Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-04-2024 13:58

General

  • Target

    fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe

  • Size

    2.7MB

  • MD5

    fa730d83b4be4c873039dc585f958d7c

  • SHA1

    95f5cef4663ceb749ca98131734bb001d618458f

  • SHA256

    293440eae97b7c052aeaffd6855b2eda065b0b8fd452a830a9bf3c6637a20f4a

  • SHA512

    2870816e65670af2b1675dc6b3e48ae6e297adc15330c1ce3e0c9ae276136a122a3fe46175c389d93014938a080bb70bc7824f5adc4b831818ee8a707a24589b

  • SSDEEP

    49152:DdbNhMYCLtVRgf3FEyzLrU2OzPaWBA22ynoyHORZ/nXX2WAoF:hPuCf1EyHo20PaP2VoyHGZ/XXyU

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

storage.nsupdate.info:8973

Attributes
  • communication_password

    bf771c9d082071fe80b18bb678220682

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1680
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WoiCgLlRgn.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:952
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WoiCgLlRgn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7559.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1988
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WoiCgLlRgn.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2172
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar857C.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\tmp7559.tmp

    Filesize

    1KB

    MD5

    c6314f01d1795b86711661a76632ec12

    SHA1

    239113579304fa8742651f0fa6af843d9df7bea5

    SHA256

    2c0af3a7c17c04bb37482fb3a0e76b2890f7dbdea4a2d2765029151d2094e88a

    SHA512

    79d529439cb60022c65a7886a432a818b9c2312900c2960bb46a7a606261bddc7b2fc018400092c02178b1fc537082233367bdfa4f41a2171ed485151927939b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q0AVR4C3IBXDHMEGT2M3.temp

    Filesize

    7KB

    MD5

    8a5efbb67168b3693f371ea585dbe6bd

    SHA1

    8ba76df1a05a2c8fcb7af2f52c393d1d15d4bdc5

    SHA256

    4ec31f1a805c026415d0b15e1482c01e0777c108b94e1a6e7b451aa1072033cd

    SHA512

    3dd61e3af898757838e73699ff14922a59e6d77a8a23f0a26c5f0a7bd108e2bd474e2eb4e5f2f55a4e6d59c0879634fd3a08eea9b7a020976b1052f5c3eccca6

  • memory/952-96-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/952-113-0x0000000002510000-0x0000000002550000-memory.dmp

    Filesize

    256KB

  • memory/952-109-0x0000000002510000-0x0000000002550000-memory.dmp

    Filesize

    256KB

  • memory/952-88-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/952-90-0x0000000002510000-0x0000000002550000-memory.dmp

    Filesize

    256KB

  • memory/952-116-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1680-112-0x0000000002440000-0x0000000002480000-memory.dmp

    Filesize

    256KB

  • memory/1680-118-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1680-94-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1680-85-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/1792-93-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-108-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-87-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-92-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1792-84-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-95-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-97-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-128-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-98-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-127-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-99-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-126-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-125-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-123-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-124-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-103-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-104-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-122-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-121-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-89-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-120-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-119-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-114-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-115-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/1792-111-0x0000000000400000-0x00000000007E4000-memory.dmp

    Filesize

    3.9MB

  • memory/2172-107-0x00000000027B0000-0x00000000027F0000-memory.dmp

    Filesize

    256KB

  • memory/2172-117-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2172-100-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2172-101-0x00000000027B0000-0x00000000027F0000-memory.dmp

    Filesize

    256KB

  • memory/2172-105-0x000000006D240000-0x000000006D7EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2656-1-0x0000000074650000-0x0000000074D3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-64-0x0000000004F70000-0x0000000004FB0000-memory.dmp

    Filesize

    256KB

  • memory/2656-63-0x0000000074650000-0x0000000074D3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-62-0x00000000006E0000-0x00000000006FA000-memory.dmp

    Filesize

    104KB

  • memory/2656-102-0x0000000074650000-0x0000000074D3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-65-0x00000000092D0000-0x00000000094C0000-memory.dmp

    Filesize

    1.9MB

  • memory/2656-0-0x0000000000C30000-0x0000000000EE0000-memory.dmp

    Filesize

    2.7MB

  • memory/2656-2-0x0000000004F70000-0x0000000004FB0000-memory.dmp

    Filesize

    256KB

  • memory/2656-66-0x0000000007020000-0x0000000007198000-memory.dmp

    Filesize

    1.5MB