Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 16:08
Behavioral task
behavioral1
Sample
a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe
-
Size
47KB
-
MD5
a750d5f19524e4431550930c4e8a0a95
-
SHA1
4e20317001a8da032d85e12ee9a41fa570485daf
-
SHA256
aa8308e986d53702e8674ec11140bf6244deafd679135bb5c1b6dbe20475a125
-
SHA512
a1bd14d2575423cce68d224dc00e359841521443eb0dff8516f442cbb38221105b7de1816b995469d554f5574a1188d50df210593e6f4128ca5d04e64c0d369f
-
SSDEEP
768:iuyKFTMIGZ8btAWUumy6mo2q88CAPSy3PIE4q12T8sBTVe0bNlpmZJqtOlD2KsfE:iuyKFTMtkY2w6E4q12TZRRbDewMlDLsc
Malware Config
Extracted
asyncrat
0.5.7B
Default
20.36.20.111:1604
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a00000002340d-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3148 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2320 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4592 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe Token: SeDebugPrivilege 3148 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2972 wrote to memory of 5084 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 92 PID 2972 wrote to memory of 5084 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 92 PID 2972 wrote to memory of 5084 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 92 PID 2972 wrote to memory of 1668 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 94 PID 2972 wrote to memory of 1668 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 94 PID 2972 wrote to memory of 1668 2972 a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe 94 PID 5084 wrote to memory of 4592 5084 cmd.exe 96 PID 5084 wrote to memory of 4592 5084 cmd.exe 96 PID 5084 wrote to memory of 4592 5084 cmd.exe 96 PID 1668 wrote to memory of 2320 1668 cmd.exe 97 PID 1668 wrote to memory of 2320 1668 cmd.exe 97 PID 1668 wrote to memory of 2320 1668 cmd.exe 97 PID 1668 wrote to memory of 3148 1668 cmd.exe 99 PID 1668 wrote to memory of 3148 1668 cmd.exe 99 PID 1668 wrote to memory of 3148 1668 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a750d5f19524e4431550930c4e8a0a95_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC2E2.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2320
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD566396f92b50792c4dc01111757ad7e27
SHA131c1fe5c47187e147bafd5e4c0976eeb3620aef9
SHA256c9090a62fc9b0ff415bdf3a6dd04462394983bd02504bf9ca37de7dc10266cd5
SHA512d96070feacfccc7aa9f93e457be0f858c94462a30163e851e7c0bb90d867daf1350ebc4b46342766c6e3766f099a496b434a4b196cdc63b90e5781ee69d0edbb
-
Filesize
47KB
MD5a750d5f19524e4431550930c4e8a0a95
SHA14e20317001a8da032d85e12ee9a41fa570485daf
SHA256aa8308e986d53702e8674ec11140bf6244deafd679135bb5c1b6dbe20475a125
SHA512a1bd14d2575423cce68d224dc00e359841521443eb0dff8516f442cbb38221105b7de1816b995469d554f5574a1188d50df210593e6f4128ca5d04e64c0d369f