Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 20:57
Static task
static1
Behavioral task
behavioral1
Sample
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe
-
Size
503KB
-
MD5
193d1bb9c609ef883a556d3c8c3e789b
-
SHA1
a6aa05f46170ab543f9122f043cf3b28fccb871c
-
SHA256
3a6d5150486d015dfa8916607c7f2f0bdd0ddd97fe4b11f15afecc40eab87a5f
-
SHA512
44631124a67e948f1ed0d71250837aaaedc7f571e3c607e2536aa0ac66700e416c43be97bd2124a3c613d955925c182027f051d6785ee44510e9c6af74862507
-
SSDEEP
6144:51StmT+sbAyX58ZPCVuif1StmT+sbAyX58ZPCVuiu+mKCJ90D+Y7a0h66549:58yIy581Qv8yIy581QS/w49
Malware Config
Extracted
netwire
79.172.242.33:4068
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Elibee88
-
registry_autorun
false
-
use_mutex
false
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2272-2-0x0000000000300000-0x0000000000328000-memory.dmp family_zgrat_v1 -
NetWire RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2320-19-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2320-21-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2320-22-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2320-25-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2320-27-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Executes dropped EXE 2 IoCs
Processes:
app.exeapp.exepid process 2404 app.exe 2320 app.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2272-2-0x0000000000300000-0x0000000000328000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
app.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUtility.exe = "C:\\Users\\Admin\\AppData\\Local\\app.exe -boot" app.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
app.exedescription pid process target process PID 2404 set thread context of 2320 2404 app.exe app.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exeapp.exedescription pid process Token: SeDebugPrivilege 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe Token: SeDebugPrivilege 2404 app.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exeexplorer.exeapp.exedescription pid process target process PID 2272 wrote to memory of 2980 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe cmd.exe PID 2272 wrote to memory of 2980 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe cmd.exe PID 2272 wrote to memory of 2980 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe cmd.exe PID 2272 wrote to memory of 2980 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe cmd.exe PID 2272 wrote to memory of 2696 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe explorer.exe PID 2272 wrote to memory of 2696 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe explorer.exe PID 2272 wrote to memory of 2696 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe explorer.exe PID 2272 wrote to memory of 2696 2272 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe explorer.exe PID 2576 wrote to memory of 2404 2576 explorer.exe app.exe PID 2576 wrote to memory of 2404 2576 explorer.exe app.exe PID 2576 wrote to memory of 2404 2576 explorer.exe app.exe PID 2576 wrote to memory of 2404 2576 explorer.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe PID 2404 wrote to memory of 2320 2404 app.exe app.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\app.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\app.exe"2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\app.exe"C:\Users\Admin\AppData\Local\app.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\app.exe"C:\Users\Admin\AppData\Local\app.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\app.exeFilesize
503KB
MD5193d1bb9c609ef883a556d3c8c3e789b
SHA1a6aa05f46170ab543f9122f043cf3b28fccb871c
SHA2563a6d5150486d015dfa8916607c7f2f0bdd0ddd97fe4b11f15afecc40eab87a5f
SHA51244631124a67e948f1ed0d71250837aaaedc7f571e3c607e2536aa0ac66700e416c43be97bd2124a3c613d955925c182027f051d6785ee44510e9c6af74862507
-
memory/2272-4-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2272-7-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2272-1-0x0000000000F90000-0x0000000001014000-memory.dmpFilesize
528KB
-
memory/2272-0-0x000000007420E000-0x000000007420F000-memory.dmpFilesize
4KB
-
memory/2272-2-0x0000000000300000-0x0000000000328000-memory.dmpFilesize
160KB
-
memory/2272-8-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2272-3-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2320-17-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2320-15-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2320-12-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2320-19-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2320-21-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2320-22-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2320-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2320-25-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2320-27-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2404-11-0x0000000000F10000-0x0000000000F94000-memory.dmpFilesize
528KB