Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 19:57
Static task
static1
Behavioral task
behavioral1
Sample
a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe
-
Size
620KB
-
MD5
a217880f3e4ffe347256d08ea0a8e756
-
SHA1
fbe38b496f08f3263659aa8f64263741a76b3464
-
SHA256
3a5fef44125d1ff9e9315dacf594bbd66a3f2619173306ab668dcc11395ca750
-
SHA512
731e37ca08f50f04fd6a67d4184b108daae48aa29551459eacfcdabfe7328a64669bbeeb249f2c189363741da6824ace393565ca7023a440a92599e05c511658
-
SSDEEP
12288:WVm7aREb32/fpxOQlzoYg+65VyAcidV2+:Wc77b3Wl31Owz
Malware Config
Extracted
netwire
46.20.33.82:3444
62.102.148.181:57980
46.165.208.108:3490
213.152.162.99:3829
109.163.226.153:3829
-
activex_autorun
true
-
activex_key
{KCU0IT3O-S203-3AK5-A012-E75586QE8077}
-
copy_executable
true
-
delete_original
false
-
host_id
~JuneLogs~%Rand%
-
install_path
%AppData%\Microsoft\HKRUN.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
QRRNjPvc
-
offline_keylogger
true
-
password
123456
-
registry_autorun
true
-
startup_name
ProLogs
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4444-4-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4444-6-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4444-9-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
HKRUN.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCU0IT3O-S203-3AK5-A012-E75586QE8077} HKRUN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCU0IT3O-S203-3AK5-A012-E75586QE8077}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HKRUN.exe\"" HKRUN.exe -
Executes dropped EXE 2 IoCs
Processes:
HKRUN.exeHKRUN.exepid process 4604 HKRUN.exe 3604 HKRUN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HKRUN.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ProLogs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\HKRUN.exe" HKRUN.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exeHKRUN.exedescription pid process target process PID 3548 set thread context of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 4604 set thread context of 3604 4604 HKRUN.exe HKRUN.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exea217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exeHKRUN.exedescription pid process target process PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 3548 wrote to memory of 4444 3548 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe PID 4444 wrote to memory of 4604 4444 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe HKRUN.exe PID 4444 wrote to memory of 4604 4444 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe HKRUN.exe PID 4444 wrote to memory of 4604 4444 a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe PID 4604 wrote to memory of 3604 4604 HKRUN.exe HKRUN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a217880f3e4ffe347256d08ea0a8e756_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4100,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\HKRUN.exeFilesize
620KB
MD5a217880f3e4ffe347256d08ea0a8e756
SHA1fbe38b496f08f3263659aa8f64263741a76b3464
SHA2563a5fef44125d1ff9e9315dacf594bbd66a3f2619173306ab668dcc11395ca750
SHA512731e37ca08f50f04fd6a67d4184b108daae48aa29551459eacfcdabfe7328a64669bbeeb249f2c189363741da6824ace393565ca7023a440a92599e05c511658
-
memory/3548-0-0x0000000074BD2000-0x0000000074BD3000-memory.dmpFilesize
4KB
-
memory/3548-1-0x0000000074BD0000-0x0000000075181000-memory.dmpFilesize
5.7MB
-
memory/3548-2-0x0000000074BD0000-0x0000000075181000-memory.dmpFilesize
5.7MB
-
memory/3548-14-0x0000000074BD0000-0x0000000075181000-memory.dmpFilesize
5.7MB
-
memory/4444-4-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4444-6-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4444-9-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4444-3-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4604-15-0x0000000074BD0000-0x0000000075181000-memory.dmpFilesize
5.7MB
-
memory/4604-16-0x0000000074BD0000-0x0000000075181000-memory.dmpFilesize
5.7MB
-
memory/4604-27-0x0000000074BD0000-0x0000000075181000-memory.dmpFilesize
5.7MB