Overview

overview

10

Static

static

5

JaffaCakes...9c.exe

windows7-x64

10

JaffaCakes...9c.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-01-2025 12:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_6535782602983133515cb2577301a19c.exe

  • Size

    849KB

  • MD5

    6535782602983133515cb2577301a19c

  • SHA1

    2850db95b9a240570f1949e0aea9211acd0a70e8

  • SHA256

    a454f35bc41058dd917250fd6b6dbd9af8bc6769d84d2165ff224720245ac4aa

  • SHA512

    73ad633a258232f161427b8429aaf40f5f32869575ea74c6365d6ade1379c0f7f3a95d54434891b2a96fcbfe0d3f972de867e3632c8b504f300d712c0855015b

  • SSDEEP

    12288:shkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a5Vqw68ArAhgv+qFvHPRi6:kRmJkcoQricOIQxiZY1ia5VqPagvoa

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat
  • Xtremerat family
    xtremerat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6535782602983133515cb2577301a19c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6535782602983133515cb2577301a19c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2828
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:2868
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            3⤵
              PID:2772
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              3⤵
                PID:2596
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                3⤵
                  PID:2896
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  3⤵
                    PID:2712
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe"
                    3⤵
                      PID:2628
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe"
                      3⤵
                        PID:2800
                      • C:\Windows\InstallDir\Server.exe
                        "C:\Windows\InstallDir\Server.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:2568

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • \Windows\InstallDir\Server.exe
                    Filesize

                    222KB

                    MD5

                    545bf7eaa24a9e062857d0742ec0b28a

                    SHA1

                    d748d5b325e5dd4fadeb837a59f61e55d2636d31

                    SHA256

                    50f2abb613df4813ce74f3b0df080497f689dfcad11f0fc7cd5ea4cdaf093bdf

                    SHA512

                    b132a23f443a75deb7bd10415efb871524b63860b2eb30a198dea2f7e67a1fa3bcdc5344dc98f306c8b93452329d6422d5264c1d64a403abeaf7db1662980f1a

                    Download Submit

                  • memory/2788-4-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/2788-6-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/2788-5-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/2788-2-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/2788-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2788-0-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/2788-10-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/2788-15-0x0000000000C80000-0x0000000000C96000-memory.dmp

                    Filesize

                    88KB

                    Download