Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 23:04

General

  • Target

    ee9a4ee14382824e759636426db0aa6f_JaffaCakes118.exe

  • Size

    17.2MB

  • MD5

    ee9a4ee14382824e759636426db0aa6f

  • SHA1

    5ff8faa6df6c1ef352d4938be39a97092dd1c7c7

  • SHA256

    48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876

  • SHA512

    4c7a3f81eb713b68c5cf8376ec5f55428294732f2c97bf5cd8bea876d569d2bf1e2d3a9c09e64b51411deaf37f1670d02a1cf192e7427f9cef3135f4a09b6656

  • SSDEEP

    393216:8oiraP3TibAcVABUY/7+VRzBST8yYnnqop7sD4p6noceRC:8LaP3zcNYERzBSTOnnqO7sDI6B

Malware Config

Extracted

Family

webmonitor

C2

worldbala.wm01.to:443

Attributes
  • config_key

    1vt5MKV6CcJnGWsNVlYXmKcidNN2mBKt

  • private_key

    NcwyDvFB8

  • url_path

    /recv4.php

Signatures

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

  • WebMonitor payload 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee9a4ee14382824e759636426db0aa6f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee9a4ee14382824e759636426db0aa6f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\ee9a4ee14382824e759636426db0aa6f_JaffaCakes118.exe:Zone.Identifier"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      PID:2684
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\ee9a4ee14382824e759636426db0aa6f_JaffaCakes118.exe:Zone.Identifier"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      PID:2692
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\ee9a4ee14382824e759636426db0aa6f_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      PID:2752
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe
        "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2664
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe:Zone.Identifier"
          4⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          PID:1484
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Roaming\GfnWebBrowser.exe:Zone.Identifier"
          4⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          PID:3008
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\GfnWebBrowser.exe

    Filesize

    17.2MB

    MD5

    ee9a4ee14382824e759636426db0aa6f

    SHA1

    5ff8faa6df6c1ef352d4938be39a97092dd1c7c7

    SHA256

    48d173767bf24bb9ad394d2581ecedfdefc4e31fd79b114a79a196eca7fb8876

    SHA512

    4c7a3f81eb713b68c5cf8376ec5f55428294732f2c97bf5cd8bea876d569d2bf1e2d3a9c09e64b51411deaf37f1670d02a1cf192e7427f9cef3135f4a09b6656

  • memory/1032-31-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-33-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-18-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-32-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-30-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-29-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-28-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1032-26-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-34-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-24-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-23-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1032-20-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/2520-6-0x00000000006A0000-0x00000000006AC000-memory.dmp

    Filesize

    48KB

  • memory/2520-14-0x00000000747E0000-0x0000000074ECE000-memory.dmp

    Filesize

    6.9MB

  • memory/2520-8-0x00000000747E0000-0x0000000074ECE000-memory.dmp

    Filesize

    6.9MB

  • memory/2520-7-0x0000000000BB0000-0x0000000000BB6000-memory.dmp

    Filesize

    24KB

  • memory/2520-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

    Filesize

    4KB

  • memory/2520-5-0x00000000005F0000-0x00000000005FA000-memory.dmp

    Filesize

    40KB

  • memory/2520-4-0x00000000747E0000-0x0000000074ECE000-memory.dmp

    Filesize

    6.9MB

  • memory/2520-3-0x0000000000470000-0x000000000049A000-memory.dmp

    Filesize

    168KB

  • memory/2520-2-0x00000000747EE000-0x00000000747EF000-memory.dmp

    Filesize

    4KB

  • memory/2520-1-0x0000000001310000-0x00000000023B2000-memory.dmp

    Filesize

    16.6MB

  • memory/2664-17-0x0000000000D40000-0x0000000000D4C000-memory.dmp

    Filesize

    48KB

  • memory/2664-16-0x00000000010B0000-0x0000000002152000-memory.dmp

    Filesize

    16.6MB