Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 14:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
General
-
Target
f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
f88b069ef7bd12d5cb4db9098d4beeeb
-
SHA1
8c786f1f2c2ae666607e8073b27dd1632277f976
-
SHA256
14877fa4f39377ada4306b7ed535e31186135b11f8981da35e2d3a124824a40a
-
SHA512
093be3cdd3b8cdf700d83c4308848f259d92c70cb6870e92faab8d9a226af7fe394024fc3c8063f1d9cf5d85ec55dc57cbd60d7e68077fae8f6a9b4750e3bb8a
-
SSDEEP
24576:XAHnh+eWsN3skA4RV1Hom2KXSmdas6J2jvmrrb5:Kh+ZkldoPKi2as6J2Lmd
Malware Config
Extracted
Family
netwire
C2
194.5.98.103:8912
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
resource yara_rule behavioral2/memory/3264-2-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/3264-11-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\certreq.vbs f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4464 set thread context of 3264 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4464 wrote to memory of 3264 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 86 PID 4464 wrote to memory of 3264 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 86 PID 4464 wrote to memory of 3264 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 86 PID 4464 wrote to memory of 3264 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 86 PID 4464 wrote to memory of 3264 4464 f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f88b069ef7bd12d5cb4db9098d4beeeb_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3264
-