Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
03/10/2024, 21:47
General
-
Target
109f178939666209f337edcb7095996d_JaffaCakes118.exe
-
Size
373KB
-
MD5
109f178939666209f337edcb7095996d
-
SHA1
a30d845117319e60679a0048a3f32fc90ceedd6c
-
SHA256
728032fc2156262ac444ba35b41678412fe7d95ee7abcf794169e1223cf340db
-
SHA512
d4127bf090a4e58fbac1a08e6d6a936b06948f3ff01a5e1796ac3c9fdb24f31ffe271eba5626323044cb55d2900f293609ae03c3664357dda7c309ba5ff0d79d
-
SSDEEP
6144:6dg5n5DJJL7XJAnY7yo0nqsJ445mgy+sk8VAX8dN4pq:VnnJHX+nO8hJB5mKD8Z1
Malware Config
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\109f178939666209f337edcb7095996d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\109f178939666209f337edcb7095996d_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
400KB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
584KB
-
Filesize
7.7MB