Overview

overview

10

Static

static

3

d34289d0f2...18.exe

windows7-x64

10

d34289d0f2...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2024 01:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d34289d0f2ac425fa5647d6acc488bcd_JaffaCakes118.exe

  • Size

    741KB

  • MD5

    d34289d0f2ac425fa5647d6acc488bcd

  • SHA1

    72197d4d62768d09913e0e106128cb63884eef6a

  • SHA256

    9993ea4fb9b7e0b7c084658cfaa0f94f64e90a5d7ef7dd973cdf0697c208fed6

  • SHA512

    ff91f69d2e01d8a44e6b56908d4d3014e11199be4d8bf28e3b2cc6ed2730da925921c58cc77d32dc0be000d91e98bbc6f0f098059f5f3f717d23ad997a9e4ba0

  • SSDEEP

    12288:MDOOXVRIBgJM6eB3IwnPkHKPZNoK8zW53kq7ZwRzHtL0QShru17/qXHx56RhPEqC:MDO56JM6eqmPKKPZN906ubLRll/WHxoq

Score
10/10
luminositydiscoverypersistencerat

Malware Config

Signatures

  • Luminosity 2 IoCs

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

    ratluminosity
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d34289d0f2ac425fa5647d6acc488bcd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d34289d0f2ac425fa5647d6acc488bcd_JaffaCakes118.exe"
    1⤵
    • Luminosity
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\htfxng.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\htfxng.exe" -n
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\htfxng.lnk" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\htfxng.lnk" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:432
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\htfxng.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\htfxng.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:732
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
          4⤵
          • Luminosity
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:744
        • C:\Windows\SysWOW64\REG.exe
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:1552
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
          dw20.exe -x -s 780
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:3592
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe"
        3⤵
          PID:4696
    • C:\Program Files (x86)\Client\client.exe
      "C:\Program Files (x86)\Client\client.exe" /startup
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2312
    • C:\Program Files (x86)\Client\client.exe
      "C:\Program Files (x86)\Client\client.exe" /startup
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3692

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\client.exe.log
      Filesize

      617B

      MD5

      99e770c0d4043aa84ef3d3cbc7723c25

      SHA1

      19829c5c413fccba750a3357f938dfa94486acad

      SHA256

      33c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5

      SHA512

      ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\htfxng.exe
      Filesize

      741KB

      MD5

      d34289d0f2ac425fa5647d6acc488bcd

      SHA1

      72197d4d62768d09913e0e106128cb63884eef6a

      SHA256

      9993ea4fb9b7e0b7c084658cfaa0f94f64e90a5d7ef7dd973cdf0697c208fed6

      SHA512

      ff91f69d2e01d8a44e6b56908d4d3014e11199be4d8bf28e3b2cc6ed2730da925921c58cc77d32dc0be000d91e98bbc6f0f098059f5f3f717d23ad997a9e4ba0

      Download Submit

    • memory/732-27-0x00000000056B0000-0x0000000005742000-memory.dmp

      Filesize

      584KB

      Download

    • memory/732-25-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

      Download

    • memory/1360-1-0x0000000000700000-0x00000000007C0000-memory.dmp

      Filesize

      768KB

      Download

    • memory/1360-2-0x00000000051A0000-0x000000000523C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1360-3-0x0000000074ED0000-0x0000000075680000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1360-4-0x0000000005240000-0x00000000052FC000-memory.dmp

      Filesize

      752KB

      Download

    • memory/1360-5-0x00000000059B0000-0x0000000005F54000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/1360-20-0x0000000074ED0000-0x0000000075680000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1360-0-0x0000000074EDE000-0x0000000074EDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1772-29-0x0000000000400000-0x0000000000408000-memory.dmp

      Filesize

      32KB

      Download

    • memory/5068-22-0x0000000074ED0000-0x0000000075680000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5068-36-0x0000000074ED0000-0x0000000075680000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5068-37-0x0000000074ED0000-0x0000000075680000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5068-21-0x0000000074ED0000-0x0000000075680000-memory.dmp

      Filesize

      7.7MB

      Download