Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 08:39
Static task
static1
Behavioral task
behavioral1
Sample
e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe
-
Size
873KB
-
MD5
e9978425a024bee8daf9b6ae88d1d967
-
SHA1
8bb64106e14c7ece0e6478a73169d7cc520c18ef
-
SHA256
e4b66d8eccf8e0ec2f33afb880b23e1a5dc131028bf91a4c5cbbbd883331fa65
-
SHA512
95cdc852ad5f8c5a4943ef963259d10c7aa8f22760e29388af67199ff8e3a8912194524a15d8e8350dcfb202c35a02267ee593533ba234f36f3fab44f397f0dd
-
SSDEEP
12288:bwaCSZ//mZ11r/JJ7q40+eUe5JtgFUIanV:jCC/ulqzjflgFUxV
Malware Config
Extracted
netwire
harold.ns01.info:3606
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
prim
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
eApkLVIW
-
offline_keylogger
true
-
password
master12
-
registry_autorun
false
-
use_mutex
true
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2716-17-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2716-19-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2716-21-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2716-23-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2716-27-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2716-29-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exedescription pid process target process PID 2128 set thread context of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2472 2716 WerFault.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exee9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exedescription pid process target process PID 2128 wrote to memory of 2556 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe schtasks.exe PID 2128 wrote to memory of 2556 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe schtasks.exe PID 2128 wrote to memory of 2556 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe schtasks.exe PID 2128 wrote to memory of 2556 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe schtasks.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2128 wrote to memory of 2716 2128 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe PID 2716 wrote to memory of 2472 2716 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe WerFault.exe PID 2716 wrote to memory of 2472 2716 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe WerFault.exe PID 2716 wrote to memory of 2472 2716 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe WerFault.exe PID 2716 wrote to memory of 2472 2716 e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DDnKWUYLNm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC35F.tmp"2⤵
- Creates scheduled task(s)
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9978425a024bee8daf9b6ae88d1d967_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 1403⤵
- Program crash
PID:2472