Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
02-06-2024 23:06
General
-
Target
8fc013bb379e00fb614142ceaa52fffe_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
8fc013bb379e00fb614142ceaa52fffe
-
SHA1
b4ac24b4e934a4339c2804dce93265ae459a4762
-
SHA256
613496e0190d0df061bb4bb9519721dba25cc0daed1bd5b535f7e9a9bc33d836
-
SHA512
ee79514d095e62046c0ad071e0521e8efa31cc1da095c202b0c74018270bdeefce313c064d08562e16f9417548bf0f22c485ebe9a002ed13414e429984d78e3d
-
SSDEEP
24576:rfEY7K9Flox2jGbgqZFZdoJb5AtatqUDzjveEolEVAOfox:rTAW2MBZWPHRzjvCpOfC
Score
10/10
Malware Config
Signatures
-
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
-
BitRAT payload 6 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fc013bb379e00fb614142ceaa52fffe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8fc013bb379e00fb614142ceaa52fffe_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
4.1MB
-
Filesize
228KB
-
Filesize
4.1MB
-
Filesize
228KB
-
Filesize
4.1MB
-
Filesize
228KB
-
Filesize
4.1MB
-
Filesize
228KB
-
Filesize
4.1MB