Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
24/06/2024, 12:13
General
- Target 086fda1b171970f1f124ab08350345be_JaffaCakes118.exe
- Size 597KB
- Sample240624-pd2aha1fkh
- SHA256 2d334e107d57c1429df36d8d195c0c3e84361e4176ab8e2f51f5238df31c0dfd
Malware Config
Signatures
- Detect XtremeRAT payload 2 IoCs
- XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\086fda1b171970f1f124ab08350345be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\086fda1b171970f1f124ab08350345be_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\086fda1b171970f1f124ab08350345be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\086fda1b171970f1f124ab08350345be_JaffaCakes118.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-18-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-17-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-15-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-39-0x00000000022C0000-0x00000000022C1000-memory.dmp
memory/372-11-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-48-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-47-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-46-0x0000000002220000-0x0000000002221000-memory.dmp
memory/372-45-0x0000000002260000-0x0000000002261000-memory.dmp
memory/372-44-0x0000000002300000-0x0000000002301000-memory.dmp
memory/372-43-0x0000000000740000-0x0000000000741000-memory.dmp
memory/372-42-0x0000000000730000-0x0000000000731000-memory.dmp
memory/372-41-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/372-38-0x00000000021F0000-0x0000000002200000-memory.dmp
memory/372-37-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-36-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-35-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-34-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-33-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-32-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-31-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-30-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-29-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-28-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-27-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-26-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-25-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-24-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-23-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-22-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-21-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-20-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-12-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-16-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-0-0x0000000000400000-0x00000000005AF000-memory.dmp
memory/372-14-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-13-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-10-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-8-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-7-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-6-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-4-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-3-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-2-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/372-1-0x00000000022E0000-0x00000000022E4000-memory.dmp
memory/372-9-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-5-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/372-61-0x0000000002D80000-0x0000000002D81000-memory.dmp
memory/372-60-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/372-59-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/372-58-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/372-57-0x0000000002C30000-0x0000000002C31000-memory.dmp
memory/372-65-0x0000000000400000-0x00000000005AF000-memory.dmp
memory/372-56-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/372-55-0x0000000002C10000-0x0000000002C11000-memory.dmp
memory/372-54-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/372-53-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/372-52-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/372-51-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/372-49-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/372-62-0x0000000002D70000-0x0000000002D71000-memory.dmp
memory/372-50-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/2232-64-0x0000000013140000-0x000000001315C000-memory.dmp
memory/2232-63-0x0000000013140000-0x000000001315C000-memory.dmp
memory/2232-66-0x0000000000400000-0x00000000005AF000-memory.dmp