Analysis
- max time kernel
68s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 17:33
General
- Target 8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exe
- Size 1.5MB
- Sample240403-v49bpagc73
- SHA256 2d29036ba5f262322db7f19bfa504e5e6d5c276a51f351e55364c356bcd00f58
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
BROC
-
sommerishere.sytes.net:61537
-
mommerishere.sytes.net:61537
-
QSR_MUTEX_htKuXGSpSizsV4VV3h
-
encryption_key
upc0vIcniTlPRcfvkZHp
-
install_name
Updater.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
Windows
Signatures
- Detect ZGRat V1 1 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exe" -Force2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y5j4TH6U8dI5.bat" "3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
8d81b074c6351ef6cb801ddbc24d4354_JaffaCakes118.exe.log
Y5j4TH6U8dI5.bat
__PSScriptPolicyTest_l2iqqpct.b2w.ps1
memory/4000-1-0x0000000000F60000-0x00000000010EA000-memory.dmp
memory/4000-2-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4000-3-0x0000000005AC0000-0x0000000005BE0000-memory.dmp
memory/4000-5-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
memory/4000-6-0x00000000066D0000-0x000000000670E000-memory.dmp
memory/4000-0-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4000-15-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4196-34-0x0000000006700000-0x000000000674C000-memory.dmp
memory/4196-8-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4196-11-0x00000000057E0000-0x0000000005E08000-memory.dmp
memory/4196-16-0x00000000056F0000-0x0000000005712000-memory.dmp
memory/4196-7-0x0000000002DA0000-0x0000000002DD6000-memory.dmp
memory/4196-49-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4196-46-0x0000000006CE0000-0x0000000006D02000-memory.dmp
memory/4196-45-0x0000000007900000-0x0000000007996000-memory.dmp
memory/4196-21-0x0000000006060000-0x00000000060C6000-memory.dmp
memory/4196-9-0x00000000051A0000-0x00000000051B0000-memory.dmp
memory/4196-41-0x0000000007F80000-0x00000000085FA000-memory.dmp
memory/4196-20-0x0000000005FF0000-0x0000000006056000-memory.dmp
memory/4196-32-0x00000000060D0000-0x0000000006424000-memory.dmp
memory/4196-33-0x00000000066C0000-0x00000000066DE000-memory.dmp
memory/4196-10-0x00000000051A0000-0x00000000051B0000-memory.dmp
memory/4196-43-0x0000000006BD0000-0x0000000006BEA000-memory.dmp
memory/4196-37-0x00000000051A0000-0x00000000051B0000-memory.dmp
memory/4824-36-0x00000000064B0000-0x00000000064EC000-memory.dmp
memory/4824-35-0x0000000005F30000-0x0000000005F42000-memory.dmp
memory/4824-12-0x0000000000400000-0x000000000045E000-memory.dmp
memory/4824-42-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4824-24-0x0000000005040000-0x0000000005050000-memory.dmp
memory/4824-19-0x0000000005050000-0x00000000050E2000-memory.dmp
memory/4824-18-0x0000000005540000-0x0000000005AE4000-memory.dmp
memory/4824-17-0x0000000074CB0000-0x0000000075460000-memory.dmp