ratty | 9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c

General

Target

018e4cd2137de20e2142fd999d9befdf_JaffaCakes118.jar
Size

415KB
MD5

018e4cd2137de20e2142fd999d9befdf
SHA1

cd37af8a3b23ae0b223ae3e52c3c5b683deb23a0
SHA256

9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c
SHA512

6c0ccf4c049ee705d884539857b1190e89f22567bd726b1c0f31e46ffe7392051860e124e40129fd70b6dd5b6d1c5110d5ec14400b37be00a4c228a565f2b422
SSDEEP

12288:TFAzU67etJXECDCXUxqyNq4D8HkxU5YCyNU:TFG77etR7CXUxfNqQxUINU

Score

10^/10

ratty discovery persistence rat trojan

Malware Config

Signatures

Ratty
Ratty is an open source Java Remote Access Tool.
trojan rat ratty

Ratty Rat payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0003000000022d25-17.dat	family_ratty

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\inhuqsomd.txt	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\inhuqsomd.txt	javaw.exe

Loads dropped DLL 1 IoCs

pid	Process
1036	javaw.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3220	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inhuqsomd.txt = "C:\\Users\\Admin\\AppData\\Roaming\\inhuqsomd.txt"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1860	REG.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1036	javaw.exe
1036	javaw.exe
1036	javaw.exe
1036	javaw.exe
1036	javaw.exe
1036	javaw.exe
1036	javaw.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3220	4080	java.exe	97
PID 4080 wrote to memory of 3220	4080	java.exe	97
PID 4080 wrote to memory of 1240	4080	java.exe	99
PID 4080 wrote to memory of 1240	4080	java.exe	99
PID 1240 wrote to memory of 1036	1240	wscript.exe	100
PID 1240 wrote to memory of 1036	1240	wscript.exe	100
PID 1036 wrote to memory of 1860	1036	javaw.exe	103
PID 1036 wrote to memory of 1860	1036	javaw.exe	103
PID 1036 wrote to memory of 3840	1036	javaw.exe	104
PID 1036 wrote to memory of 3840	1036	javaw.exe	104
PID 1036 wrote to memory of 1564	1036	javaw.exe	105
PID 1036 wrote to memory of 1564	1036	javaw.exe	105

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3840	attrib.exe
1564	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\018e4cd2137de20e2142fd999d9befdf_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3220
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\lcxjxwgqpx.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\inhuqsomd.txt"
    3⤵
    - Drops startup file
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\SYSTEM32\REG.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "inhuqsomd.txt" /d "C:\Users\Admin\AppData\Roaming\inhuqsomd.txt" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1860
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\inhuqsomd.txt
      4⤵
      Views/modifies file attributes
      PID:3840
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\inhuqsomd.txt
      4⤵
      Views/modifies file attributes
      PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

File and Directory Permissions Modification

1

T1222

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
66c8d0ba70a33d29f7cb63acb729b412

SHA1
7bc392a5a168646f430fdceb9db57c5c2246cb9a

SHA256
5db1c5709fb2d634f1c9768ef3b97c7bb4b487ca96d65dd4e7f7dc8be976609d

SHA512
029d7ff5be9c86da3683980b03231576d0567238f1dadc7da944c2684a361fcb784dcc9ae287221ce6b6d2fb7973e7af742960b633bfa7b49beb386bd811a792

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll

Filesize
83KB

MD5
55f4de7f270663b3dc712b8c9eed422a

SHA1
7432773eb4d09dc286d43fcc77ddb0e1e3bce2b4

SHA256
47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25

SHA512
9da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996

Download Submit
C:\Users\Admin\AppData\Roaming\inhuqsomd.txt

Filesize
332KB

MD5
af7f264ed40f293a01ee685ee7d42daf

SHA1
a20caef9550c2ae144529b60598b5f58e63a409a

SHA256
2436fa28a278522c298b3a398ddc553c96c4be29ae7b433a999ad49ac71d656c

SHA512
05a060fe3d4b9f92180987d742e5ecad0deb1c5d2cbb1deec0fb31af8ddc5aa867b73ac0b9af02a764c453ba50fc4e9bd6d42b83b294a9e9bcf91b32c34ded7d

Download Submit
C:\Users\Admin\lcxjxwgqpx.js

Filesize
634KB

MD5
65225b9f3a8c18d88929b65409c24f6b

SHA1
0e67e77a99ce04077739672198a0b29f43790dfb

SHA256
2b668f355b8bacb7aebb291c83808a557700807d441564f78784debd86e3e2cc

SHA512
6ba01958b389e8a618732992a6f1f37f19ace63284278d9c7966a1668301d7ad4e48385d19a76db9907b4e7484ba960510041ab2a1a21f9fca9b2e5e5f86a6fd

Download Submit
memory/1036-22-0x0000021380000000-0x0000021381000000-memory.dmp

Filesize
16.0MB

Download
memory/1036-30-0x00000213F73F0000-0x00000213F73F1000-memory.dmp

Filesize
4KB

Download
memory/1036-37-0x00000213F73F0000-0x00000213F73F1000-memory.dmp

Filesize
4KB

Download
memory/1036-49-0x0000000065E40000-0x0000000065E55000-memory.dmp

Filesize
84KB

Download
memory/1036-50-0x0000000065E40000-0x0000000065E55000-memory.dmp

Filesize
84KB

Download
memory/1036-51-0x0000021380000000-0x0000021381000000-memory.dmp

Filesize
16.0MB

Download
memory/1036-57-0x0000000065E40000-0x0000000065E55000-memory.dmp

Filesize
84KB

Download
memory/4080-14-0x000001DDF2450000-0x000001DDF2451000-memory.dmp

Filesize
4KB

Download
memory/4080-11-0x000001DDF2450000-0x000001DDF2451000-memory.dmp

Filesize
4KB

Download
memory/4080-2-0x000001DD80000000-0x000001DD81000000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads