Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-10-2024 06:33
General
-
Target
20180a09bd56f0614df702155b59eb22_JaffaCakes118.exe
-
Size
670KB
-
MD5
20180a09bd56f0614df702155b59eb22
-
SHA1
a965cd7150fb405653d59994344b4941c8fdf6be
-
SHA256
55b4dfd9f6a64f7a2b86033f0808e1850cebb5819e476e9dcd25d59bf09366c1
-
SHA512
c88387b6b9490cb13de28e04bbdabde9437c8ad27fb8c9ee5110ffe12180821bb5a0f4621fb80611e7bbc5b274124e2c94154ef570b8eaa48abf4e066acb87fb
-
SSDEEP
6144:F2n5g3PZMegQUFyGy+3Lg57V1OnheX88VVcPnxSXeqpZE4GRfKx/8GcsMBvMCmJO:F252EQUFuCgJ/s2q5Gep4E+esTCmfU
Malware Config
Extracted
netwire
centos4u.strangled.net:1337
centos44.myftp.biz:1337
-
activex_autorun
true
-
activex_key
{3G3GH5DC-0RYG-I32H-266Y-2RMB2EO7OHX0}
-
copy_executable
true
-
delete_original
false
-
host_id
ZOZO
-
install_path
%AppData%\Adobe\Firefox.exe
-
keylogger_dir
%AppData%\L0JJ\
-
lock_executable
true
-
mutex
RvPShIvm
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
Defenderss
-
use_mutex
true
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
NetWire RAT payload 6 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
ModiLoader Second Stage 5 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20180a09bd56f0614df702155b59eb22_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\20180a09bd56f0614df702155b59eb22_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\20180a09bd56f0614df702155b59eb22_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\20180a09bd56f0614df702155b59eb22_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\Firefox.exe"C:\Users\Admin\AppData\Roaming\Adobe\Firefox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\Firefox.exe"C:\Users\Admin\AppData\Roaming\Adobe\Firefox.exe"4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
670KB
MD520180a09bd56f0614df702155b59eb22
SHA1a965cd7150fb405653d59994344b4941c8fdf6be
SHA25655b4dfd9f6a64f7a2b86033f0808e1850cebb5819e476e9dcd25d59bf09366c1
SHA512c88387b6b9490cb13de28e04bbdabde9437c8ad27fb8c9ee5110ffe12180821bb5a0f4621fb80611e7bbc5b274124e2c94154ef570b8eaa48abf4e066acb87fb
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1.3MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
264KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
264KB