Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 16:37
General
-
Target
JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe
-
Size
608KB
-
MD5
7ab423a0c3c7eeb3bb00d130e6b6f9bd
-
SHA1
23ecc0bb28e5c69b5a07cd215e34b2459ffa7f4e
-
SHA256
209b685ffe19683bfa33f9bb813abe69fd7df5d7260e186d09189d0764b61b5c
-
SHA512
dc2061ac9a1e7573348ac49514a6c905f3c756e4d5a366001ca76bb604e92f03fe4e967f65f843c82397e74cce938b32cc08261e9b193a91bb58270d291da93e
-
SSDEEP
12288:52u4sum+hlTEqUZoYX+KdC3R+kFifVucd4lJO2oT+VC/:pKmGlTEZo8eRpFifMK/
Malware Config
Signatures
-
Detect XtremeRAT payload 3 IoCs
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NTFS ADS 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ab423a0c3c7eeb3bb00d130e6b6f9bd.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
971B
MD5bc927f9c98623eb2f1beefde02085316
SHA11421822873d453d24f874a10d7d1293f463b7f39
SHA2563fc2933b01a45913d9599df921784bbc85ff754b265b289a24e15e5a5fdf4717
SHA512bf1ba87f836d7e2f8b2d30eecf9052959395d7d94493e4a5e66f24c0f3ea4ea529b3da03be2024c86d3479310130d7f6421c13aa45ecaa5929d070c2c082782e
-
Filesize
971B
MD51672edcaa69fcd6696d210fc27d84760
SHA1237db715a17c381a2380a34b9f8f7c487745d12e
SHA256f03b737036e9bd0994ccf00e196a9e13906a60bdeae5fbe39cfb5d84928c78d8
SHA512ec640b23882c32ee0cd76b6aafa9c5e65bbf65a15d9a8ed2ae95364a2f1c40bce3202cafa7adebda9f39d69f299fb9aee86a3683ce1b67664bddb49d4982371c
-
Filesize
971B
MD5954c62ee6376d7502831ae39831caadc
SHA175860379a9f0ae31e3b21fc9fc839f3f534c792b
SHA2561d7e0004629ce379e7c39f3416111cede15f1badb5d232dad40c56371f647ef7
SHA512d8dbd31c6c4e09035a88e1ceea90d54a37c8472b955c1db9fc06fd0bc0c1712c2047060d1aabc5f34205015de8e081dea536bcdb3ab4bfb56679c6281c98d1af
-
Filesize
766KB
-
Filesize
628KB
-
Filesize
766KB
-
Filesize
766KB
-
Filesize
766KB
-
Filesize
766KB
-
Filesize
628KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
766KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB