Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 20:57
Static task
static1
Behavioral task
behavioral1
Sample
81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe
-
Size
250KB
-
MD5
81e62e155aa60cb563f4abb72e2d7545
-
SHA1
64c7ff05b6043a53e3c5b32f9d1610c7a711b274
-
SHA256
ee1a3b6747408c19a04a7bd69a4af9d81e71637a49ea16834e9e5ad381be4241
-
SHA512
906352611c7dc7b8204ad91faacba3f89006245f6d6d739fe24dfcd2edf4e8c48323009f7fafb96ea072d0affaaa80ce78456b7d151a6b0d24514c04eba0ecba
-
SSDEEP
6144:q1BLCofs/ic8Uo1DeXggJYXRYhxhjuk618HMqWIpbsQO:oLCCsKsuUJY2GH8KUQx
Malware Config
Extracted
netwire
mardjdf.ug:6974
kjsdtrfuyhgxcv.ru:6974
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Tlogs\
-
lock_executable
false
-
mutex
hgdGIATE
-
offline_keylogger
true
-
password
rdfs34df32sdf
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5040-6-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/5040-7-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Drops startup file 1 IoCs
Processes:
81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kjhgcxvbe.vbs 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exedescription pid process target process PID 852 set thread context of 5040 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exepid process 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exepid process 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exedescription pid process target process PID 852 wrote to memory of 5040 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe svchost.exe PID 852 wrote to memory of 5040 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe svchost.exe PID 852 wrote to memory of 5040 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe svchost.exe PID 852 wrote to memory of 5040 852 81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\81e62e155aa60cb563f4abb72e2d7545_JaffaCakes118.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-1-0x0000000000420000-0x0000000000520000-memory.dmpFilesize
1024KB
-
memory/852-2-0x00000000008C0000-0x00000000008C5000-memory.dmpFilesize
20KB
-
memory/852-3-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/5040-6-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5040-7-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB