Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 22:39
Static task
static1
Behavioral task
behavioral1
Sample
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe
-
Size
971KB
-
MD5
f47c9b8d2c51230830d4575ad4647237
-
SHA1
99b6ce244240ed1996b9e63d072f9379350ba049
-
SHA256
c3b72e467295324862f281885750d3d860c7a6b2bd2af9b1117632750e39b071
-
SHA512
cf88181f05f7d20b6e480c23e47b20df8b4c4ac733aa3c62c46a73cc734bdf7258b43d175d1cd13302aadf4d9a72988fa6bb1d06d279445ddacc770dac3a4370
-
SSDEEP
12288:eaWzgMg7v3qnCiMErQohh0F4CCJ8lny/QCIgKKM4YV/Z2Sr:paHMv6Corjqny/QBR1V/Z2u
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-10-0x00000000000C0000-0x0000000000108000-memory.dmp family_xtremerat behavioral1/memory/2968-13-0x00000000000C0000-0x0000000000108000-memory.dmp family_xtremerat behavioral1/memory/2968-14-0x00000000000C0000-0x0000000000108000-memory.dmp family_xtremerat behavioral1/memory/2968-15-0x00000000000C0000-0x0000000000108000-memory.dmp family_xtremerat behavioral1/memory/2968-17-0x00000000000C0000-0x0000000000108000-memory.dmp family_xtremerat behavioral1/memory/2968-18-0x00000000000C0000-0x0000000000108000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Program Files (x86)\\InstallDir\\AZERT.exe restart" f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\InstallDir\\AZERT.exe" f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\InstallDir\\AZERT.exe" f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exedescription pid process target process PID 1936 set thread context of 2968 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
Processes:
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\InstallDir\AZERT.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe File created C:\Program Files (x86)\InstallDir\AZERT.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exepid process 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exepid process 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exedescription pid process target process PID 1936 wrote to memory of 2968 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe PID 1936 wrote to memory of 2968 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe PID 1936 wrote to memory of 2968 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe PID 1936 wrote to memory of 2968 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe PID 1936 wrote to memory of 2968 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe PID 1936 wrote to memory of 2968 1936 f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f47c9b8d2c51230830d4575ad4647237_JaffaCakes118.exe"2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PE-SCRYPTED.BINFilesize
65KB
MD5380d2eb961261843580bc8e69ce2da30
SHA1b8990484fd428ee98937abdfd572b1bc8ac5296f
SHA256def1b2cd0c4f0859dcd684a7ac1fba32b190006311428812fa953c210d74928a
SHA512b12ab84ea05f0f28946701adb3f0404d02986e7e8d726b9b30b72b7affabefe6c0a21161eb50a70e8d53c5008bb1cd2bd48159c4ac9c266fc8b02ee65740e540
-
memory/2968-6-0x00000000000C0000-0x0000000000108000-memory.dmpFilesize
288KB
-
memory/2968-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2968-10-0x00000000000C0000-0x0000000000108000-memory.dmpFilesize
288KB
-
memory/2968-13-0x00000000000C0000-0x0000000000108000-memory.dmpFilesize
288KB
-
memory/2968-14-0x00000000000C0000-0x0000000000108000-memory.dmpFilesize
288KB
-
memory/2968-15-0x00000000000C0000-0x0000000000108000-memory.dmpFilesize
288KB
-
memory/2968-17-0x00000000000C0000-0x0000000000108000-memory.dmpFilesize
288KB
-
memory/2968-18-0x00000000000C0000-0x0000000000108000-memory.dmpFilesize
288KB