Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2024 13:29

General

  • Target

    bd9b6f7cfa3c3fb00907de25d57946fa_JaffaCakes118.exe

  • Size

    78KB

  • MD5

    bd9b6f7cfa3c3fb00907de25d57946fa

  • SHA1

    127056647ba8ccbc6f8b56abe1670fdcc9df950c

  • SHA256

    d94a0011b59f79b57f2aea31225aee805990c5d7b121edfc8a1fd622bef7968d

  • SHA512

    a3732930b39a0e275aecf70d05cd49d6e3b82984e1f2174f3b36ca6c8c863dac7704feed4c27c6b24f728d168d375cfac53ec50a347929ec0c61eef585efa895

  • SSDEEP

    1536:czWV5jNXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96159/S1Nf:yWV5j9SyRxvY3md+dWWZyG59/2

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd9b6f7cfa3c3fb00907de25d57946fa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd9b6f7cfa3c3fb00907de25d57946fa_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0qanucjt.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D88.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc333416CD202F488F9C63D7815EEB6577.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:512
    • C:\Users\Admin\AppData\Local\Temp\tmp9BE2.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp9BE2.tmp.exe" C:\Users\Admin\AppData\Local\Temp\bd9b6f7cfa3c3fb00907de25d57946fa_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0qanucjt.0.vb

    Filesize

    14KB

    MD5

    642a937394513a178520a16f47b3ec07

    SHA1

    b8aa7f3f1b2fb99432e3ea4d4ba4ce370814419d

    SHA256

    0fc2cb7be33a65161691756a3ff02dc17a1568bd4fe4bf4c0adc25455e8de801

    SHA512

    2434bdd54c8224270bb0b52394779f3c45c843d93d022316a455077a4de5c2fcc75af1bb280b1cd43d9defc6bbdbcf18415c15bdce21070c153804ab8eb1e2f9

  • C:\Users\Admin\AppData\Local\Temp\0qanucjt.cmdline

    Filesize

    266B

    MD5

    45f2178ef3fb49396445b86a8e81a66c

    SHA1

    0b2764888ab8ff276152704ddfb7701442ecd3df

    SHA256

    31935bd92a3b7765966ca92d09f555d9486f604ea3aa0a773ad4fd2c6960f9c9

    SHA512

    848450224aee073b01558b6c755379b9f36c8a1d61ef59b42338a9a43b232bc41dd107c9fc841e0349f3988fe63c9b3c3d8e98b51d2bf76a679ac91e4184d285

  • C:\Users\Admin\AppData\Local\Temp\RES9D88.tmp

    Filesize

    1KB

    MD5

    96dee95e688c9576df31176848e7530d

    SHA1

    ca7700ddca04c4f48697921895f7c4eb3ca30a32

    SHA256

    8c62e50c306bb4116b945d309f4474e424c67706e93ba9d630d923fd1117de2d

    SHA512

    3fc3e5e3f27a835346d88a62da2a913a3bdbebcf3da87ab7fc1c1817fcd6eae06ec0ff3ae3b50d4ac53137921469dcb2f792a11bcd55dd0df5022c5e260e4f93

  • C:\Users\Admin\AppData\Local\Temp\tmp9BE2.tmp.exe

    Filesize

    78KB

    MD5

    7c13511dd9c40973c2128c72e55e2f7a

    SHA1

    7a45d5664dbe7a4577d5ab519dae6513955dd17c

    SHA256

    ba59cb645a4da18f35362aaab21c0051aa7707c4002fb9dda53034c84e4624b9

    SHA512

    91d3fd3532edd646ed5dda261a84af3f5ff14aeb01d64af778af87066097bc82f36eee8af14d66f1b7f99a0961225639ac25b32932f26c7d5694396424fdd628

  • C:\Users\Admin\AppData\Local\Temp\vbc333416CD202F488F9C63D7815EEB6577.TMP

    Filesize

    660B

    MD5

    e1118bd46f68b09a89b1209920f79a06

    SHA1

    3fd3b522e7278dd4e796f18d73ae34101bf645d9

    SHA256

    123412959e54a1a24cd0cabd601ce3e98b03d1a7ee781f4b81ad2e251762dcb9

    SHA512

    dd2f4b334af6c9c4272100442941798e0d1d0a967d89c5ed93c5646ac3abc0a774a6e171c506fee015a984925771a64be9d0e80fd59641dce0a6592b4f03a736

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    4f0e8cf79edb6cd381474b21cabfdf4a

    SHA1

    7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4

    SHA256

    e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5

    SHA512

    2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107

  • memory/2704-25-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/2704-29-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/2704-28-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/2704-27-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/2704-24-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/2704-23-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/4648-22-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/4648-2-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/4648-0-0x0000000074752000-0x0000000074753000-memory.dmp

    Filesize

    4KB

  • memory/4648-1-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/5068-18-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB

  • memory/5068-9-0x0000000074750000-0x0000000074D01000-memory.dmp

    Filesize

    5.7MB