Analysis

  • max time kernel
    134s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2024 08:32

General

  • Target

    bc8e1da50706bcb8321e9801e5d0f3b0_JaffaCakes118.exe

  • Size

    256KB

  • MD5

    bc8e1da50706bcb8321e9801e5d0f3b0

  • SHA1

    d4171182fbc73dada2558a2d01a9217078625c5d

  • SHA256

    e41287f8c0fd9459833ad09d8285bb9a44690fdd172fd9a33b933f50ed21dbff

  • SHA512

    c39cf3d9fd0a5cec9b8649812c8edb948df1d39e2d8edb9fab917da3768b68825066da2bfc86d4a83d7f75353e2b0e886fb94003769d5e6a4e1de559c4b17e38

  • SSDEEP

    6144:332DaBByk9s4hw8JQl5WZl4TyQOI5JgpcvqNplcHsY85BT6V:nKMBMSw8JQpT0Iw5pKhMh2

Malware Config

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc8e1da50706bcb8321e9801e5d0f3b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bc8e1da50706bcb8321e9801e5d0f3b0_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\bc8e1da50706bcb8321e9801e5d0f3b0_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\bc8e1da50706bcb8321e9801e5d0f3b0_JaffaCakes118.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1740-22-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/1740-11-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-0-0x0000000000400000-0x00000000004A5000-memory.dmp

    Filesize

    660KB

  • memory/1740-42-0x0000000000400000-0x00000000004A5000-memory.dmp

    Filesize

    660KB

  • memory/1740-38-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/1740-37-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/1740-36-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/1740-35-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/1740-34-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1740-33-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/1740-32-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/1740-31-0x0000000000520000-0x0000000000521000-memory.dmp

    Filesize

    4KB

  • memory/1740-30-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/1740-29-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/1740-28-0x00000000004E0000-0x00000000004E1000-memory.dmp

    Filesize

    4KB

  • memory/1740-21-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/1740-26-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/1740-25-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1740-24-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-23-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/1740-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1740-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1740-27-0x00000000004C0000-0x00000000004C1000-memory.dmp

    Filesize

    4KB

  • memory/1740-20-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/1740-19-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/1740-18-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1740-17-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/1740-15-0x0000000000370000-0x0000000000371000-memory.dmp

    Filesize

    4KB

  • memory/1740-14-0x0000000000240000-0x0000000000250000-memory.dmp

    Filesize

    64KB

  • memory/1740-13-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-12-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-1-0x0000000000390000-0x0000000000394000-memory.dmp

    Filesize

    16KB

  • memory/1740-10-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-9-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-8-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-7-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-6-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/1740-5-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/2556-50-0x0000000000C80000-0x0000000000C92000-memory.dmp

    Filesize

    72KB

  • memory/2556-49-0x0000000000C80000-0x0000000000C92000-memory.dmp

    Filesize

    72KB

  • memory/2556-52-0x0000000000C80000-0x0000000000C92000-memory.dmp

    Filesize

    72KB

  • memory/2584-39-0x0000000000C80000-0x0000000000C92000-memory.dmp

    Filesize

    72KB

  • memory/2584-40-0x0000000000C80000-0x0000000000C92000-memory.dmp

    Filesize

    72KB