Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-10-2024 07:12

General

  • Target

    5b7184b825866b331b646b976e52165d_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    5b7184b825866b331b646b976e52165d

  • SHA1

    e88407cfb398a23e65113fdaa763e924f0da3819

  • SHA256

    312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b

  • SHA512

    521f667d961b6a703a5230fe52165eb3866527f4542e75b81756fb003a309e60929983e24707e3b7a52ad8ff24edbb5414199d53ca48b59145da4e5b80155f29

  • SSDEEP

    49152:4gjblslEu5zl4Yb9jUefS89Zg1aOGIC+kM:4g3i15VVUMZg1aOan

Malware Config

Signatures

  • Luminosity 2 IoCs

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 21 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b7184b825866b331b646b976e52165d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5b7184b825866b331b646b976e52165d_JaffaCakes118.exe"
    1⤵
    • Luminosity
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Users\Admin\AppData\Local\Temp\tsmgr.exe
      "C:\Users\Admin\AppData\Local\Temp\tsmgr.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3380
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f
        3⤵
        • Luminosity
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4880
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1896
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2244
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2692
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1656
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2200
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3456
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2400
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3312
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2948
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2536
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3872
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:4004
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:4520
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:5060
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1556
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3096
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1500
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2420
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:428
      • C:\Windows\SysWOW64\REG.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3888
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\tsmgr.exe.lnk " /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3020
    • C:\Users\Admin\AppData\Local\Temp\notepad.exe
      "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\FolderN\tsmgr.exe

    Filesize

    1.8MB

    MD5

    5b7184b825866b331b646b976e52165d

    SHA1

    e88407cfb398a23e65113fdaa763e924f0da3819

    SHA256

    312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b

    SHA512

    521f667d961b6a703a5230fe52165eb3866527f4542e75b81756fb003a309e60929983e24707e3b7a52ad8ff24edbb5414199d53ca48b59145da4e5b80155f29

  • C:\Users\Admin\AppData\Local\Temp\notepad.exe

    Filesize

    52KB

    MD5

    a64daca3cfbcd039df3ec29d3eddd001

    SHA1

    eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

    SHA256

    403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

    SHA512

    b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

  • C:\Users\Admin\AppData\Local\Temp\tsmgr.exe

    Filesize

    857KB

    MD5

    bc6529f2a93dd5eb328963e0b41a855a

    SHA1

    0d3fe448baa8a886fd33541f17e893a8a550640f

    SHA256

    b98c711a375f39574672d49fdb798e70dab73b56c5a605c2cfd55a82d8d1b528

    SHA512

    4b50bc0de71bdbdbe76622d498d70b940e11a5c34b6d58b43765eacb2447d3106da3ac80f3a20e7eed67598bf9875cda9646694724b8fae6d91a7ed97b0bad73

  • memory/1556-3-0x0000000074E92000-0x0000000074E93000-memory.dmp

    Filesize

    4KB

  • memory/1556-4-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/1556-0-0x0000000074E92000-0x0000000074E93000-memory.dmp

    Filesize

    4KB

  • memory/1556-2-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/1556-1-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/1556-27-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/2372-15-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/2372-16-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/2372-17-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB

  • memory/2372-28-0x0000000074E90000-0x0000000075441000-memory.dmp

    Filesize

    5.7MB