Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/09/2024, 08:16
General
- Target d179fb1a173a8da2155ef32c99daafb6_JaffaCakes118.exe
- Size 3.3MB
- Sample240907-j56fmsthqa
- SHA256 f6bf8be76ab0deedb26fccd13d1f7c6bc1b308497481c663ee771f6860087a0f
Malware Config
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- BitRAT payload 20 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 20 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d179fb1a173a8da2155ef32c99daafb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d179fb1a173a8da2155ef32c99daafb6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1584-37-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-41-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-51-0x000000006E830000-0x000000006E869000-memory.dmp
memory/1584-50-0x000000006E830000-0x000000006E869000-memory.dmp
memory/1584-49-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-48-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-47-0x000000006EB10000-0x000000006EB49000-memory.dmp
memory/1584-46-0x000000006E830000-0x000000006E869000-memory.dmp
memory/1584-44-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-23-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-43-0x000000006E830000-0x000000006E869000-memory.dmp
memory/1584-42-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-27-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-33-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-39-0x000000006E830000-0x000000006E869000-memory.dmp
memory/1584-25-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-38-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-35-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-36-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-19-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-21-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-29-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-34-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-32-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-45-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-30-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/1584-31-0x000000006EB10000-0x000000006EB49000-memory.dmp
memory/4216-12-0x0000000007880000-0x0000000007926000-memory.dmp
memory/4216-15-0x0000000006490000-0x0000000006536000-memory.dmp
memory/4216-1-0x00000000006C0000-0x0000000000A06000-memory.dmp
memory/4216-18-0x0000000006680000-0x0000000006726000-memory.dmp
memory/4216-17-0x00000000065E0000-0x0000000006686000-memory.dmp
memory/4216-16-0x0000000006540000-0x00000000065E6000-memory.dmp
memory/4216-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp
memory/4216-14-0x00000000092D0000-0x0000000009376000-memory.dmp
memory/4216-13-0x0000000008920000-0x00000000089C6000-memory.dmp
memory/4216-11-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/4216-10-0x0000000074B0E000-0x0000000074B0F000-memory.dmp
memory/4216-9-0x00000000074A0000-0x0000000007546000-memory.dmp
memory/4216-8-0x0000000007490000-0x000000000749A000-memory.dmp
memory/4216-7-0x0000000004EF0000-0x0000000004F10000-memory.dmp
memory/4216-6-0x000000000AED0000-0x000000000B474000-memory.dmp
memory/4216-5-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/4216-4-0x000000000A880000-0x000000000A912000-memory.dmp
memory/4216-3-0x0000000002DD0000-0x0000000002DEC000-memory.dmp
memory/4216-2-0x0000000002CA0000-0x0000000002CB0000-memory.dmp