Overview

overview

10

Static

static

3

6962527d9a...18.exe

windows7-x64

10

6962527d9a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 02:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    6962527d9ac313319bd2b87cd12ab32c

  • SHA1

    cd5c57102e56d6af901919edf41dd85d9f012351

  • SHA256

    e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a

  • SHA512

    048f07a350e08d49e70b3a1a1d017c515f700ad0de2415130efe71c455b81cd656ab820104eff6bf39444d9cae1c2220066715ed8efec0e898602e9ea5ab3532

  • SSDEEP

    12288:Z2PCI9ykuSRPFqiVx/kTarr86nHKzCKE7tSlR/h0QRVDNwm:ZM9Pu2Fc6r8y3KcQ7/h0Uu

Score
10/10
xpertratkaffyvirusevasionpersistencerattrojan

Malware Config

Extracted

Family

xpertrat

Version

3.0.10

Botnet

kaffyvirus

C2

84.38.134.115:1234

Mutex

B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • XpertRAT Core payload 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6962527d9ac313319bd2b87cd12ab32c_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
        "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
          "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3712
          • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
            "C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"
            5⤵
            • UAC bypass
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:928
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
              6⤵
              • Adds policy Run key to start application
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:5044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe
    Filesize

    1.1MB

    MD5

    72b518574405809b54d8e2d3a4283d50

    SHA1

    9429216ebd67da45ac4b9dbc24e5c47a24425e26

    SHA256

    4fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e

    SHA512

    a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff

    Download Submit
  • C:\Windows\win.ini
    Filesize

    123B

    MD5

    6bf517432f65eb7f0d18d574bf14124c

    SHA1

    5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

    SHA256

    6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

    SHA512

    7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

    Download Submit
  • memory/928-37-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

    Download
  • memory/928-39-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

    Download
  • memory/928-49-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

    Download
  • memory/4280-14-0x0000000000560000-0x0000000000660000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/4280-15-0x0000000002D20000-0x0000000002E20000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/4432-3-0x0000000000700000-0x0000000000800000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/4432-5-0x0000000002D40000-0x0000000002E40000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/4432-6-0x0000000077A61000-0x0000000077B81000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/4432-51-0x0000000077A61000-0x0000000077B81000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/5044-42-0x0000000000400000-0x0000000000443000-memory.dmp
    Filesize

    268KB

    Download