Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 06:57

General

  • Target

    e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    e967e5778bbce368c0786e990cda6417

  • SHA1

    92c06f11f52865d2c05a091d92907cc446b150f3

  • SHA256

    1012f81b764e19da221657cbf5c400063faef8f97d82ccc1c7b1bab0921aa85b

  • SHA512

    098caaec0f9482e2b13d1460d3be95322fa564ff5490fe9c06cee735502edabf95804e9d42504bf3d60557b187ce798fa883e188e0c5307a3f33a291f360d8b5

  • SSDEEP

    24576:rrfP1Tok9Kc87buCPiCH3pSkT4gN38kOW8qdM7o+N4Du7Ec:Pd9KcsbDiCwM4CsBTWMpN4OEc

Malware Config

Signatures

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2924
    • C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\ProgramData\WMP UPDATE\client.exe
        "C:\ProgramData\WMP UPDATE\client.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2728
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\WMP UPDATE\client.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:268
        • C:\ProgramData\WMP UPDATE\client.exe
          "C:\ProgramData\WMP UPDATE\client.exe"
          4⤵
          • Executes dropped EXE
          PID:848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    8f6ca8e01da45ffe10f5695abdbb1a5a

    SHA1

    6a8e1bbb159fa86a698b4ae4b5742a9169ce34f0

    SHA256

    e14cca5f6f2c214963996b8300428065985770c06d1ab04b41c5279496cc4a0e

    SHA512

    d972906b6f25ff649fd16810ba207ad812009474c651f8e1e37a8b81551072627a5eb825424e7ab6df421ba7fa006a3510622fe685ed0c4b735c97b823bbabaa

  • \ProgramData\WMP UPDATE\client.exe

    Filesize

    1.4MB

    MD5

    e967e5778bbce368c0786e990cda6417

    SHA1

    92c06f11f52865d2c05a091d92907cc446b150f3

    SHA256

    1012f81b764e19da221657cbf5c400063faef8f97d82ccc1c7b1bab0921aa85b

    SHA512

    098caaec0f9482e2b13d1460d3be95322fa564ff5490fe9c06cee735502edabf95804e9d42504bf3d60557b187ce798fa883e188e0c5307a3f33a291f360d8b5

  • memory/268-68-0x000000006EB00000-0x000000006F0AB000-memory.dmp

    Filesize

    5.7MB

  • memory/268-71-0x00000000027E0000-0x0000000002820000-memory.dmp

    Filesize

    256KB

  • memory/268-69-0x000000006EB00000-0x000000006F0AB000-memory.dmp

    Filesize

    5.7MB

  • memory/268-70-0x00000000027E0000-0x0000000002820000-memory.dmp

    Filesize

    256KB

  • memory/268-72-0x000000006EB00000-0x000000006F0AB000-memory.dmp

    Filesize

    5.7MB

  • memory/848-57-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/848-63-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/1980-6-0x00000000059E0000-0x0000000005AFC000-memory.dmp

    Filesize

    1.1MB

  • memory/1980-7-0x0000000005E70000-0x0000000005F44000-memory.dmp

    Filesize

    848KB

  • memory/1980-3-0x0000000000290000-0x00000000002A8000-memory.dmp

    Filesize

    96KB

  • memory/1980-2-0x00000000045C0000-0x0000000004600000-memory.dmp

    Filesize

    256KB

  • memory/1980-5-0x00000000045C0000-0x0000000004600000-memory.dmp

    Filesize

    256KB

  • memory/1980-4-0x0000000074220000-0x000000007490E000-memory.dmp

    Filesize

    6.9MB

  • memory/1980-1-0x0000000074220000-0x000000007490E000-memory.dmp

    Filesize

    6.9MB

  • memory/1980-0-0x0000000000D20000-0x0000000000E98000-memory.dmp

    Filesize

    1.5MB

  • memory/1980-24-0x0000000074220000-0x000000007490E000-memory.dmp

    Filesize

    6.9MB

  • memory/2648-31-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-19-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-21-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-8-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-10-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-12-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-14-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-15-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-27-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-16-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

  • memory/2648-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2728-67-0x0000000073110000-0x00000000737FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2728-43-0x0000000004E30000-0x0000000004E70000-memory.dmp

    Filesize

    256KB

  • memory/2728-42-0x0000000073110000-0x00000000737FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2728-36-0x0000000004E30000-0x0000000004E70000-memory.dmp

    Filesize

    256KB

  • memory/2728-35-0x0000000001270000-0x00000000013E8000-memory.dmp

    Filesize

    1.5MB

  • memory/2728-34-0x0000000073110000-0x00000000737FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2924-41-0x000000006F240000-0x000000006F7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2924-40-0x0000000002820000-0x0000000002860000-memory.dmp

    Filesize

    256KB

  • memory/2924-39-0x0000000002820000-0x0000000002860000-memory.dmp

    Filesize

    256KB

  • memory/2924-38-0x000000006F240000-0x000000006F7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2924-37-0x000000006F240000-0x000000006F7EB000-memory.dmp

    Filesize

    5.7MB