Analysis

  • max time kernel
    136s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13-05-2024 07:26

General

  • Target

    3e5b3579e97745512e8766b9c89aba66_JaffaCakes118.exe

  • Size

    503KB

  • MD5

    3e5b3579e97745512e8766b9c89aba66

  • SHA1

    43a67810e5278a542f6a4d8eb86040b64e34fb35

  • SHA256

    90e165246c0518ce77a98adbe2cd589bdc75d162f23fde3e7f837882b8facd2f

  • SHA512

    d967309ba2e26e71c692850c04aae9a90880614848c021e332d06d4de123c02cf07768b42503d065cde9187e3d56b1637d16b775f2c755a7b1ae01632000dc6c

  • SSDEEP

    12288:mY9OgcjseeEyx6a7AX8EmUfsgHYYKDWHe3odvByqTX:mgcjsfH6aamUfUfWDvcA

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

svhost

C2

myconect.ddns.net:6606

Mutex

VNM_MUTEX_ND6PULLW5ZVLwo1nwR

Attributes
  • encryption_key

    yaa63tXY4j55os5llHHd

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 3 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e5b3579e97745512e8766b9c89aba66_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3e5b3579e97745512e8766b9c89aba66_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Roaming\$77-Venom.exe
      "C:\Users\Admin\AppData\Roaming\$77-Venom.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1860
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\null (2).docx"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      b0a247b937479ac015dafce09dff6f8b

      SHA1

      64577a9f74a2fbbdc92fb69f9426ad03eb7b7aac

      SHA256

      fa3ef035121400402ca9eb30170e82160a5dad23ae6643c3785af4becfb563ce

      SHA512

      e831fbc2427dc26ad501a821ce5ccfb104ddc1dbf5dff42a80e21b1af6bb0ebf0594a4fa766068b42cb5ab035bac3b95a55e9709e1721ff4c4eefd190e4271be

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Roaming\null (2).docx

      Filesize

      2KB

      MD5

      b73ace90e3fbada0e8baa0d47b2cbd6f

      SHA1

      2147bfa5d92cb0c3fd296e7c90befa08564240a6

      SHA256

      94f271283b679ee024724d1aee0f4ead90ce56fb67813b5e0cbc082091fbe364

      SHA512

      d1a9d73fca25a73782bd0170937225afdb402a354a7fb6ea308114e276aed7f77ef211c458dd03292d2e90cd1d61976340396540ac410d452bda363f6d2ee157

    • \Users\Admin\AppData\Roaming\$77-Venom.exe

      Filesize

      534KB

      MD5

      84c1dc6b428904cc2a6746653849df0f

      SHA1

      5cce4078427481f4d7456b5a4f3930ae6e706fb4

      SHA256

      bc24e3c5408fea0b6f9aa0deb56a4636a8d0b9a6054ff1033efa6ccfe04ba44a

      SHA512

      3b7a7607c3409b5ded563f2e1fcc0fa489c4465ab764d14a647b474968a025a95fa8ceb549fc70482b7b1dd935f66a41ada7b4910059786aafc870c5847a9245

    • memory/1380-17-0x000000006C58D000-0x000000006C598000-memory.dmp

      Filesize

      44KB

    • memory/1380-67-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1380-47-0x000000006C58D000-0x000000006C598000-memory.dmp

      Filesize

      44KB

    • memory/1380-14-0x000000002FD41000-0x000000002FD42000-memory.dmp

      Filesize

      4KB

    • memory/1380-16-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1860-11-0x0000000071F6E000-0x0000000071F6F000-memory.dmp

      Filesize

      4KB

    • memory/1860-15-0x00000000048C0000-0x0000000004900000-memory.dmp

      Filesize

      256KB

    • memory/1860-12-0x0000000000110000-0x000000000019C000-memory.dmp

      Filesize

      560KB

    • memory/1860-45-0x0000000071F6E000-0x0000000071F6F000-memory.dmp

      Filesize

      4KB

    • memory/1860-46-0x00000000048C0000-0x0000000004900000-memory.dmp

      Filesize

      256KB

    • memory/2944-13-0x0000000074040000-0x00000000745EB000-memory.dmp

      Filesize

      5.7MB

    • memory/2944-0-0x0000000074041000-0x0000000074042000-memory.dmp

      Filesize

      4KB

    • memory/2944-2-0x0000000074040000-0x00000000745EB000-memory.dmp

      Filesize

      5.7MB

    • memory/2944-1-0x0000000074040000-0x00000000745EB000-memory.dmp

      Filesize

      5.7MB