Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 11:43
Static task
static1
Behavioral task
behavioral1
Sample
a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe
Resource
win7-20240221-en
9 signatures
150 seconds
General
-
Target
a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe
-
Size
273KB
-
MD5
a97e85a40509f6bbc7427edf6a1db4c8
-
SHA1
f3e0bd2597e0d1f819337808dee52babc70f16f5
-
SHA256
b23e4ec41a7eaacf693fc9f0651c514720b0ba28773c85aa6b8aa682a42c3a23
-
SHA512
5f1559c5fa0f6f4fb378b28ed82e00ef6e64f635f91ed78e8acb683c550b2a9cb19e30ed7aaa9563cde8d804444dc5834cd7f953b2e60fafc775c0a5bd11dbaa
-
SSDEEP
6144:Q5NT96qD0nnPSe/NZ+CVtZsStyK7sSVR0ICW0SEMUSdGg1MRafm1QhO:U96q4nnPSeDtySo251MRafm1QU
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1216-7-0x00000000003E0000-0x00000000003FE000-memory.dmp netwire behavioral2/memory/1216-6-0x00000000003E0000-0x00000000003FE000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exedescription pid process target process PID 4048 set thread context of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exedescription pid process target process PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe PID 4048 wrote to memory of 1216 4048 a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a97e85a40509f6bbc7427edf6a1db4c8_JaffaCakes118.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1216-5-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/1216-7-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/1216-6-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/4048-0-0x0000000074882000-0x0000000074883000-memory.dmpFilesize
4KB
-
memory/4048-1-0x0000000074880000-0x0000000074E31000-memory.dmpFilesize
5.7MB
-
memory/4048-2-0x0000000074880000-0x0000000074E31000-memory.dmpFilesize
5.7MB
-
memory/4048-9-0x0000000074880000-0x0000000074E31000-memory.dmpFilesize
5.7MB
-
memory/4048-11-0x0000000074880000-0x0000000074E31000-memory.dmpFilesize
5.7MB