Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe
-
Size
451KB
-
MD5
f206fcd4c9308dbd966384dc94ea6811
-
SHA1
49e1c7affefcbdc4a69ce941704b63f0508760de
-
SHA256
301042d2e4c7c38c45d27312dffcd8260060bc8d98ddb510dbbf7f52f1f0f151
-
SHA512
efcce74dc0f7a326a54f7b7a999071236f92d1f0930630f10dbd070e4c3c4d4aef43dcaaa1d570ccb665f39490889529b4a87d73109f83f4477d60c9f2e49789
-
SSDEEP
6144:vuS/mbZR6tzw+HYzXfjn7FdXjxTpUQPY5e9JfQ3EIY0FY:XmbZRp+4pxxJY5cQ3EIYR
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-3-0x0000000000550000-0x0000000000598000-memory.dmp family_zgrat_v1 -
WSHRAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\ugbeh.vbs family_wshrat -
Blocklisted process makes network request 8 IoCs
Processes:
wscript.exeflow pid process 9 2740 wscript.exe 10 2740 wscript.exe 11 2740 wscript.exe 12 2740 wscript.exe 13 2740 wscript.exe 14 2740 wscript.exe 15 2740 wscript.exe 17 2740 wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ugbeh.vbs wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ugbeh.vbs wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\musaka = "\"C:\\Users\\Admin\\AppData\\Roaming\\musaka.exe\"" f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exedescription pid process target process PID 1964 set thread context of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exepid process 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exef206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exedescription pid process target process PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 1964 wrote to memory of 2692 1964 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe PID 2692 wrote to memory of 2740 2692 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe wscript.exe PID 2692 wrote to memory of 2740 2692 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe wscript.exe PID 2692 wrote to memory of 2740 2692 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe wscript.exe PID 2692 wrote to memory of 2740 2692 f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe wscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f206fcd4c9308dbd966384dc94ea6811_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\ugbeh.vbs3⤵
- Blocklisted process makes network request
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ugbeh.vbsFilesize
180KB
MD58ffe3d7ee738e0573bd189ccc3b539b2
SHA194eab63679eca28bcd764d6d5d42094467e3d2ac
SHA256f4af882c098d1e7c1e989ab36b0653a580d55ac0b52b2f6cd1faa070c738698f
SHA5125f30d676aca05fcde57f17ddc87ba86a2d05bbf72fe166d97de042eca60dca76413a2bdaebe10e22471ae4689601d849e58cb78eb6aaf4cfa6fd6384dc81b273
-
memory/1964-0-0x0000000000AF0000-0x0000000000B66000-memory.dmpFilesize
472KB
-
memory/1964-1-0x00000000745F0000-0x0000000074CDE000-memory.dmpFilesize
6.9MB
-
memory/1964-2-0x0000000004C00000-0x0000000004C40000-memory.dmpFilesize
256KB
-
memory/1964-3-0x0000000000550000-0x0000000000598000-memory.dmpFilesize
288KB
-
memory/1964-19-0x00000000745F0000-0x0000000074CDE000-memory.dmpFilesize
6.9MB
-
memory/2692-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2692-11-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-9-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-15-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-17-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-7-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-20-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-21-0x00000000745F0000-0x0000000074CDE000-memory.dmpFilesize
6.9MB
-
memory/2692-5-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-24-0x00000000745F0000-0x0000000074CDE000-memory.dmpFilesize
6.9MB