Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 23:45
Behavioral task
behavioral1
Sample
JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe
-
Size
45KB
-
MD5
9c851b642e1e49781e2ce9eedb02ee64
-
SHA1
e22971a8700bf28867e744244474033d55143ee5
-
SHA256
fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8
-
SHA512
77696aaae1df81d5922ddf30a6df4fc8f1e3aacdb2884d1a55e8362315f6895c13394fc14723f2879a8848cf33ec235a5405841aed9450f15f515a251da6ebda
-
SSDEEP
768:buqg9T944nD5WUxiVDmo2qrjKjGKG6PIyzjbFgX3iSe8lUSoR29OAlpxyNmBDZrx:buqg9T9xy2uKYDy3bCXS+G38cApxhdrx
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1604
127.0.0.1:14778
6.tcp.eu.ngrok.io:6606
6.tcp.eu.ngrok.io:7707
6.tcp.eu.ngrok.io:8808
6.tcp.eu.ngrok.io:1604
6.tcp.eu.ngrok.io:14778
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
123.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023bab-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe -
Executes dropped EXE 1 IoCs
pid Process 4060 123.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 20 6.tcp.eu.ngrok.io 40 6.tcp.eu.ngrok.io 47 6.tcp.eu.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4244 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4420 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe Token: SeDebugPrivilege 4060 123.exe Token: SeDebugPrivilege 4060 123.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3716 wrote to memory of 1064 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 85 PID 3716 wrote to memory of 1064 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 85 PID 3716 wrote to memory of 1064 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 85 PID 3716 wrote to memory of 3212 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 87 PID 3716 wrote to memory of 3212 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 87 PID 3716 wrote to memory of 3212 3716 JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe 87 PID 1064 wrote to memory of 4420 1064 cmd.exe 89 PID 1064 wrote to memory of 4420 1064 cmd.exe 89 PID 1064 wrote to memory of 4420 1064 cmd.exe 89 PID 3212 wrote to memory of 4244 3212 cmd.exe 90 PID 3212 wrote to memory of 4244 3212 cmd.exe 90 PID 3212 wrote to memory of 4244 3212 cmd.exe 90 PID 3212 wrote to memory of 4060 3212 cmd.exe 91 PID 3212 wrote to memory of 4060 3212 cmd.exe 91 PID 3212 wrote to memory of 4060 3212 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "123" /tr '"C:\Users\Admin\AppData\Roaming\123.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "123" /tr '"C:\Users\Admin\AppData\Roaming\123.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4420
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD205.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4244
-
-
C:\Users\Admin\AppData\Roaming\123.exe"C:\Users\Admin\AppData\Roaming\123.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD51f2838a327e8206ca7f93fb6a3086b40
SHA1c70ef6e32d8fc78c2eac98847968cef1ae3c0ea5
SHA256569ba03c714989384617961449c1bc2624354e6cefaa76cdb505b3070853be8d
SHA5122a55fbb87fcde8f92fefa6764ddd62ab6448116dba02f8ec2165053b294788f4c2f58ee3a81095e9ead9b10f3c1c3c3b6bb9811da927ee86c8520f772cd84f03
-
Filesize
45KB
MD59c851b642e1e49781e2ce9eedb02ee64
SHA1e22971a8700bf28867e744244474033d55143ee5
SHA256fc1189eca6c99ec90d71c2317c7c89b5c5d54dd5d378a57e50669849775f25e8
SHA51277696aaae1df81d5922ddf30a6df4fc8f1e3aacdb2884d1a55e8362315f6895c13394fc14723f2879a8848cf33ec235a5405841aed9450f15f515a251da6ebda