Overview

overview

10

Static

static

1

d97dc7068c...18.msi

windows7-x64

10

d97dc7068c...18.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 02:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d97dc7068c3264ec0ef8d228db33ef12_JaffaCakes118.msi

  • Size

    300KB

  • MD5

    d97dc7068c3264ec0ef8d228db33ef12

  • SHA1

    cc811a1ced21af00d47968f87f7c2a6198dffad7

  • SHA256

    2e60d3cd818fa132f8425b50f8a1de53fb7c1ebfa050bd3891a4f5c97971bf10

  • SHA512

    bde02f49f92a39a51ee683522201a83fb6651df424400a0a1b39c00aa74f5ab05dda60f75354467c8ef6c2b535c365dcd68dd86c93b51577afbf2a2fa5dd2be9

  • SSDEEP

    6144:2EAidq19l2sJmwh4HYRYtEWBzhlANcjat9w44mKZ:2E6N44RQEW54m+934zZ

Score
10/10
netwirebotnetdiscoverypersistenceprivilege_escalationratstealer

Malware Config

Extracted

Family

netwire

C2

wealthymachine.ddns.net:39560

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    sunshineslisa

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 2 IoCs
    rat
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire
  • Drops startup file 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d97dc7068c3264ec0ef8d228db33ef12_JaffaCakes118.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2344
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1580
    • C:\Windows\Installer\MSID1F7.tmp
      "C:\Windows\Installer\MSID1F7.tmp"
      2⤵
      • Drops startup file
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2268
      • C:\Users\Admin\AppData\Roaming\app.exe
        "C:\Users\Admin\AppData\Roaming\app.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Users\Admin\AppData\Roaming\app.exe
          "C:\Users\Admin\AppData\Roaming\app.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:468
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57d11e.rbs
    Filesize

    663B

    MD5

    527727268b7957cfd921bdce15d82142

    SHA1

    e598ed5fd10db77b2a8c8d0f780efdf5af2c3539

    SHA256

    40a21bced1c5d310f692af78ace6d213efc61b1cce2aa3ea238d57abbd0a6db8

    SHA512

    a96bd5dbb15e86e5e6f9412ff07d2e4309a7d42cebb62a45a3a0c83d9f51bc77aa11c3de41cdac129d8c3b0158fc9533007c711952211f9d24181e8ce3087306

    Download Submit

  • C:\Windows\Installer\MSID1F7.tmp
    Filesize

    274KB

    MD5

    73724b470edb3f41133b46d9a86e40b7

    SHA1

    bcad91a319ee05563eb63c1dd34456f961c19cf4

    SHA256

    bf6750c39f9a74489588698123c7231b0045baee86325f6e2e7ff5fad859dff3

    SHA512

    cca819c2973060c55809e02c711fb8cc1af0248c6776f1ebf6f16108c461cb9f2062c37a10fff86ed75c6e3872330c8349943b4b9578a0b9683aa98678120fb1

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.7MB

    MD5

    00839f3651b651246e412d5b99e227ea

    SHA1

    b84d6ad4d9a9152227636d7a173a85fac31ada0b

    SHA256

    f87f62db171ef8f79ad0c80df2fb40f5944ece9f495f94b469d4a7134b4059e7

    SHA512

    653a642ddfabbbe8e88217a2e8e322489755d24a0fca927613af2dab24a63ecfeafe88717ea32bd54dbd8f17360df8504a9b9400e174c692e4c459bcb49e401a

    Download Submit

  • \??\Volume{f1c9ec80-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c164df66-eb1a-42db-82ff-a55b45ef0ce6}_OnDiskSnapshotProp
    Filesize

    6KB

    MD5

    08a568426041f950e99028061918c7a1

    SHA1

    03169fefd1e37161c74f9dcc4e049ec1e148963a

    SHA256

    2b7a40f865fe95990ff034a1f307a276bbe0894751890fff85cad0a266d555b3

    SHA512

    13f4fee54302875a510044d677d263d55f2b5b71ac355bc197f0cafd13fac84f4da72262c5a8cd9a49e741e2ddf866240a6b3c5fba2d25bb6d164dc1f4cf0508

    Download Submit

  • memory/468-41-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/468-43-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download