Analysis
- max time kernel
133s - max time network
152s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
08/05/2024, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
General
- Target 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe
- Size 325KB
- Sample240508-sr4vbsah2x
- SHA256 0f4e7faf833c30ed300efa46b4b1d083523d48ec2864f110d2a2d5b47eb67a72
- MD5 2578debd234465c8aa7bcdf53bc3858a
- SHA1 aaec53a7560318b698cec4f1388f26b1c12f9c40
- SHA512 849947365c47ab82f54d7e7b6a5105e28bf684cff0ad3f313541722dcc2b0ae9bbdeb794b771a32a07fd6b1f071f2b99e7c8464167aff036a622fc969ce4fcdf
- SSDEEP 6144:KiMD5bWl4fAAH3gyLBVpRQ7Wm5qRnu1goA:hl4bHQydlQamL/A
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xpertrat
Version
-
3.0.10
Botnet
-
Group
C2
-
46.183.220.104:10101
Mutex
-
K8P3I007-I4G2-R2U0-V0G8-T1Q3K5W771L5
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" svhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" tmp.exe - XpertRAT Core payload 1 IoCs
resource yara_rule behavioral1/memory/2384-44-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe - Executes dropped EXE 2 IoCs
pid Process 2568 tmp.exe 2936 svhost.exe - Loads dropped DLL 5 IoCs
pid Process 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 2568 tmp.exe 2568 tmp.exe 2568 tmp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" svhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" tmp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svhost.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2264 set thread context of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2936 set thread context of 2384 2936 svhost.exe 35 PID 2568 set thread context of 2496 2568 tmp.exe 34 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
pid Process 2504 timeout.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 2568 tmp.exe 2568 tmp.exe 2936 svhost.exe 2936 svhost.exe 2568 tmp.exe 2568 tmp.exe 2936 svhost.exe 2936 svhost.exe 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe Token: 33 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe Token: SeDebugPrivilege 2384 iexplore.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2936 svhost.exe 2568 tmp.exe 2384 iexplore.exe - Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2692 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 28 PID 2264 wrote to memory of 2692 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 28 PID 2264 wrote to memory of 2692 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 28 PID 2264 wrote to memory of 2692 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 28 PID 2692 wrote to memory of 2564 2692 cmd.exe 30 PID 2692 wrote to memory of 2564 2692 cmd.exe 30 PID 2692 wrote to memory of 2564 2692 cmd.exe 30 PID 2692 wrote to memory of 2564 2692 cmd.exe 30 PID 2264 wrote to memory of 2568 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 31 PID 2264 wrote to memory of 2568 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 31 PID 2264 wrote to memory of 2568 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 31 PID 2264 wrote to memory of 2568 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 31 PID 2264 wrote to memory of 2568 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 31 PID 2264 wrote to memory of 2568 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 31 PID 2264 wrote to memory of 2568 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 31 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 2936 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 32 PID 2264 wrote to memory of 1724 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 33 PID 2264 wrote to memory of 1724 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 33 PID 2264 wrote to memory of 1724 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 33 PID 2264 wrote to memory of 1724 2264 2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe 33 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2936 wrote to memory of 2384 2936 svhost.exe 35 PID 2568 wrote to memory of 2496 2568 tmp.exe 34 PID 1724 wrote to memory of 2504 1724 cmd.exe 37 PID 1724 wrote to memory of 2504 1724 cmd.exe 37 PID 1724 wrote to memory of 2504 1724 cmd.exe 37 PID 1724 wrote to memory of 2504 1724 cmd.exe 37 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2578debd234465c8aa7bcdf53bc3858a_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk" /f3⤵PID:2564
-
-
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2568 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Roaming\tmp.exe3⤵PID:2496
-
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2936 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\svhost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2384
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\FolderN\name.exe.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
PID:2504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
- Size 1.6MB
- SHA256 9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
- MD5 32827e69b293b99013bbbe37d029245d
- SHA1 bc9f80a38f09354d71467a05b0c5a82c3f7dac53
- SHA512 58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
- SSDEEP 24576:pCvgYAS7wMZneVQj+KCHw5D0YG0J6R4PJEysQ1QAvyb+yEYM3sZWe2:pjYsaqQKKCbt0J6R9QS6yEYMIW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\FolderN\name.exe
- Size 325KB
- SHA256 0f4e7faf833c30ed300efa46b4b1d083523d48ec2864f110d2a2d5b47eb67a72
- MD5 2578debd234465c8aa7bcdf53bc3858a
- SHA1 aaec53a7560318b698cec4f1388f26b1c12f9c40
- SHA512 849947365c47ab82f54d7e7b6a5105e28bf684cff0ad3f313541722dcc2b0ae9bbdeb794b771a32a07fd6b1f071f2b99e7c8464167aff036a622fc969ce4fcdf
- SSDEEP 6144:KiMD5bWl4fAAH3gyLBVpRQ7Wm5qRnu1goA:hl4bHQydlQamL/A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\FolderN\name.exe.bat
- Size 189B
- SHA256 413b4ee68f5400fcd30ae5df957d723989b400637dbc7f5d158fa050bdc20743
- MD5 dca86f6bec779bba1b58d992319e88db
- SHA1 844e656d3603d15ae56f36298f8031ad52935829
- SHA512 4b9d532a777921543b3243020ea4b655a8b956c400b237ce714b5bd8e9a3ad7fdbcb11410e84e2e0ecc45e87dcd107385a487f5bb5b359aabd1322314ef2d24c
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\svhost.exe
- Size 448KB
- SHA256 a221e9aa2edf42cbd95a7d1aefa30e0d73d2c7ba0cff93c3b53db9e364334fef
- MD5 dea4be0cd6e1e8e3c7b5ac7c0bd90a57
- SHA1 07f8fbaaa4c65c3e9327aeb8afba76895e269507
- SHA512 a963cc3056d9fdce74ffabcfa7cc32d62c49700a25167f80468919da4d80806c4ceec82d77be04b8bc9362c43bb25d2a0437708bb1159b7efed48fa0ff749f5f
- SSDEEP 12288:pClZgYAm/Rp77UM/oUv/B6ZN4EbZKjdJ+5:pCvgYAS7wMZneVQj2
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Roaming\tmp.exe
- Size 172KB
- SHA256 4c4b3ad8895c8ea779e3e359b8f3610f061d4d865170e32b7af648ff0268e2b8
- MD5 d5ac3689652f1d3566ec15d8ba4f088a
- SHA1 aedd8e90ec29f1a0259eb31fab519a398cb4f205
- SHA512 6b989ca5018c9ff845461e150ac23b92ae71ef1d268d8975e52a3293f15eefadde6f3b73670c902f4d146e80db0f799b08fedd87c786ab7af366f4b54e35ba70
- SSDEEP 3072:YNWDBU5B+ExRjcL1R4g1qDmJMyYZzlh7jACSey+GDhwyhYcF/ikDNThkNK:YIBw30nqaJMJh7RSh3FPYcFJFhkY
- MD5 SHA1 SHA512 SSDEEP