Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 14:17
Behavioral task
behavioral1
Sample
952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe
-
Size
359KB
-
MD5
952692e06a52def1ae5a4135e9bbe13d
-
SHA1
72a5a6ad26acb424d540fd2cdd86fbe316d88eb5
-
SHA256
de98e97c7af2ae6eaf40e293e156e83c1b80e3d197add148ced9b4e98f84a1eb
-
SHA512
410908d17b87d8d617bd9897a04622efcd0ced4122acc66cb85c88d864d63798da147dc9600ca2eb082cb81ef473fd3a34d789e34a383db11cf68d02c87a782d
-
SSDEEP
6144:9Aqya+IRYCpyJKlriiAv3krwfkkXwEZnbiftZ2ADdSEF4dAHsPrsA7zXPyeKmK7D:9AqySRnyJm6p+ftZ2AExdvTsEz/lKhV
Malware Config
Extracted
netwire
respect.ddns.net:3945
-
activex_autorun
true
-
activex_key
{6632CI80-0E7T-476N-GWY8-1230G174P611}
-
copy_executable
true
-
delete_original
false
-
host_id
windows
-
install_path
%AppData%\Install\excel.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
FkUGAcbk
-
offline_keylogger
true
-
password
Hunter45
-
registry_autorun
true
-
startup_name
Flash
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3976-6-0x0000000000400000-0x0000000000FB8000-memory.dmp netwire behavioral2/memory/3976-3-0x0000000000400000-0x0000000000FB8000-memory.dmp netwire behavioral2/memory/3976-13-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/3976-9-0x0000000000400000-0x0000000000FB8000-memory.dmp netwire behavioral2/memory/2224-25-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
excel.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6632CI80-0E7T-476N-GWY8-1230G174P611} excel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6632CI80-0E7T-476N-GWY8-1230G174P611}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\excel.exe\"" excel.exe -
Drops startup file 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exeexcel.exeexcel.exepid process 3976 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 1744 excel.exe 2224 excel.exe -
Processes:
resource yara_rule behavioral2/memory/4076-0-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe upx behavioral2/memory/1744-12-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1744-15-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4076-23-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
excel.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Flash = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\excel.exe" excel.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exeexcel.exedescription pid process target process PID 4076 set thread context of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 1744 set thread context of 2224 1744 excel.exe excel.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exeexcel.exepid process 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 1744 excel.exe 1744 excel.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exeexcel.exepid process 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 1744 excel.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.execmd.exenet.exeexcel.execmd.exenet.exedescription pid process target process PID 4076 wrote to memory of 5036 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe cmd.exe PID 4076 wrote to memory of 5036 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe cmd.exe PID 4076 wrote to memory of 5036 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe cmd.exe PID 4076 wrote to memory of 3048 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe cmd.exe PID 4076 wrote to memory of 3048 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe cmd.exe PID 4076 wrote to memory of 3048 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe cmd.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 3976 wrote to memory of 1744 3976 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe excel.exe PID 3976 wrote to memory of 1744 3976 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe excel.exe PID 3976 wrote to memory of 1744 3976 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe excel.exe PID 4076 wrote to memory of 3976 4076 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe 952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe PID 3048 wrote to memory of 3456 3048 cmd.exe net.exe PID 3048 wrote to memory of 3456 3048 cmd.exe net.exe PID 3048 wrote to memory of 3456 3048 cmd.exe net.exe PID 3456 wrote to memory of 1904 3456 net.exe net1.exe PID 3456 wrote to memory of 1904 3456 net.exe net1.exe PID 3456 wrote to memory of 1904 3456 net.exe net1.exe PID 1744 wrote to memory of 4896 1744 excel.exe cmd.exe PID 1744 wrote to memory of 4896 1744 excel.exe cmd.exe PID 1744 wrote to memory of 4896 1744 excel.exe cmd.exe PID 1744 wrote to memory of 748 1744 excel.exe cmd.exe PID 1744 wrote to memory of 748 1744 excel.exe cmd.exe PID 1744 wrote to memory of 748 1744 excel.exe cmd.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 1744 wrote to memory of 2224 1744 excel.exe excel.exe PID 748 wrote to memory of 4296 748 cmd.exe net.exe PID 748 wrote to memory of 4296 748 cmd.exe net.exe PID 748 wrote to memory of 4296 748 cmd.exe net.exe PID 4296 wrote to memory of 2020 4296 net.exe net1.exe PID 4296 wrote to memory of 2020 4296 net.exe net1.exe PID 4296 wrote to memory of 2020 4296 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
C:\Users\Admin\AppData\Local\Temp\952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\excel.exe"C:\Users\Admin\AppData\Roaming\Install\excel.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Roaming\Install\excel.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"4⤵
- Drops startup file
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc6⤵
-
C:\Users\Admin\AppData\Roaming\Install\excel.exeC:\Users\Admin\AppData\Roaming\Install\excel.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\952692e06a52def1ae5a4135e9bbe13d_JaffaCakes118.exeFilesize
359KB
MD5952692e06a52def1ae5a4135e9bbe13d
SHA172a5a6ad26acb424d540fd2cdd86fbe316d88eb5
SHA256de98e97c7af2ae6eaf40e293e156e83c1b80e3d197add148ced9b4e98f84a1eb
SHA512410908d17b87d8d617bd9897a04622efcd0ced4122acc66cb85c88d864d63798da147dc9600ca2eb082cb81ef473fd3a34d789e34a383db11cf68d02c87a782d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
111B
MD589394958ce9d184d2340451aad75fffd
SHA157984720d59beb2d034483c409f7791dd6a41cc8
SHA2562f1e20eab24d144fe57631b11a5b6cef3d805f9a368b008ed38e7bd8d15e43bf
SHA51284a9e31e6d2a516d49c2bb12a004fb79fd4c822aa402556b8fc84180d779d2c4040a14c47b5ef9f604da51064d9f66c41e161bc415b9134212e2dd000140aba4
-
memory/1744-12-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1744-15-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2224-25-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3976-6-0x0000000000400000-0x0000000000FB8000-memory.dmpFilesize
11.7MB
-
memory/3976-3-0x0000000000400000-0x0000000000FB8000-memory.dmpFilesize
11.7MB
-
memory/3976-13-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3976-9-0x0000000000400000-0x0000000000FB8000-memory.dmpFilesize
11.7MB
-
memory/4076-2-0x00000000022B0000-0x00000000022B5000-memory.dmpFilesize
20KB
-
memory/4076-0-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4076-1-0x0000000002290000-0x0000000002291000-memory.dmpFilesize
4KB
-
memory/4076-23-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB