Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 20:24

General

  • Target

    3beb1fd8946ef3d9378bf3d42476a631_JaffaCakes118.exe

  • Size

    532KB

  • MD5

    3beb1fd8946ef3d9378bf3d42476a631

  • SHA1

    7d48f3a14cf23c74db900cafd84ee1e7fd7cfe46

  • SHA256

    e9a8bf4f31da146761af10a16f17c402c2de1bfbafe5f770b1ffadbe373a2aa4

  • SHA512

    e9f755cfca4ca269d4e426cd1ce451072d839b37f4d3daec2661f8ffb1ae726056692ef531fb622b3a0f6d6331799e9058a406bcba0ec8e598738d3bd500c2b8

  • SSDEEP

    6144:QAL4KvK5CcGQkPcWVEBomeiUhNDbD4YQZ/ia02Sdj/4KngWIq6jRkyi:ZLpvpQkZVhhRbhgia02SKKngWIjn

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Executes dropped EXE 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3beb1fd8946ef3d9378bf3d42476a631_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3beb1fd8946ef3d9378bf3d42476a631_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\3beb1fd8946ef3d9378bf3d42476a631_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
      2⤵
        PID:1524
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
        2⤵
          PID:2556
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe
          "C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2700
          • C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe
            "C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe"
            3⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • outlook_office_path
            • outlook_win_path
            PID:2884

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Adobe_ReaderX.exe

        Filesize

        532KB

        MD5

        3beb1fd8946ef3d9378bf3d42476a631

        SHA1

        7d48f3a14cf23c74db900cafd84ee1e7fd7cfe46

        SHA256

        e9a8bf4f31da146761af10a16f17c402c2de1bfbafe5f770b1ffadbe373a2aa4

        SHA512

        e9f755cfca4ca269d4e426cd1ce451072d839b37f4d3daec2661f8ffb1ae726056692ef531fb622b3a0f6d6331799e9058a406bcba0ec8e598738d3bd500c2b8

      • memory/1196-0-0x00000000740FE000-0x00000000740FF000-memory.dmp

        Filesize

        4KB

      • memory/1196-1-0x0000000000FC0000-0x000000000104C000-memory.dmp

        Filesize

        560KB

      • memory/1196-2-0x00000000740F0000-0x00000000747DE000-memory.dmp

        Filesize

        6.9MB

      • memory/1196-3-0x0000000000430000-0x0000000000450000-memory.dmp

        Filesize

        128KB

      • memory/1196-4-0x00000000740FE000-0x00000000740FF000-memory.dmp

        Filesize

        4KB

      • memory/1196-7-0x00000000740F0000-0x00000000747DE000-memory.dmp

        Filesize

        6.9MB

      • memory/2700-10-0x0000000000200000-0x000000000028C000-memory.dmp

        Filesize

        560KB

      • memory/2884-19-0x0000000000080000-0x00000000000BA000-memory.dmp

        Filesize

        232KB

      • memory/2884-16-0x0000000000080000-0x00000000000BA000-memory.dmp

        Filesize

        232KB

      • memory/2884-12-0x0000000000080000-0x00000000000BA000-memory.dmp

        Filesize

        232KB

      • memory/2884-20-0x00000000002F0000-0x00000000002FA000-memory.dmp

        Filesize

        40KB