Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
27/06/2024, 19:49
Behavioral task
behavioral1
Sample
174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe
- Size 76KB
- Sample240627-yjsd8axdpg
- SHA256 6688d063b81d8fb5a984b27c0387ebeabee0f97e404d9efd6540493f0ddbfdf1
- MD5 174e4a7bf7e519789e29bdf3f164c8c3
- SHA1 76ec730896e7d2e9da670339546debe5396fef51
- SHA512 a91421a1bd7320349bae146f83bd49e71ff071bc9a9ed79ac7cdc50c18e964a192cb2cfea41a32a092d91594655295838045c290066d9d4aee10d5f22cb23ff9
- SSDEEP 1536:SyRUhlRZvp8W3PrjHuQyDoEA9sFKaZcKWu/2Z:SyRUj3fYoBmBZcKWueZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect XtremeRAT payload 5 IoCs
resource yara_rule behavioral2/memory/640-6-0x0000000000C80000-0x0000000000C9B000-memory.dmp family_xtremerat behavioral2/files/0x000c0000000233b3-7.dat family_xtremerat behavioral2/memory/3316-8-0x0000000000C80000-0x0000000000C9B000-memory.dmp family_xtremerat behavioral2/memory/384-18-0x0000000000C80000-0x0000000000C9B000-memory.dmp family_xtremerat behavioral2/memory/3316-21-0x0000000000C80000-0x0000000000C9B000-memory.dmp family_xtremerat - Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe - XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
- Adds policy Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe restart" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe restart" svchost.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe - Executes dropped EXE 1 IoCs
pid Process 1304 942CDHACK.EXE -
resource yara_rule behavioral2/files/0x000700000002346c-14.dat upx behavioral2/memory/1304-19-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral2/memory/1304-22-0x0000000000400000-0x0000000000418000-memory.dmp upx - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Cdhack = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Cdhack.exe" 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\Cdhack.exe 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallDir\Cdhack.exe 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InstallDir\ 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE 1304 942CDHACK.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3316 svchost.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 384 wrote to memory of 640 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 91 PID 384 wrote to memory of 640 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 91 PID 384 wrote to memory of 640 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 91 PID 384 wrote to memory of 640 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 91 PID 384 wrote to memory of 3316 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 92 PID 384 wrote to memory of 3316 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 92 PID 384 wrote to memory of 3316 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 92 PID 384 wrote to memory of 3316 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 92 PID 384 wrote to memory of 1304 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 94 PID 384 wrote to memory of 1304 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 94 PID 384 wrote to memory of 1304 384 174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\174e4a7bf7e519789e29bdf3f164c8c3_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
PID:640
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:3316
-
-
C:\Users\Admin\AppData\Local\Temp\942CDHACK.EXE"C:\Users\Admin\AppData\Local\Temp\942CDHACK.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1304
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\942CDHACK.EXE
- Size 29KB
- SHA256 195ab8924d0cd89602731a404acfaa744093c3082ce721c0b21a91d1df19d992
- MD5 45ba52781154bcab999cc459e4454659
- SHA1 5d091d990c5463327145902feed83df9fc311369
- SHA512 11a59bf4732cdb0398262396671233e84baca1579df8b527a69e1a7e8a8868e05485e7a458703adbb54911135f530c79a13e6937452edf26ac2c758eb822fd73
- SSDEEP 768:MzhNkHpiKOkM0VsvYFm5D1uRhjXs2oSIO2h:eNkJtnMkvbISe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\InstallDir\Cdhack.exe
- Size 76KB
- SHA256 6688d063b81d8fb5a984b27c0387ebeabee0f97e404d9efd6540493f0ddbfdf1
- MD5 174e4a7bf7e519789e29bdf3f164c8c3
- SHA1 76ec730896e7d2e9da670339546debe5396fef51
- SHA512 a91421a1bd7320349bae146f83bd49e71ff071bc9a9ed79ac7cdc50c18e964a192cb2cfea41a32a092d91594655295838045c290066d9d4aee10d5f22cb23ff9
- SSDEEP 1536:SyRUhlRZvp8W3PrjHuQyDoEA9sFKaZcKWu/2Z:SyRUj3fYoBmBZcKWueZ
- MD5 SHA1 SHA512 SSDEEP