Analysis
-
max time kernel
132s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
13-06-2024 10:06
General
-
Target
a500424ebd54b1e006ccad65266562e3_JaffaCakes118.exe
-
Size
303KB
-
MD5
a500424ebd54b1e006ccad65266562e3
-
SHA1
18be3591da1c3d79aee29026c30c67567e3b2bad
-
SHA256
e4b0894af3fb7948dd92288339cf2fda627c26ec25b4d37c1620f6c005c0c01c
-
SHA512
c197f02534c15b82f81def7d60349fba1e72c0b82d8b11fe64856a7ae7833e9d9d70d723bac8e1809ceda2cc9c76eb87025199230ba08ebc89bde2f6b71931ec
-
SSDEEP
6144:7VPN+C5cB6NYR+perZTyhGupmUfr7MUYbW2KrFrg30RSsBWRzPDzWrkpeF4+:JPN+C5cB6pGTggGHUUrdgEAsotMk
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
2.1.0.0
Office04
myconect.ddns.net:6606
VNM_MUTEX_bW2Pm17MwUNvIYeCrf
-
encryption_key
skMcIyTXgvAaYya6lzLD
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 3 IoCs
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a500424ebd54b1e006ccad65266562e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a500424ebd54b1e006ccad65266562e3_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\fxcwhgku.inf2⤵
-
-
C:\Windows\system32\cmd.execmd /c start C:\Windows\temp\npdhb1di.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\npdhb1di.exeC:\Windows\temp\npdhb1di.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
534KB
MD5e4dc9cb250120aebeee969906d1a7a22
SHA1c0f9d3a2531cc25e212d9adbf8614903d8a6247e
SHA25614de179b37e9958b3a1d22f22b0bb545be1cb166aeaf5a4892ccd616ee7e544f
SHA51221461e4fdc16ba99ae24a1f2fa39465678e851591d7402c762a04bf286b9ec8230a0acd147f0c9d54fb6a3428be1851c4d75f46b6cf917a44b3b399e8897667b
-
Filesize
606B
MD5557daa0f3e391f04373cb08cc606045d
SHA1b762524e07d6f250fac3f507460fd3d0c2744472
SHA256847cf58b7c96f9396242f5e32af6508ed38079a0ec74eecb43a7bf0679a72a22
SHA512d2fce405d4e3bc6bd4d0a75a4a7b4e760ed88257e22800aadcdc1636e551669b57d1a07c954a2634909cdb50557af90420d1766291c84dd881850e5a2bc66ce9
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
560KB
-
Filesize
5.6MB
-
Filesize
10.8MB
-
Filesize
328KB
-
Filesize
8KB
-
Filesize
568KB
-
Filesize
10.8MB
-
Filesize
10.8MB