Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 11:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe
-
Size
1.0MB
-
MD5
e77736cd2247a057638f7010e5ca80e6
-
SHA1
938ac139fd722f3d7c0ac4c06019c6c794b4048b
-
SHA256
6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e
-
SHA512
08416526c24a818ebbf52106422849ae8ff9ab75b6df372e0bb8abe42deb77ed64226cec2b80ce125fe68da63d27e614250a0c78efa73c84ddcbebacfd098a3c
-
SSDEEP
24576:XbYPbYPbYPbYPbYPbYEEbF5uSPTAaTVxuWcE9i1ZN6/BABT/9:XbubububububsF5tPTAaTVxhcQid6y/9
Malware Config
Extracted
remcos
2.7.0 Pro
31
pruebatreintauno167821.duckdns.org:1616
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-Q9CDFX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Remcos family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2756 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2208 set thread context of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 2756 powershell.exe 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe Token: SeDebugPrivilege 2756 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1136 RegSvcs.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2756 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 31 PID 2208 wrote to memory of 2756 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 31 PID 2208 wrote to memory of 2756 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 31 PID 2208 wrote to memory of 2756 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 31 PID 2208 wrote to memory of 2792 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 33 PID 2208 wrote to memory of 2792 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 33 PID 2208 wrote to memory of 2792 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 33 PID 2208 wrote to memory of 2792 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 33 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35 PID 2208 wrote to memory of 1136 2208 JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fe7cd8556827d79fabee1921c2b0e64a0bc1f69f3bbcb50cfdcdc260ac5b40e.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KNzGgKDdavn.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KNzGgKDdavn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7197.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2792
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58d3376445dcdbeb71a4ec6a01ff47676
SHA14a7957288a46e9b7723462b2b3566753c2b88b50
SHA256a2ea491bc0475170a20e6c0fdc97c86db728d2f2a066f42e37c5d8b8a65177a0
SHA5128f1f807fe8a59355a42dcb8de116f1e594fbcd7bc6763998849524ef1dfba70c20d705c38fc6939b9e39acbf9fd07a5807fe5dac681b5f629423caeeda1e4a16
-
Filesize
74B
MD5021ce220ee6f6461600d8034a2574d32
SHA1509577c5c6ce7e9ea4578f9b25e8043552a1e826
SHA2561031fdd952c01d2fade67441e561c0554c5ea68fcb9c4ea893c22304eccb8ca1
SHA512de206a751f289f0245dcb4dc2e1dab5452de022338c552055d84abf671aef09c3b177f609d5f49e04d4ea1310e453e8d1d8e10f5d4ffb8580117a1e4c4593a4b