Analysis
-
max time kernel
159s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05-04-2024 00:36
General
-
Target
c60c89675f01d29fa7d51e7164f0b0bb_JaffaCakes118.exe
-
Size
4.4MB
-
MD5
c60c89675f01d29fa7d51e7164f0b0bb
-
SHA1
8dda37e1d7d08b75b37f40185df71134d1bb3e31
-
SHA256
3fe1fdb32e7d31efa8846dc6d01c56a5ccf708a770aafedcadac875e8ce41f8e
-
SHA512
9b972e6e29ece417a5018ac8df6f601f58b353d9ca3bc713a89d404ab31b9a48f9bc732299fefd8f4314fa36c9a40c3f3dd5d717318872c56cdb298a225b0bdb
-
SSDEEP
98304:74AqGkgAo0Gkuv0VrN2OVDv4j24lilj1qU:74vlPqsrNAi9UU
Malware Config
Extracted
netwire
173.209.48.226:3360
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-qCmwMg
-
keylogger_dir
C:\Users\Admin\AppData\Roaming\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c60c89675f01d29fa7d51e7164f0b0bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c60c89675f01d29fa7d51e7164f0b0bb_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
204KB
-
Filesize
960KB
-
Filesize
492KB
-
Filesize
204KB