netwire | 8de3dda2e65faa4fffcac28429edb1dbd767edbfebf45314cba0269c3a4e6933

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Host.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Host.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50L4QLIK-5N0E-1U7P-5W65-RDN0R6N72FF0}	Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50L4QLIK-5N0E-1U7P-5W65-RDN0R6N72FF0}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe\""	Host.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Host.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Host.exe

Executes dropped EXE 3 IoCs

pid	Process
3732	Host.exe
2488	Host.exe
1036	Host.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Host.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Host.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 3732 set thread context of 1036	3732	Host.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2980	schtasks.exe
4544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
3732	Host.exe
3732	Host.exe
3732	Host.exe
3732	Host.exe
3732	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
Token: SeDebugPrivilege	3732	Host.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2980	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	95
PID 2596 wrote to memory of 2980	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	95
PID 2596 wrote to memory of 2980	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	95
PID 2596 wrote to memory of 2108	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	97
PID 2596 wrote to memory of 2108	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	97
PID 2596 wrote to memory of 2108	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	97
PID 2596 wrote to memory of 2332	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	98
PID 2596 wrote to memory of 2332	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	98
PID 2596 wrote to memory of 2332	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	98
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 2596 wrote to memory of 1248	2596	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	99
PID 1248 wrote to memory of 3732	1248	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	100
PID 1248 wrote to memory of 3732	1248	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	100
PID 1248 wrote to memory of 3732	1248	636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe	100
PID 3732 wrote to memory of 4544	3732	Host.exe	101
PID 3732 wrote to memory of 4544	3732	Host.exe	101
PID 3732 wrote to memory of 4544	3732	Host.exe	101
PID 3732 wrote to memory of 2488	3732	Host.exe	103
PID 3732 wrote to memory of 2488	3732	Host.exe	103
PID 3732 wrote to memory of 2488	3732	Host.exe	103
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104
PID 3732 wrote to memory of 1036	3732	Host.exe	104

C:\Users\Admin\AppData\Local\Temp\636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKoqzTArbkVKfc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFA8C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
  "{path}"
  2⤵
  PID:2108
- C:\Users\Admin\AppData\Local\Temp\636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
  "{path}"
  2⤵
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\636fe98bde392f519b60e46f80dbbda5_JaffaCakes118.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKoqzTArbkVKfc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8066.tmp"
      4⤵
      Creates scheduled task(s)
      PID:4544
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:2488
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion