Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 09:27
Static task
static1
Behavioral task
behavioral1
Sample
b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe
-
Size
539KB
-
MD5
b7e3a34777762e23320ac86a0dc0e13d
-
SHA1
144e81a97b40bdd0c084d2bdb3de2f1b8cecc597
-
SHA256
5b3692b40de137cd31116d42ed879e98ffce063ad118c88e83e0eb8eeda720a7
-
SHA512
8b3d4f147115386d6b49c4858a17bf11558b3302ee86fc98033c8a886dd295bdfe8fdd2d064c5856309c3466e9656e19452cc5487a10d4fdf4ef1ce285c0f67a
-
SSDEEP
6144:30kAoJOWlY4KCi5E/vbBIPcSO1KiB4tgq1:nFYMiG/vbnoiBOL
Malware Config
Extracted
netwire
noapology.climatechangeawareness.uk:2001
-
activex_autorun
true
-
activex_key
{4N3IXX84-X7C0-1FI7-0YT5-2HLCU3K0W152}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
TtUhMGhJ
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3988-6-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/3988-10-0x0000000000400000-0x000000000042B000-memory.dmp netwire behavioral2/memory/3988-8-0x0000000000400000-0x000000000042B000-memory.dmp netwire -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exedescription pid process target process PID 1240 set thread context of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 set thread context of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 552 1644 WerFault.exe RegAsm.exe 4716 3988 WerFault.exe RegAsm.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exepid process 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exedescription pid process target process PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 wrote to memory of 3988 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe PID 1240 wrote to memory of 1644 1240 b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7e3a34777762e23320ac86a0dc0e13d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 5803⤵
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 5803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3988 -ip 39881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1644 -ip 16441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-0-0x000000007484E000-0x000000007484F000-memory.dmpFilesize
4KB
-
memory/1240-1-0x0000000000250000-0x00000000002DC000-memory.dmpFilesize
560KB
-
memory/1240-2-0x00000000026E0000-0x00000000026E8000-memory.dmpFilesize
32KB
-
memory/1240-3-0x0000000004CC0000-0x0000000004D52000-memory.dmpFilesize
584KB
-
memory/1240-4-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/1240-5-0x00000000050A0000-0x00000000050D0000-memory.dmpFilesize
192KB
-
memory/1240-17-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/1240-18-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/3988-6-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3988-10-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3988-8-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB