General

  • Target

    6b1bd2bb379d1a4e929ba32100b6acd3_JaffaCakes118

  • Size

    174KB

  • Sample

    240523-qwkadadb97

  • MD5

    6b1bd2bb379d1a4e929ba32100b6acd3

  • SHA1

    7e575b77c856c49495f3cf3d3dc6b3340facb99b

  • SHA256

    8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78

  • SHA512

    8e8d033bb29dbc9b36278285a4e8655e54add7a51570b3e132cb1e0992e3753eb353eb6787cc9fcb56e2f4e79f382050063eea0cf949d9a9151c9c5eed2f8cd8

  • SSDEEP

    3072:YPGsB7XNuFhSJ1RwrzDJoqpJlKhAeQfpIYEDapZ2Ti87w3b+46UB:YPPNzTUzDJ/jqQxIhmr2TiBT

Malware Config

Targets

    • Target

      6b1bd2bb379d1a4e929ba32100b6acd3_JaffaCakes118

    • Size

      174KB

    • MD5

      6b1bd2bb379d1a4e929ba32100b6acd3

    • SHA1

      7e575b77c856c49495f3cf3d3dc6b3340facb99b

    • SHA256

      8d44a736975543b4f5c40296fb1c1a2e42700861d95704fd224d42d73d475d78

    • SHA512

      8e8d033bb29dbc9b36278285a4e8655e54add7a51570b3e132cb1e0992e3753eb353eb6787cc9fcb56e2f4e79f382050063eea0cf949d9a9151c9c5eed2f8cd8

    • SSDEEP

      3072:YPGsB7XNuFhSJ1RwrzDJoqpJlKhAeQfpIYEDapZ2Ti87w3b+46UB:YPPNzTUzDJ/jqQxIhmr2TiBT

    • BitRAT

      BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    • BitRAT payload

    • Modifies WinLogon for persistence

    • Modifies Windows Defender Real-time Protection settings

    • Turns off Windows Defender SpyNet reporting

    • Windows security bypass

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Windows security modification

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks