Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
08/09/2024, 05:45
General
- Target d3ae29e3719d5fd68d31bf3c4d9eac30_JaffaCakes118.exe
- Size 252KB
- Sample240908-gf8hlazelp
- SHA256 bc1c02ee6e4d533847e586205284c7cc4d69909b2bd9c6781c92c766384405f2
Malware Config
Signatures
- Detects PlugX payload 18 IoCs
- PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3ae29e3719d5fd68d31bf3c4d9eac30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d3ae29e3719d5fd68d31bf3c4d9eac30_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/452-32-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-41-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-33-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-4-0x0000000000E70000-0x0000000000E71000-memory.dmp
memory/452-5-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-8-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-31-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-21-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-22-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-23-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-20-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-9-0x0000000001490000-0x00000000014BE000-memory.dmp
memory/452-19-0x0000000000E70000-0x0000000000E71000-memory.dmp
memory/1820-7-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1820-26-0x0000000003510000-0x0000000003610000-memory.dmp
memory/1820-1-0x0000000003510000-0x0000000003610000-memory.dmp
memory/1820-2-0x0000000003780000-0x00000000037AE000-memory.dmp
memory/1820-3-0x0000000003780000-0x00000000037AE000-memory.dmp
memory/3784-25-0x0000000002580000-0x00000000025AE000-memory.dmp
memory/3784-30-0x0000000002580000-0x00000000025AE000-memory.dmp
memory/3784-29-0x0000000002580000-0x00000000025AE000-memory.dmp
memory/3784-28-0x0000000002530000-0x0000000002531000-memory.dmp
memory/3784-27-0x0000000002580000-0x00000000025AE000-memory.dmp
memory/3784-24-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3784-34-0x0000000002580000-0x00000000025AE000-memory.dmp