Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 20:57
Static task
static1
Behavioral task
behavioral1
Sample
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe
-
Size
503KB
-
MD5
193d1bb9c609ef883a556d3c8c3e789b
-
SHA1
a6aa05f46170ab543f9122f043cf3b28fccb871c
-
SHA256
3a6d5150486d015dfa8916607c7f2f0bdd0ddd97fe4b11f15afecc40eab87a5f
-
SHA512
44631124a67e948f1ed0d71250837aaaedc7f571e3c607e2536aa0ac66700e416c43be97bd2124a3c613d955925c182027f051d6785ee44510e9c6af74862507
-
SSDEEP
6144:51StmT+sbAyX58ZPCVuif1StmT+sbAyX58ZPCVuiu+mKCJ90D+Y7a0h66549:58yIy581Qv8yIy581QS/w49
Malware Config
Extracted
netwire
79.172.242.33:4068
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Elibee88
-
registry_autorun
false
-
use_mutex
false
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4468-2-0x00000000055D0000-0x00000000055F8000-memory.dmp family_zgrat_v1 -
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4488-15-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/4488-20-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/4488-18-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
app.exeapp.exepid process 776 app.exe 4488 app.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4468-2-0x00000000055D0000-0x00000000055F8000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
app.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUtility.exe = "C:\\Users\\Admin\\AppData\\Local\\app.exe -boot" app.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
app.exedescription pid process target process PID 776 set thread context of 4488 776 app.exe app.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exeapp.exedescription pid process Token: SeDebugPrivilege 4468 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe Token: SeDebugPrivilege 776 app.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exeexplorer.exeapp.exedescription pid process target process PID 4468 wrote to memory of 1936 4468 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe cmd.exe PID 4468 wrote to memory of 1936 4468 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe cmd.exe PID 4468 wrote to memory of 1936 4468 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe cmd.exe PID 4468 wrote to memory of 3632 4468 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe explorer.exe PID 4468 wrote to memory of 3632 4468 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe explorer.exe PID 4468 wrote to memory of 3632 4468 193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe explorer.exe PID 2708 wrote to memory of 776 2708 explorer.exe app.exe PID 2708 wrote to memory of 776 2708 explorer.exe app.exe PID 2708 wrote to memory of 776 2708 explorer.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe PID 776 wrote to memory of 4488 776 app.exe app.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\193d1bb9c609ef883a556d3c8c3e789b_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\app.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\app.exe"2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\app.exe"C:\Users\Admin\AppData\Local\app.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\app.exe"C:\Users\Admin\AppData\Local\app.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\app.exeFilesize
503KB
MD5193d1bb9c609ef883a556d3c8c3e789b
SHA1a6aa05f46170ab543f9122f043cf3b28fccb871c
SHA2563a6d5150486d015dfa8916607c7f2f0bdd0ddd97fe4b11f15afecc40eab87a5f
SHA51244631124a67e948f1ed0d71250837aaaedc7f571e3c607e2536aa0ac66700e416c43be97bd2124a3c613d955925c182027f051d6785ee44510e9c6af74862507
-
memory/776-14-0x0000000005DC0000-0x0000000005E5C000-memory.dmpFilesize
624KB
-
memory/4468-3-0x0000000005DD0000-0x0000000006374000-memory.dmpFilesize
5.6MB
-
memory/4468-0-0x000000007534E000-0x000000007534F000-memory.dmpFilesize
4KB
-
memory/4468-4-0x0000000075340000-0x0000000075AF0000-memory.dmpFilesize
7.7MB
-
memory/4468-5-0x0000000005720000-0x00000000057B2000-memory.dmpFilesize
584KB
-
memory/4468-8-0x000000007534E000-0x000000007534F000-memory.dmpFilesize
4KB
-
memory/4468-9-0x0000000075340000-0x0000000075AF0000-memory.dmpFilesize
7.7MB
-
memory/4468-11-0x0000000075340000-0x0000000075AF0000-memory.dmpFilesize
7.7MB
-
memory/4468-2-0x00000000055D0000-0x00000000055F8000-memory.dmpFilesize
160KB
-
memory/4468-1-0x0000000000C20000-0x0000000000CA4000-memory.dmpFilesize
528KB
-
memory/4488-15-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4488-20-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4488-18-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB