Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
11-05-2024 09:03
General
-
Target
33ce258b07afea582cc317a398b8770c_JaffaCakes118.exe
-
Size
488KB
-
MD5
33ce258b07afea582cc317a398b8770c
-
SHA1
9a81235b698e5477847280626b729f5347ed2585
-
SHA256
39f9d2856a3b52e03ecb1c72605afcd0fce0bf5bacc047a0d7d07e8e9edc2065
-
SHA512
4fbd58e79881313b8c29ccafd9ef7c479e9bbc427869a44981bc4077bd81ed1532c5bcb679e8973470833e18dc5c81a54c69d958030f31f053e92f35a6d2ad66
-
SSDEEP
12288:ayJgDWpL20Rr3oPm1PC8CcxZsfi8H8fxQpwW2R7NoBE:aAgDWWm1HCX9cz1dNoS
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Signatures
-
Contains code to disable Windows Defender 10 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 10 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33ce258b07afea582cc317a398b8770c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33ce258b07afea582cc317a398b8770c_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\k4bwqwn4.inf2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
606B
MD55be15073f32f85ae9153f0ca665c1753
SHA1637f6f58ec16ebd41c9961d8cede765f9f689ecd
SHA256dbdef92c142210d3e247611cfdbd6d777638f0e83358a9f5cdc43dc2c4845d0c
SHA5128a727fdb77d092ae49f96293afadfcca5dfdf5cdd6dc87e380bf4e5434d01919880757b2c6060ed611ac5e6a24be4971be3a6d2892478bb16cb466a3b340aea6
-
Filesize
676KB
-
Filesize
76KB
-
Filesize
676KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
676KB
-
Filesize
688KB
-
Filesize
36KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
540KB
-
Filesize
676KB
-
Filesize
1.4MB
-
Filesize
676KB
-
Filesize
572KB
-
Filesize
512KB
-
Filesize
296KB
-
Filesize
348KB
-
Filesize
284KB
-
Filesize
12.3MB
-
Filesize
92KB
-
Filesize
676KB
-
Filesize
296KB
-
Filesize
36KB
-
Filesize
500KB
-
Filesize
12.3MB
-
Filesize
688KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
1.4MB
-
Filesize
348KB
-
Filesize
540KB
-
Filesize
92KB
-
Filesize
676KB
-
Filesize
572KB
-
Filesize
512KB
-
Filesize
12KB
-
Filesize
980KB
-
Filesize
6.9MB