Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe
-
Size
396KB
-
MD5
a955ac034ab71cc35107fd81d4d0904a
-
SHA1
7e00fa5b9e8718d6ae19856ecc1be4cbf487a164
-
SHA256
ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81
-
SHA512
48804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d
-
SSDEEP
12288:F3P+z2F99SVFC6UJiMCXxdS3uh57eNgZP:F342FUVMCXjlhVeNg5
Malware Config
Extracted
remcos
3.0.1 Pro
RemoteHost
capriteam.ddns.net:1010
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VHHYND
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Deletes itself 1 IoCs
pid Process 2376 WScript.exe -
Executes dropped EXE 2 IoCs
pid Process 2876 remcos.exe 2828 remcos.exe -
Loads dropped DLL 2 IoCs
pid Process 2852 cmd.exe 2852 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2424 set thread context of 2156 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 30 PID 2876 set thread context of 2828 2876 remcos.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 2876 remcos.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 2876 remcos.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2156 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2156 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2156 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2156 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 30 PID 2424 wrote to memory of 2156 2424 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 30 PID 2156 wrote to memory of 2376 2156 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2376 2156 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2376 2156 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2376 2156 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2852 2376 WScript.exe 33 PID 2376 wrote to memory of 2852 2376 WScript.exe 33 PID 2376 wrote to memory of 2852 2376 WScript.exe 33 PID 2376 wrote to memory of 2852 2376 WScript.exe 33 PID 2852 wrote to memory of 2876 2852 cmd.exe 35 PID 2852 wrote to memory of 2876 2852 cmd.exe 35 PID 2852 wrote to memory of 2876 2852 cmd.exe 35 PID 2852 wrote to memory of 2876 2852 cmd.exe 35 PID 2876 wrote to memory of 2828 2876 remcos.exe 36 PID 2876 wrote to memory of 2828 2876 remcos.exe 36 PID 2876 wrote to memory of 2828 2876 remcos.exe 36 PID 2876 wrote to memory of 2828 2876 remcos.exe 36 PID 2876 wrote to memory of 2828 2876 remcos.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2828
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
622B
MD5643a79abdc3f32f5a14d7964d479040c
SHA133368a48f78ff737aa2f4c0cbf9a4810e23f3780
SHA256115a6f1c26738bfd44c3d81723d091bc90662123ad01497b353707161997948e
SHA5123a42f2753a9a2d14c461722923622408eb76b6f85bd186377bfe2af44ff882714a38e0d223d69d2b28dc8390cc386c6fef5bf325dc20e4cf499d991e32d2bb58
-
Filesize
396KB
MD5a955ac034ab71cc35107fd81d4d0904a
SHA17e00fa5b9e8718d6ae19856ecc1be4cbf487a164
SHA256ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81
SHA51248804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d