Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16/06/2024, 00:40
General
-
Target
b0f0683358f3f66718dcdea684a959cc_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
b0f0683358f3f66718dcdea684a959cc
-
SHA1
f59c306fbc3129d09ba4e4ad8321c72a4858209c
-
SHA256
476dd6c64a2e5c0547956069693b4072929a9a264d05e0d7ade0ba784e22377d
-
SHA512
4635a3bb6f88fb9c8ece85e13510ecbc8b0f5e955ce234c23a70833c3a93398c96a8847e06c0913dbff01228b3198850b7f530e90095f0e91e2efc7cd8f6b36b
-
SSDEEP
24576:qQYf/Dlmx2Wm/49ghA0DB1uOXO9Kl6SdOnGGcJvS3KsDcz:n4LUV9kXDBXX2cVdOGG+ucz
Malware Config
Extracted
asyncrat
Strekatun RAT
13f-03018eb703b3
-
delay
0
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/JuGEzR6N
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Async RAT payload 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0f0683358f3f66718dcdea684a959cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0f0683358f3f66718dcdea684a959cc_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Driver" /tr "C:\Users\Admin\AppData\Roaming\Windows Driver\Windows Driver.exe" /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {A45BBF0D-A24B-462C-B248-B708DC905529} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB