Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe
-
Size
396KB
-
MD5
a955ac034ab71cc35107fd81d4d0904a
-
SHA1
7e00fa5b9e8718d6ae19856ecc1be4cbf487a164
-
SHA256
ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81
-
SHA512
48804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d
-
SSDEEP
12288:F3P+z2F99SVFC6UJiMCXxdS3uh57eNgZP:F342FUVMCXjlhVeNg5
Malware Config
Extracted
remcos
3.0.1 Pro
RemoteHost
capriteam.ddns.net:1010
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VHHYND
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
pid Process 3108 WScript.exe -
Executes dropped EXE 2 IoCs
pid Process 3116 remcos.exe 2532 remcos.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4040 set thread context of 1568 4040 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 87 PID 3116 set thread context of 2532 3116 remcos.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4040 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 3116 remcos.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4040 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 3116 remcos.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4040 wrote to memory of 1568 4040 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 87 PID 4040 wrote to memory of 1568 4040 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 87 PID 4040 wrote to memory of 1568 4040 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 87 PID 4040 wrote to memory of 1568 4040 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 87 PID 1568 wrote to memory of 3108 1568 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 88 PID 1568 wrote to memory of 3108 1568 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 88 PID 1568 wrote to memory of 3108 1568 a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe 88 PID 3108 wrote to memory of 4440 3108 WScript.exe 91 PID 3108 wrote to memory of 4440 3108 WScript.exe 91 PID 3108 wrote to memory of 4440 3108 WScript.exe 91 PID 4440 wrote to memory of 3116 4440 cmd.exe 94 PID 4440 wrote to memory of 3116 4440 cmd.exe 94 PID 4440 wrote to memory of 3116 4440 cmd.exe 94 PID 3116 wrote to memory of 2532 3116 remcos.exe 96 PID 3116 wrote to memory of 2532 3116 remcos.exe 96 PID 3116 wrote to memory of 2532 3116 remcos.exe 96 PID 3116 wrote to memory of 2532 3116 remcos.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a955ac034ab71cc35107fd81d4d0904a_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Checks computer location settings
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2532
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
622B
MD5643a79abdc3f32f5a14d7964d479040c
SHA133368a48f78ff737aa2f4c0cbf9a4810e23f3780
SHA256115a6f1c26738bfd44c3d81723d091bc90662123ad01497b353707161997948e
SHA5123a42f2753a9a2d14c461722923622408eb76b6f85bd186377bfe2af44ff882714a38e0d223d69d2b28dc8390cc386c6fef5bf325dc20e4cf499d991e32d2bb58
-
Filesize
396KB
MD5a955ac034ab71cc35107fd81d4d0904a
SHA17e00fa5b9e8718d6ae19856ecc1be4cbf487a164
SHA256ba52101e664d1ab4110977264bb16ff13c5bf4bdb004ddcacba915006d275b81
SHA51248804a5469f810aa8f936e5ee5e466263a8da35d42c058fb7a77928b22135ea2e3b3bf41ad075a8449d3c13c4dcaa84aa6ce5e463c33ccc40e40c21cd90e847d