Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 15:02
Static task
static1
Behavioral task
behavioral1
Sample
53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe
-
Size
463KB
-
MD5
53834f4c637be12b175a692de825fdd0
-
SHA1
e1e210ec29fb1f5ffb3a0f94b76be29aba748c22
-
SHA256
5f0e22853f1219e48718990a6a278af919fe39f9a3d6f57434dae1fd789c8406
-
SHA512
23eded2adecbf17e64daaca4d36733046f743cdd58c0ae264523e4d546834eefa564a0bb562383bf8e6a5ca6774491abe638e36c4320bdba3a6e5a88ec56b38e
-
SSDEEP
12288:k1W4/3SNJW/Pf2wPB+I9XeC3T7CB4F8E/k8VyLmg/TtZEF:kl/34JGPfnQ+X/TM4DZELTXEF
Malware Config
Signatures
-
Detect XtremeRAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1692-51-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1852-54-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1852-55-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Processes:
resource yara_rule behavioral2/memory/1692-45-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1692-47-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1692-51-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1852-54-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1852-55-0x0000000000C80000-0x0000000000C95000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
53834f4c637be12b175a692de825fdd0_JaffaCakes118.exedescription pid Process procid_target PID 1036 set thread context of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 864 1852 WerFault.exe 92 456 1852 WerFault.exe 92 -
Modifies registry class 3 IoCs
Processes:
53834f4c637be12b175a692de825fdd0_JaffaCakes118.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
53834f4c637be12b175a692de825fdd0_JaffaCakes118.exepid Process 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe53834f4c637be12b175a692de825fdd0_JaffaCakes118.exedescription pid Process procid_target PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1036 wrote to memory of 1692 1036 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 91 PID 1692 wrote to memory of 1852 1692 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 92 PID 1692 wrote to memory of 1852 1692 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 92 PID 1692 wrote to memory of 1852 1692 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 92 PID 1692 wrote to memory of 1852 1692 53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\53834f4c637be12b175a692de825fdd0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\53834f4c637be12b175a692de825fdd0_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 4564⤵
- Program crash
PID:864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 4644⤵
- Program crash
PID:456
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1852 -ip 18521⤵PID:2068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1852 -ip 18521⤵PID:368