Overview

overview

10

Static

static

3

6962527d9a...18.exe

windows7-x64

10

6962527d9a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 02:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    6962527d9ac313319bd2b87cd12ab32c

  • SHA1

    cd5c57102e56d6af901919edf41dd85d9f012351

  • SHA256

    e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a

  • SHA512

    048f07a350e08d49e70b3a1a1d017c515f700ad0de2415130efe71c455b81cd656ab820104eff6bf39444d9cae1c2220066715ed8efec0e898602e9ea5ab3532

  • SSDEEP

    12288:Z2PCI9ykuSRPFqiVx/kTarr86nHKzCKE7tSlR/h0QRVDNwm:ZM9Pu2Fc6r8y3KcQ7/h0Uu

Score
10/10
xpertratkaffyvirusevasionpersistencerattrojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

kaffyvirus

C2

84.38.134.115:1234

Mutex

B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • XpertRAT Core payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
        "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
          "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
            "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2904
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
              6⤵
              • Adds policy Run key to start application
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2520

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\win.ini
    Filesize

    509B

    MD5

    d2a2412bddba16d60ec63bd9550d933f

    SHA1

    deb3d3bdc9055f0b4909b31d3048446848fae0e1

    SHA256

    79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

    SHA512

    8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

    Download Submit
  • \Users\Admin\AppData\Local\Temp\frm_QANATS.exe
    Filesize

    1.1MB

    MD5

    72b518574405809b54d8e2d3a4283d50

    SHA1

    9429216ebd67da45ac4b9dbc24e5c47a24425e26

    SHA256

    4fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e

    SHA512

    a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff

    Download Submit
  • memory/836-3-0x00000000002D0000-0x00000000003D0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/836-5-0x0000000002A40000-0x0000000002B40000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/836-7-0x0000000077201000-0x0000000077302000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/836-6-0x00000000773F0000-0x00000000774C6000-memory.dmp
    Filesize

    856KB

    Download
  • memory/836-8-0x0000000077200000-0x00000000773A9000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/2116-16-0x0000000077200000-0x00000000773A9000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/2520-44-0x0000000000400000-0x0000000000443000-memory.dmp
    Filesize

    268KB

    Download
  • memory/2904-39-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

    Download
  • memory/2904-51-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

    Download