Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 00:03
General
-
Target
69151a11fa04f698816a2e4b36a34f58_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
69151a11fa04f698816a2e4b36a34f58
-
SHA1
93a7d4537f7b34105a2d5f59564dc9327ef2a072
-
SHA256
22d5447cace450971bac1055cac836686691a30e31880dbf1e66acd0c7c4e2df
-
SHA512
1dbbe3129bafb15cbb526e6f15e5ad64beedb5733fad6e064e66d1d298f86dd5383f4951f7652c51bbeb53ceb537510fef8be5e18fbb5a670f5672c967e4cf4f
-
SSDEEP
24576:IGk69IS0rw4pP9p41GXbT7koeZRh0NIVIg8EwpsQ35gdn5H7/bPwEjHly3H:Xkjrl341GHQo40WSg8EwsQ35gdnp7TPL
Malware Config
Extracted
Protocol: ftp- Host:
195.210.46.67 - Port:
21 - Username:
focuseye_wp - Password:
focuseye_33213!
Signatures
-
Executes dropped EXE 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69151a11fa04f698816a2e4b36a34f58_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69151a11fa04f698816a2e4b36a34f58_JaffaCakes118.exe"1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
-
C:\ProgramData\amd64_dual_netevbda.inf_31bf3856ad364e35_10.0.18362.1_none_0282c0892fb67555\FwRemoteSvr.exeC:\ProgramData\amd64_dual_netevbda.inf_31bf3856ad364e35_10.0.18362.1_none_0282c0892fb67555\FwRemoteSvr.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\amd64_dual_netevbda.inf_31bf3856ad364e35_10.0.18362.1_none_0282c0892fb67555\FwRemoteSvr.exeC:\ProgramData\amd64_dual_netevbda.inf_31bf3856ad364e35_10.0.18362.1_none_0282c0892fb67555\FwRemoteSvr.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\ProgramData\amd64_dual_netevbda.inf_31bf3856ad364e35_10.0.18362.1_none_0282c0892fb67555\FwRemoteSvr.exeC:\ProgramData\amd64_dual_netevbda.inf_31bf3856ad364e35_10.0.18362.1_none_0282c0892fb67555\FwRemoteSvr.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD569151a11fa04f698816a2e4b36a34f58
SHA193a7d4537f7b34105a2d5f59564dc9327ef2a072
SHA25622d5447cace450971bac1055cac836686691a30e31880dbf1e66acd0c7c4e2df
SHA5121dbbe3129bafb15cbb526e6f15e5ad64beedb5733fad6e064e66d1d298f86dd5383f4951f7652c51bbeb53ceb537510fef8be5e18fbb5a670f5672c967e4cf4f
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB