Analysis

  • max time kernel
    135s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 20:46

General

  • Target

    3aa8042b959d01f9bad93546c7d8c298_JaffaCakes118.exe

  • Size

    81KB

  • MD5

    3aa8042b959d01f9bad93546c7d8c298

  • SHA1

    76136463338e1f5291818193ea8623b1b4ebbc70

  • SHA256

    8f90fb235e7f992c5731d71ad5d47e5c08448c53f93e97846b1ea146b586babd

  • SHA512

    0132fcae80df171f5813ea3d3902dcaa0f4d38b0419f1abbde4dad45e50e1dae10820fc73c3fca6949791ab5e998ec4d8ac044aa49b9e8cffdb444131506376a

  • SSDEEP

    1536:k90G3jdMXF8kqNYFwrLRIgK++/0KFGlCB4exfJ4c2o3wlQo:uyXCkAY6IgmMK8AB4edScp3wSo

Malware Config

Signatures

  • Detect XtremeRAT payload 5 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3aa8042b959d01f9bad93546c7d8c298_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3aa8042b959d01f9bad93546c7d8c298_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4180
    • C:\Users\Admin\AppData\Local\Temp\3aa8042b959d01f9bad93546c7d8c298_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3aa8042b959d01f9bad93546c7d8c298_JaffaCakes118.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:616
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:2212
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 472
            4⤵
            • Program crash
            PID:1164
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 488
            4⤵
            • Program crash
            PID:5016
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:2108
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 548
          2⤵
          • Program crash
          PID:1376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4180 -ip 4180
        1⤵
          PID:4888
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2212 -ip 2212
          1⤵
            PID:2704
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2212 -ip 2212
            1⤵
              PID:2680

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/616-19-0x0000000010000000-0x000000001004D000-memory.dmp

              Filesize

              308KB

            • memory/616-25-0x0000000010000000-0x000000001004D000-memory.dmp

              Filesize

              308KB

            • memory/616-23-0x0000000010000000-0x000000001004D000-memory.dmp

              Filesize

              308KB

            • memory/616-22-0x0000000010000000-0x000000001004D000-memory.dmp

              Filesize

              308KB

            • memory/616-21-0x0000000010000000-0x000000001004D000-memory.dmp

              Filesize

              308KB

            • memory/2212-27-0x0000000010000000-0x000000001004D000-memory.dmp

              Filesize

              308KB

            • memory/2212-24-0x0000000010000000-0x000000001004D000-memory.dmp

              Filesize

              308KB

            • memory/4180-16-0x0000000002130000-0x0000000002140000-memory.dmp

              Filesize

              64KB

            • memory/4180-0-0x0000000002020000-0x0000000002030000-memory.dmp

              Filesize

              64KB

            • memory/4180-10-0x00000000020C0000-0x00000000020D0000-memory.dmp

              Filesize

              64KB

            • memory/4180-7-0x0000000002090000-0x00000000020A0000-memory.dmp

              Filesize

              64KB

            • memory/4180-15-0x0000000002120000-0x0000000002130000-memory.dmp

              Filesize

              64KB

            • memory/4180-14-0x0000000002110000-0x0000000002120000-memory.dmp

              Filesize

              64KB

            • memory/4180-3-0x0000000002050000-0x0000000002060000-memory.dmp

              Filesize

              64KB

            • memory/4180-2-0x0000000002040000-0x0000000002050000-memory.dmp

              Filesize

              64KB

            • memory/4180-1-0x0000000002030000-0x0000000002040000-memory.dmp

              Filesize

              64KB

            • memory/4180-12-0x00000000020F0000-0x0000000002100000-memory.dmp

              Filesize

              64KB

            • memory/4180-13-0x0000000002100000-0x0000000002110000-memory.dmp

              Filesize

              64KB

            • memory/4180-9-0x00000000020B0000-0x00000000020C0000-memory.dmp

              Filesize

              64KB

            • memory/4180-11-0x00000000020D0000-0x00000000020E0000-memory.dmp

              Filesize

              64KB

            • memory/4180-4-0x0000000002060000-0x0000000002070000-memory.dmp

              Filesize

              64KB

            • memory/4180-5-0x0000000002070000-0x0000000002080000-memory.dmp

              Filesize

              64KB

            • memory/4180-6-0x0000000002080000-0x0000000002090000-memory.dmp

              Filesize

              64KB

            • memory/4180-8-0x00000000020A0000-0x00000000020B0000-memory.dmp

              Filesize

              64KB