Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-08-2024 08:31
General
-
Target
a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118.exe
-
Size
553KB
-
MD5
a1d9f729ba0a93ca92686b0db80ceb5a
-
SHA1
6835e4b44a748d067fbb9fcc1d7f4ad7d2cf61d5
-
SHA256
e866ce1a165219488a44eab3ae217e8f849951f5c8859f0f848768c909609406
-
SHA512
45c35f44c73ff3cff81b7c31737257b37c809cd063a25c6cdb1986b71a5508e4ecae9a7afa0228514a41f448f975e8aa1a84771b1e3b0ae996637d5ef892480f
-
SSDEEP
6144:7mCNnDzCA1x4X3PXrPJAVcD8LPhSiWofQr2k5l8Xb4ZFFpt0bowi/EH1:7zBRUfXacD8pellob4zKo//EH1
Malware Config
Extracted
netwire
185.61.138.216:456
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
592KB