Analysis
-
max time kernel
142s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 14:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
-
Size
448KB
-
MD5
41cddb92c40e1603cdd00456cf19b1b8
-
SHA1
c55741e0e2068f8f2c1f920822335ecf2816a17e
-
SHA256
fdadd323f4e3b7dfa61822fb9abe621a9dc0b79f465c8b767cee4f5ecf4bb194
-
SHA512
fcb9110cc2c6e469079c400ab2f2a7cd55c92011fcdcc7a38a4fb483489a2ac642e097bf9099a94063b4ff5e7450116f2ac581292f1b81a252731d6181a902d0
-
SSDEEP
6144:wQN9opCq9B2U1NZx9WRpRnbcE96n6+mpv2muhHklc37k8ztMj/+pLp:5opCQ4YWRnYE06+0BumlmkvzCp
Score
10/10
Malware Config
Extracted
Family
netwire
C2
top.westover.xyz:4590
Attributes
-
activex_autorun
true
-
activex_key
{803GTO4N-ENS6-08FV-IL8I-U12VW8O81OU2}
-
copy_executable
false
-
delete_original
false
-
host_id
ACALYS-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
WDqjVsjL
-
offline_keylogger
true
-
password
252522
-
registry_autorun
true
-
startup_name
printer
-
use_mutex
true
Signatures
-
NetWire RAT payload 2 IoCs
resource yara_rule behavioral2/memory/1704-8-0x0000000048D70000-0x0000000048DE2000-memory.dmp netwire behavioral2/memory/1704-11-0x0000000048D70000-0x0000000048DE2000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{803GTO4N-ENS6-08FV-IL8I-U12VW8O81OU2}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe\"" 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{803GTO4N-ENS6-08FV-IL8I-U12VW8O81OU2} 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\printer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe" 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe 1704 41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\41cddb92c40e1603cdd00456cf19b1b8_JaffaCakes118.exe"1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1704