Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    04/05/2024, 14:42

General

  • Target

    132b58b929bda60a63b4e31e734259db_JaffaCakes118.exe

  • Size

    819KB

  • MD5

    132b58b929bda60a63b4e31e734259db

  • SHA1

    7b5562475375ff2e2b28713a650777e6bdba6952

  • SHA256

    a369d1321703dce354cfcb0f57106a7ec1bcdcafe7f9fe00a63bbbdf38aa105a

  • SHA512

    0e2f32cee15498f81fad6772cf44b7033de00815f619b46a3d3164d50be7a10ea47a934f79a9ad372470adef6013e8222139d6646cb0413bc0ff5021302921bb

  • SSDEEP

    12288:5sO2acTaulCSRO6HFKrnsRlNUuVRptW508YYfO0QfdYB9QjUoSwrnDSlVCZI6FA0:KLTESRQr/uVVkY9TYB9QzZr6wZI6fqAT

Malware Config

Signatures

  • Detect ZGRat V1 5 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\132b58b929bda60a63b4e31e734259db_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\132b58b929bda60a63b4e31e734259db_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YyxkgULjBFG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9434.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2592
    • C:\Users\Admin\AppData\Local\Temp\132b58b929bda60a63b4e31e734259db_JaffaCakes118.exe
      "{path}"
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp9434.tmp

    Filesize

    1KB

    MD5

    e5fc653fd5069b0ce45415de1b2c664e

    SHA1

    4ce39bd42e975d0817ccc37253f6b7bfccc7b611

    SHA256

    de9dfb8e1635d9714e0ea1d5fe686b58969420e09df50ecc8c2a859f821f0fb9

    SHA512

    c924519b150dd702f44cf6dc2f689900d2a0a190f9a4fd795aa77d082640c61f91528eb68bbbde17c3eb12811dfee2817108f6889c7987e58febe958c637fed4

  • memory/2732-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2732-12-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/2732-28-0x0000000000BE0000-0x0000000000BF4000-memory.dmp

    Filesize

    80KB

  • memory/2732-26-0x0000000000270000-0x00000000002B4000-memory.dmp

    Filesize

    272KB

  • memory/2732-19-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/2732-13-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/2732-9-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/2732-15-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/2732-24-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/2732-21-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/2824-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2824-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

    Filesize

    4KB

  • memory/2824-1-0x0000000001270000-0x0000000001344000-memory.dmp

    Filesize

    848KB

  • memory/2824-5-0x0000000005250000-0x00000000052F2000-memory.dmp

    Filesize

    648KB

  • memory/2824-25-0x00000000742C0000-0x00000000749AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2824-4-0x00000000742C0000-0x00000000749AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2824-3-0x0000000000600000-0x0000000000608000-memory.dmp

    Filesize

    32KB