zgrat | 07e29f000ed708f299bf6c7e034bbc35ffd21662632930aadf4f3d3a4c1aee18

General

Target

1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe
Size

575KB
MD5

1a5c0296fc617d1f5d8f2fc5e07054ea
SHA1

6f925105ec99a59f21a6ff1ae43c378ba5db1299
SHA256

07e29f000ed708f299bf6c7e034bbc35ffd21662632930aadf4f3d3a4c1aee18
SHA512

6691163ecb6c12f258a3436288d727f001debb9ff32dd5a07ca6d6f3cc8cca95918bb5d4fccee132822ac400eaa210e3a9ee1cd84c595cdadc6a8953600b54a6
SSDEEP

12288:070cYEJSPyIKrIxap3RkL/Y+oHjc1Qb8m07JZpVUDk3P7Krxgw2xRrHP:070cY7PyIgpp3R+/jEgGB0F3VUDgPV

Score

10^/10

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2740-7-0x00000000004A0000-0x00000000004B4000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2740 set thread context of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2660	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe
2660	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2660	2740	1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1a5c0296fc617d1f5d8f2fc5e07054ea_JaffaCakes118.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\rr

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\Documents\rr

Filesize
92KB

MD5
c38ea50a9d1b652272fdae5db82c9404

SHA1
d7444179c921d090b4e5d954997087bc0004e69f

SHA256
b5e3708f123a02f980e4e8397a055b98dceecdc754bbb67872e8bf3651541742

SHA512
b91d23e89ca310a4cc9bbfc9537880e1b0c09d0ebf28fa1514258110f3fe33493f24145430093c9d1eb6ddcac8ef25ed74eb0d0c2c8c0544c1cfe2dcf206e2f5

Download Submit
memory/2660-13-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-75-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-10-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-12-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-17-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-9-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-15-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-21-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-24-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2660-23-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2740-7-0x00000000004A0000-0x00000000004B4000-memory.dmp

Filesize
80KB

Download
memory/2740-3-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2740-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/2740-6-0x0000000001F40000-0x0000000001FB6000-memory.dmp

Filesize
472KB

Download
memory/2740-5-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2740-26-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2740-2-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2740-1-0x00000000002F0000-0x0000000000384000-memory.dmp

Filesize
592KB

Download
memory/2740-4-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing