Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
06/07/2024, 10:59
General
- Target 284e9f7c94febdcc6960fbb1a6e428d3_JaffaCakes118.exe
- Size 332KB
- Sample240706-m3plwszbrd
- SHA256 586c7de36f595b57dd89b3cf808b2a05d62448995b83ca2803ce37ef94f36c9c
Malware Config
Signatures
- Detect XtremeRAT payload 5 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 1 IoCs
- XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\284e9f7c94febdcc6960fbb1a6e428d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\284e9f7c94febdcc6960fbb1a6e428d3_JaffaCakes118.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\284e9f7c94febdcc6960fbb1a6e428d3_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\284e9f7c94febdcc6960fbb1a6e428d3_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 4844⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 4924⤵
- Program crash
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1808 -ip 18081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1808 -ip 18081⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
memory/1380-4-0x0000000010000000-0x000000001004B000-memory.dmp
memory/1380-6-0x0000000010000000-0x000000001004B000-memory.dmp
memory/1380-7-0x0000000010000000-0x000000001004B000-memory.dmp
memory/1380-8-0x0000000010000000-0x000000001004B000-memory.dmp
memory/1380-10-0x0000000010000000-0x000000001004B000-memory.dmp
memory/1688-0-0x0000000000400000-0x00000000004BB000-memory.dmp
memory/1688-1-0x00000000001C0000-0x00000000001C3000-memory.dmp
memory/1688-12-0x0000000000400000-0x00000000004BB000-memory.dmp
memory/1688-13-0x00000000001C0000-0x00000000001C3000-memory.dmp
memory/1808-9-0x0000000010000000-0x000000001004B000-memory.dmp
memory/1808-11-0x0000000010000000-0x000000001004B000-memory.dmp