Analysis
-
max time kernel
136s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 13:29
Behavioral task
behavioral1
Sample
JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe
-
Size
72KB
-
MD5
bbb8e40c8828fb4649ab6414cea472f8
-
SHA1
ee633e317ca9a66a97550aa6e5521803a27693e6
-
SHA256
5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417
-
SHA512
c9f9c41ba8c99cb3e913e6cffd63be0f5dfc81e08e056d0ce2083e16b344c0990b9455c21c07e7bf34ba46e9514d66d12966c02d2292b5e5e26aef90f2aed06c
-
SSDEEP
1536:QoD1Mth9k0XBq+adebTry5UNEN5rNKmVcl:QoD1Mthy0MXebTdk5JK8Y
Malware Config
Extracted
asyncrat
0.5.6D
Default
milla.publicvm.com:6606
milla.publicvm.com:7707
milla.publicvm.com:8808
bdeyjxzfhfrvuzdyrin
-
delay
3
-
install
true
-
install_file
firefoxa.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b79-10.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe -
Executes dropped EXE 1 IoCs
pid Process 5072 firefoxa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 4256 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 664 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe Token: SeDebugPrivilege 5072 firefoxa.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4488 wrote to memory of 5012 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 84 PID 4488 wrote to memory of 5012 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 84 PID 4488 wrote to memory of 1468 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 86 PID 4488 wrote to memory of 1468 4488 JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe 86 PID 5012 wrote to memory of 664 5012 cmd.exe 88 PID 5012 wrote to memory of 664 5012 cmd.exe 88 PID 1468 wrote to memory of 4256 1468 cmd.exe 89 PID 1468 wrote to memory of 4256 1468 cmd.exe 89 PID 1468 wrote to memory of 5072 1468 cmd.exe 92 PID 1468 wrote to memory of 5072 1468 cmd.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417 /tr '"C:\Users\Admin\AppData\Roaming\firefoxa.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn JaffaCakes118_5aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417 /tr '"C:\Users\Admin\AppData\Roaming\firefoxa.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAF3B.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4256
-
-
C:\Users\Admin\AppData\Roaming\firefoxa.exe"C:\Users\Admin\AppData\Roaming\firefoxa.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5cc156159da52d98edcab998589ec911a
SHA19e3a85723ea13d0e5196bd77882a8da9928d0d86
SHA25647370ac070a44389579ae13e8f53a4a22cab113306cfea6612b9a9eca336b5bf
SHA5120d565bd714a5b6e5788d7ef4b4ce9794c3e92d1f32e2ec9b026d20e640b0228a13fcad2b50c5748da60dbdf34cd2690a62f068ab4576cac51d06e8a31edfdf38
-
Filesize
72KB
MD5bbb8e40c8828fb4649ab6414cea472f8
SHA1ee633e317ca9a66a97550aa6e5521803a27693e6
SHA2565aaec1bda08134d46382d217dbeba5a93a5969cb6ad918c04476086a21e8d417
SHA512c9f9c41ba8c99cb3e913e6cffd63be0f5dfc81e08e056d0ce2083e16b344c0990b9455c21c07e7bf34ba46e9514d66d12966c02d2292b5e5e26aef90f2aed06c