Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
03-05-2024 03:28
General
-
Target
0f9120aa260daa1849a56062f8b6a492_JaffaCakes118.exe
-
Size
488KB
-
MD5
0f9120aa260daa1849a56062f8b6a492
-
SHA1
a56e35f6cc5424936a56827d307253c56a937a0e
-
SHA256
e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215
-
SHA512
ae52b328521f6a550951ac0c53745034f985230dcd850d0881079d1a2f50b865c30e646271dd4230f3d07db34bf6515b434bcf0f085f8e703533ae14180f81dc
-
SSDEEP
12288:RhMM2P6wZMGWIHT0K5DDeOGYJeSyzLIB/xk5:Plk6SF9HT0gGie4B/x
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
2.1.0.0
Office04
193.161.193.99:25334
VNM_MUTEX_3gEHJWUppmmJSCirO4
-
encryption_key
WrqRQZrwZ1NbyFhWiYhM
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 11 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 11 IoCs
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f9120aa260daa1849a56062f8b6a492_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f9120aa260daa1849a56062f8b6a492_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\bnc1mqfg.inf2⤵
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c start C:\Windows\temp\krvcp3e1.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\krvcp3e1.exeC:\Windows\temp\krvcp3e1.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cmstp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
534KB
MD5f9173b96d6fe649de1d4ab61ab76beb4
SHA1403bf6cc3f682b575beb79186cef5b38bc2fe59f
SHA256228ade38d24df70b545682076a142874ad4385528179a90c585d574c1aad2aac
SHA5126060bc2ef5295df71bf78b29bfd7d5576d5299df9553ec5d41852455cbcfa3f9bcb50ad16b13337aff3b68b34387855675948276343d65ae03d5eac4e8470700
-
Filesize
606B
MD5f69043a2ac6ae406d96c1f07cd6377dd
SHA128df1e9b190e110e7ac861935d5dd61dd110fa2d
SHA25611a87db16d1f964c06a18ffd4bc17e6e5f6f72f9c04e7a351f8d6e6eee16d624
SHA5129b54c0061e05464330bc750bb9a84154560a9057edd5a1f99761808249c8ecd69f8e7f28bebae3d415da92b0fcc820d94ecdacd09e9bf7e55a959b8615e7e304
-
Filesize
492KB
-
Filesize
32KB
-
Filesize
284KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
2.1MB
-
Filesize
676KB
-
Filesize
2.5MB
-
Filesize
676KB
-
Filesize
908KB
-
Filesize
676KB
-
Filesize
548KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
5.7MB
-
Filesize
540KB
-
Filesize
676KB
-
Filesize
40KB
-
Filesize
284KB
-
Filesize
676KB
-
Filesize
2.1MB
-
Filesize
144KB
-
Filesize
284KB
-
Filesize
1.1MB
-
Filesize
676KB
-
Filesize
764KB
-
Filesize
5.7MB
-
Filesize
764KB
-
Filesize
80KB
-
Filesize
328KB
-
Filesize
2.5MB
-
Filesize
600KB
-
Filesize
276KB
-
Filesize
564KB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
7.7MB
-
Filesize
684KB
-
Filesize
100KB
-
Filesize
540KB
-
Filesize
548KB
-
Filesize
908KB
-
Filesize
560KB
-
Filesize
408KB
-
Filesize
72KB
-
Filesize
240KB