Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 03:26
Behavioral task
behavioral1
Sample
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe
-
Size
905KB
-
MD5
8cbde96ada607b270b1ca1bd725c946f
-
SHA1
29d7cd4c3dfb7d63e169f87053ae73f6ebf4b449
-
SHA256
88f1963ba61b31fd9c2fb7b604867bc3d04552dead616f6ebb63945014df16ba
-
SHA512
f46348214286f34535cb3f27e31f7dfc01b6666a2940b60ca6c203c18e368fb77e0fa3b6b104e379aa66d40a0a6407b2bf7a8afedac7dfe838daf256d1d98363
-
SSDEEP
24576:ZKa4MROxnF0ptJSRrrcI0AilFEvxHPRtoo3:ZOMiSTSRrrcI0AilFEvxHP
Malware Config
Extracted
orcus
eta.ne.virus.ne.trogaj.mena.kstati.putinso.site:3232
3798ee9268c5481cb713c259a2b2a0d2
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%appdata%\regedit.exe
-
reconnect_delay
10000
-
registry_keyname
Disc0rd
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\regedit.exe family_orcus -
Orcurs Rat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3168-1-0x0000000000770000-0x0000000000858000-memory.dmp orcus C:\Users\Admin\AppData\Roaming\regedit.exe orcus -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
regedit.exeregedit.exepid process 6040 regedit.exe 4404 regedit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs regedit.exe 2 IoCs
Processes:
regedit.exeregedit.exepid process 6040 regedit.exe 4404 regedit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regedit.exedescription pid process Token: SeDebugPrivilege 6040 regedit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
regedit.exepid process 6040 regedit.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exedescription pid process target process PID 3168 wrote to memory of 6040 3168 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe regedit.exe PID 3168 wrote to memory of 6040 3168 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe regedit.exe PID 3168 wrote to memory of 6040 3168 8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe regedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8cbde96ada607b270b1ca1bd725c946f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\regedit.exe"C:\Users\Admin\AppData\Roaming\regedit.exe"2⤵
- Executes dropped EXE
- Runs regedit.exe
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\regedit.exeC:\Users\Admin\AppData\Roaming\regedit.exe1⤵
- Executes dropped EXE
- Runs regedit.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\regedit.exeFilesize
905KB
MD58cbde96ada607b270b1ca1bd725c946f
SHA129d7cd4c3dfb7d63e169f87053ae73f6ebf4b449
SHA25688f1963ba61b31fd9c2fb7b604867bc3d04552dead616f6ebb63945014df16ba
SHA512f46348214286f34535cb3f27e31f7dfc01b6666a2940b60ca6c203c18e368fb77e0fa3b6b104e379aa66d40a0a6407b2bf7a8afedac7dfe838daf256d1d98363
-
C:\Users\Admin\AppData\Roaming\regedit.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
memory/3168-6-0x0000000005390000-0x0000000005422000-memory.dmpFilesize
584KB
-
memory/3168-3-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB
-
memory/3168-4-0x0000000005190000-0x00000000051EC000-memory.dmpFilesize
368KB
-
memory/3168-5-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/3168-7-0x0000000005380000-0x0000000005392000-memory.dmpFilesize
72KB
-
memory/3168-2-0x0000000002C10000-0x0000000002C1E000-memory.dmpFilesize
56KB
-
memory/3168-23-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB
-
memory/3168-0-0x000000007490E000-0x000000007490F000-memory.dmpFilesize
4KB
-
memory/3168-1-0x0000000000770000-0x0000000000858000-memory.dmpFilesize
928KB
-
memory/4404-31-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB
-
memory/4404-36-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB
-
memory/4404-34-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB
-
memory/6040-24-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB
-
memory/6040-29-0x0000000006570000-0x0000000006588000-memory.dmpFilesize
96KB
-
memory/6040-27-0x0000000005CC0000-0x0000000005D0E000-memory.dmpFilesize
312KB
-
memory/6040-33-0x0000000006740000-0x000000000674A000-memory.dmpFilesize
40KB
-
memory/6040-26-0x0000000005880000-0x0000000005892000-memory.dmpFilesize
72KB
-
memory/6040-32-0x0000000006720000-0x0000000006730000-memory.dmpFilesize
64KB
-
memory/6040-30-0x00000000068E0000-0x0000000006AA2000-memory.dmpFilesize
1.8MB
-
memory/6040-25-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB
-
memory/6040-37-0x0000000074900000-0x00000000750B0000-memory.dmpFilesize
7.7MB