Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 03:10
Behavioral task
behavioral1
Sample
043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe
-
Size
45KB
-
MD5
043f13448fd09a6280b0583c5a9df36c
-
SHA1
8edce3d25bd93882673410bb57f0fefb782d1021
-
SHA256
ef982d3d8cf7b1ab0c10a6ded5b5eefe3935abfdc5118761f1412b01bace7aad
-
SHA512
5d79edaf71702cefaed1f7718d79ea58e3c35c8abb1322c5ee08b761ef92da7077f9271372248a19b18945c479a22b6bc20ad7d69514a7936338325450178dd0
-
SSDEEP
768:PBr+tjFY90iY6W1jwmDzKgEFQXaklMIAn0tYCpPZzoKQ:ZyRh31jxPEFQXak+05poKQ
Malware Config
Signatures
-
Detect XtremeRAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2148-5-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/1948-6-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral1/memory/2148-8-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C4O8O7U-AS43-WHBO-370S-1VL8U6U75RBW} 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3C4O8O7U-AS43-WHBO-370S-1VL8U6U75RBW}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
Processes:
043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\InstallDir\Server.exe 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe File created C:\Windows\InstallDir\Server.exe 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 2148 explorer.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exedescription pid process target process PID 1948 wrote to memory of 1844 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 1844 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 1844 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 1844 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 1248 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 1248 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 1248 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 1248 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 2564 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 2564 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 2564 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 2564 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 3008 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 3008 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 3008 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 3008 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 2476 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 2476 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 2476 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 2476 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe iexplore.exe PID 1948 wrote to memory of 2148 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 2148 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 2148 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 2148 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe PID 1948 wrote to memory of 2148 1948 043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\043f13448fd09a6280b0583c5a9df36c_JaffaCakes118.exe"1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1948-6-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2148-3-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2148-5-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2148-8-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB