Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 03:26
Behavioral task
behavioral1
Sample
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe
-
Size
905KB
-
MD5
8cbde96ada607b270b1ca1bd725c946f
-
SHA1
29d7cd4c3dfb7d63e169f87053ae73f6ebf4b449
-
SHA256
88f1963ba61b31fd9c2fb7b604867bc3d04552dead616f6ebb63945014df16ba
-
SHA512
f46348214286f34535cb3f27e31f7dfc01b6666a2940b60ca6c203c18e368fb77e0fa3b6b104e379aa66d40a0a6407b2bf7a8afedac7dfe838daf256d1d98363
-
SSDEEP
24576:ZKa4MROxnF0ptJSRrrcI0AilFEvxHPRtoo3:ZOMiSTSRrrcI0AilFEvxHP
Malware Config
Extracted
orcus
eta.ne.virus.ne.trogaj.mena.kstati.putinso.site:3232
3798ee9268c5481cb713c259a2b2a0d2
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%appdata%\regedit.exe
-
reconnect_delay
10000
-
registry_keyname
Disc0rd
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\regedit.exe family_orcus -
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2380-1-0x0000000000AF0000-0x0000000000BD8000-memory.dmp orcus \Users\Admin\AppData\Roaming\regedit.exe orcus behavioral1/memory/1820-16-0x0000000000D20000-0x0000000000E08000-memory.dmp orcus -
Executes dropped EXE 2 IoCs
Processes:
regedit.exeregedit.exepid process 1820 regedit.exe 2752 regedit.exe -
Loads dropped DLL 1 IoCs
Processes:
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exepid process 2380 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs regedit.exe 2 IoCs
Processes:
regedit.exeregedit.exepid process 2752 regedit.exe 1820 regedit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regedit.exedescription pid process Token: SeDebugPrivilege 1820 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
regedit.exepid process 1820 regedit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exetaskeng.exedescription pid process target process PID 2380 wrote to memory of 1820 2380 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe regedit.exe PID 2380 wrote to memory of 1820 2380 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe regedit.exe PID 2380 wrote to memory of 1820 2380 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe regedit.exe PID 2380 wrote to memory of 1820 2380 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe regedit.exe PID 2600 wrote to memory of 2752 2600 taskeng.exe regedit.exe PID 2600 wrote to memory of 2752 2600 taskeng.exe regedit.exe PID 2600 wrote to memory of 2752 2600 taskeng.exe regedit.exe PID 2600 wrote to memory of 2752 2600 taskeng.exe regedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\regedit.exe"C:\Users\Admin\AppData\Roaming\regedit.exe"2⤵
- Executes dropped EXE
- Runs regedit.exe
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {1306F73F-F255-4635-B9EB-576B4CF2059E} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\regedit.exeC:\Users\Admin\AppData\Roaming\regedit.exe2⤵
- Executes dropped EXE
- Runs regedit.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\regedit.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\Users\Admin\AppData\Roaming\regedit.exeFilesize
905KB
MD58cbde96ada607b270b1ca1bd725c946f
SHA129d7cd4c3dfb7d63e169f87053ae73f6ebf4b449
SHA25688f1963ba61b31fd9c2fb7b604867bc3d04552dead616f6ebb63945014df16ba
SHA512f46348214286f34535cb3f27e31f7dfc01b6666a2940b60ca6c203c18e368fb77e0fa3b6b104e379aa66d40a0a6407b2bf7a8afedac7dfe838daf256d1d98363
-
memory/1820-20-0x0000000000770000-0x00000000007BE000-memory.dmpFilesize
312KB
-
memory/1820-19-0x0000000000390000-0x00000000003A2000-memory.dmpFilesize
72KB
-
memory/1820-26-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/1820-25-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/1820-22-0x0000000004350000-0x0000000004360000-memory.dmpFilesize
64KB
-
memory/1820-21-0x0000000004330000-0x0000000004348000-memory.dmpFilesize
96KB
-
memory/1820-18-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/1820-17-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/1820-16-0x0000000000D20000-0x0000000000E08000-memory.dmpFilesize
928KB
-
memory/2380-2-0x0000000000470000-0x000000000047E000-memory.dmpFilesize
56KB
-
memory/2380-0-0x00000000748BE000-0x00000000748BF000-memory.dmpFilesize
4KB
-
memory/2380-1-0x0000000000AF0000-0x0000000000BD8000-memory.dmpFilesize
928KB
-
memory/2380-3-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/2380-24-0x00000000748B0000-0x0000000074F9E000-memory.dmpFilesize
6.9MB
-
memory/2380-5-0x00000000005F0000-0x0000000000602000-memory.dmpFilesize
72KB
-
memory/2380-4-0x00000000009F0000-0x0000000000A4C000-memory.dmpFilesize
368KB