFTMIGZ8btAWUumy6mo2q88CAPSy3PIE4q12T8sBTVe0bNlpmZJqtOlD2KsfE:iuyKFTMtkY2w6E4q12TZRRbDewMlDLsc
Malware Config
Extracted
asyncrat
0.5.7B
Default
20.36.20.111:1604
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c000000012246-13.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2612 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2608 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2716 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2056 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe Token: SeDebugPrivilege 2612 svchost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2712 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 30 PID 2848 wrote to memory of 2712 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 30 PID 2848 wrote to memory of 2712 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 30 PID 2848 wrote to memory of 2712 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 30 PID 2848 wrote to memory of 2608 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 32 PID 2848 wrote to memory of 2608 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 32 PID 2848 wrote to memory of 2608 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 32 PID 2848 wrote to memory of 2608 2848 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 32 PID 2608 wrote to memory of 2716 2608 cmd.exe 35 PID 2608 wrote to memory of 2716 2608 cmd.exe 35 PID 2608 wrote to memory of 2716 2608 cmd.exe 35 PID 2608 wrote to memory of 2716 2608 cmd.exe 35 PID 2712 wrote to memory of 2056 2712 cmd.exe 34 PID 2712 wrote to memory of 2056 2712 cmd.exe 34 PID 2712 wrote to memory of 2056 2712 cmd.exe 34 PID 2712 wrote to memory of 2056 2712 cmd.exe 34 PID 2608 wrote to memory of 2612 2608 cmd.exe 36 PID 2608 wrote to memory of 2612 2608 cmd.exe 36 PID 2608 wrote to memory of 2612 2608 cmd.exe 36 PID 2608 wrote to memory of 2612 2608 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2056
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7262.tmp.bat""2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2716
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD527c3e9f54068eef3963e945a17eb1dfa
SHA12f8f5feff8ef97dcef2402f45b561bdc5f71a44a
SHA256519b71066f409a597af582d4fb2a4c37ea6cf79b0079d66d7ddbca8f61bbe7c8
SHA512f29ad6f91810d9ba65520e9fd5d1ef6dbdddd08f824fdb148699f7332b0e55c2014e4cca5100e623f6eb385eeda33085b43fe880871ced61720d40b461c3dd66
-
Filesize
47KB
MD5a750d5f19524e4431550930c4e8a0a95
SHA14e20317001a8da032d85e12ee9a41fa570485daf
SHA256aa8308e986d53702e8674ec11140bf6244deafd679135bb5c1b6dbe20475a125
SHA512a1bd14d2575423cce68d224dc00e359841521443eb0dff8516f442cbb38221105b7de1816b995469d554f5574a1188d50df210593e6f4128ca5d04e64c0d369f