Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 10:54
Behavioral task
behavioral1
Sample
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe
-
Size
211KB
-
MD5
f0e35d7526ac18475f1cfcdd6c772a8c
-
SHA1
525a6d099216ae252d803f0e47806a55621e6d9e
-
SHA256
b9021561415bff1468c140ce32431baf1ee6f94aeacf450634f2b76232055438
-
SHA512
923ccad09ede28890165792c9229076ba55683efb989da85dea14048abed45abd8ca40af77d4a086f5701daabbcc6da415e0c737bb98029dfcf411b2a0c3ab0a
-
SSDEEP
6144:dqZ7oEYoRAQaUbRZH+CHRSwI7PTn422b4HuwIAXbPZcry+wNKevSK0b4EeU:da7TFUUbRMCf
Malware Config
Extracted
xtremerat
abcdgl.mooo.com
88.net
ƁᏘ캸glhacker.zapto.org
glhacwthackupdate.no-ip.biz
ƁᏘ캸winrarsfx.linkpc.net
winraabcdgl.mooo.com
.net
Signatures
-
Detect XtremeRAT payload 7 IoCs
Processes:
resource yara_rule C:\server.exe family_xtremerat behavioral1/memory/2680-27-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2900-31-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2588-35-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2888-37-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2588-40-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2588-41-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
svchost.exeserver.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\Microsoft\\update.exe" svchost.exe -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Adds policy Run key to start application 2 TTPs 8 IoCs
Processes:
svchost.exeserver.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
server.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3} server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3}\StubPath = "C:\\Windows\\Microsoft\\update.exe restart" server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C4EL34C4-EOX8-G74W-4066-AU2QRKI1J2A3}\StubPath = "C:\\Windows\\Microsoft\\update.exe restart" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
server.exeWolfteam++.exepid process 2888 server.exe 1700 Wolfteam++.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
server.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winupdate = "C:\\Windows\\Microsoft\\update.exe" server.exe -
Drops file in Windows directory 3 IoCs
Processes:
server.exedescription ioc process File opened for modification C:\Windows\Microsoft\update.exe server.exe File created C:\Windows\Microsoft\update.exe server.exe File opened for modification C:\Windows\Microsoft\ server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exesvchost.exepid process 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe 2588 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exeserver.exedescription pid process target process PID 2148 wrote to memory of 2888 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe server.exe PID 2148 wrote to memory of 2888 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe server.exe PID 2148 wrote to memory of 2888 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe server.exe PID 2148 wrote to memory of 2888 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe server.exe PID 2148 wrote to memory of 1700 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe Wolfteam++.exe PID 2148 wrote to memory of 1700 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe Wolfteam++.exe PID 2148 wrote to memory of 1700 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe Wolfteam++.exe PID 2148 wrote to memory of 1700 2148 f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe Wolfteam++.exe PID 2888 wrote to memory of 2680 2888 server.exe svchost.exe PID 2888 wrote to memory of 2680 2888 server.exe svchost.exe PID 2888 wrote to memory of 2680 2888 server.exe svchost.exe PID 2888 wrote to memory of 2680 2888 server.exe svchost.exe PID 2888 wrote to memory of 2680 2888 server.exe svchost.exe PID 2888 wrote to memory of 2588 2888 server.exe svchost.exe PID 2888 wrote to memory of 2588 2888 server.exe svchost.exe PID 2888 wrote to memory of 2588 2888 server.exe svchost.exe PID 2888 wrote to memory of 2588 2888 server.exe svchost.exe PID 2888 wrote to memory of 2900 2888 server.exe explorer.exe PID 2888 wrote to memory of 2900 2888 server.exe explorer.exe PID 2888 wrote to memory of 2900 2888 server.exe explorer.exe PID 2888 wrote to memory of 2900 2888 server.exe explorer.exe PID 2888 wrote to memory of 2900 2888 server.exe explorer.exe PID 2888 wrote to memory of 2588 2888 server.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0e35d7526ac18475f1cfcdd6c772a8c_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\server.exe"C:\server.exe"2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Wolfteam++.exe"C:\Wolfteam++.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Wolfteam++.exeFilesize
127KB
MD5a33d838a724bdb6c4776c83cade05c8d
SHA11d461f8ce81fd9158206087257b4141e4210d589
SHA256c87f6de3b8d6d0c21c3c3270322688199d1ca583f470f1ccf9a12c4326b745df
SHA512d5e0628bef30ef699ce61501d7dd05eecc96a531dea471e8abd889bccfa1e71fb2e07e01cb70402546cdbe16c812a49a3c71f20846dfa6f5de1eb3b45b58c0a1
-
C:\server.exeFilesize
44KB
MD5a32d0301ec441c45da2e43061fa602b9
SHA1cdb3fadd221c522141c927695f3d42eb5f579c16
SHA256c7f4a0c976caa8f3b5a79bdd3235d0108a2670e6e6f2a412aa0d6fb7d3c6120a
SHA512c18d9e6468e149f7c525ce64965324e62f2ce6df37138ce1a4401fde227bbbd61600c9947fce477759ad82e634bedd70bb7a6de4e6014338708bff06e88ff18d
-
memory/1700-33-0x0000000004980000-0x00000000049C0000-memory.dmpFilesize
256KB
-
memory/1700-24-0x0000000073CC0000-0x00000000743AE000-memory.dmpFilesize
6.9MB
-
memory/1700-23-0x00000000008B0000-0x00000000008D3000-memory.dmpFilesize
140KB
-
memory/1700-42-0x0000000073CC0000-0x00000000743AE000-memory.dmpFilesize
6.9MB
-
memory/1700-36-0x0000000004980000-0x00000000049C0000-memory.dmpFilesize
256KB
-
memory/2148-3-0x0000000003CE0000-0x000000000479A000-memory.dmpFilesize
10.7MB
-
memory/2588-35-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2588-40-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2588-41-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2680-27-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2680-25-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2888-37-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2900-31-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB