Malware Analysis Report

2025-01-18 16:34

Sample ID 241215-abnjasyjgv
Target f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118
SHA256 f657d23b0f5e8c046f6c345a7bf78ac8a2f95f5b6c8bfe11effd6e986b046ef3
Tags
netwire botnet discovery persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f657d23b0f5e8c046f6c345a7bf78ac8a2f95f5b6c8bfe11effd6e986b046ef3

Threat Level: Known bad

The file f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

netwire botnet discovery persistence rat stealer

NetWire RAT payload

Netwire

Netwire family

Loads dropped DLL

Executes dropped EXE

Drops startup file

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Runs net.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-15 00:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-15 00:02

Reported

2024-12-15 00:05

Platform

win7-20241010-en

Max time kernel

145s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2932 set thread context of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2908 set thread context of 2552 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2820 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2820 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2820 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2820 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2820 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2820 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2820 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2996 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2996 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2748 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2748 wrote to memory of 2856 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2932 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2892 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2892 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2892 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2892 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2892 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2892 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2892 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"

C:\Windows\SysWOW64\cmd.exe

/c net stop MpsSvc

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Windows\SysWOW64\net.exe

net stop MpsSvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MpsSvc

C:\Users\Admin\AppData\Roaming\Install\Host.exe

-m "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Roaming\Install\Host.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"

C:\Windows\SysWOW64\cmd.exe

/c net stop MpsSvc

C:\Users\Admin\AppData\Roaming\Install\Host.exe

C:\Users\Admin\AppData\Roaming\Install\Host.exe

C:\Windows\SysWOW64\net.exe

net stop MpsSvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MpsSvc

Network

Country Destination Domain Proto
US 88.119.175.41:3365 tcp
US 88.119.175.41:3365 tcp
US 88.119.175.41:3365 tcp
US 88.119.175.41:3365 tcp
US 88.119.175.41:3365 tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

MD5 de8517147501bb8972fb16635580f3ba
SHA1 7f806c1ceca11217110c85ffb8ce4d076179b40a
SHA256 d7a3315f872243c28bd95fb75ed3b007821a2dea25f78afd8cbaaca1d853ef4f
SHA512 c6dd32cd44569e9367ae447791c1554903bdba7c35729e46cdfec8cbdd3194aa192cdc95fe224917b7cf7c8c7818cb0da0bf787d59e7e4dbad925dd8426d940f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cm_

MD5 654ac265df471b3b1747695fa19cc226
SHA1 1a0b7674e906b8661977c17c74f66b2172524085
SHA256 f1ead6d6c1b1515a0f781783cf8f929cd403aeaaeaef55ee03c3c1e7a983148a
SHA512 5a23074054cc8261f77835d55355cecaf3914982ca4bc705bce0f29a259fea6b750b65e753ec1d98b2c4d4e4f893426ccdc3d1451899e7247e5d903bb0ee0f21

memory/2932-19-0x0000000000250000-0x0000000000255000-memory.dmp

memory/2892-22-0x0000000000300000-0x0000000000400000-memory.dmp

memory/2892-26-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-25-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-28-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-52-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2892-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2892-51-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-30-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-34-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-36-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-43-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-41-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-39-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2892-32-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2552-88-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2552-90-0x0000000000400000-0x000000000041E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-15 00:02

Reported

2024-12-15 00:05

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3292 set thread context of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3136 set thread context of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Install\Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Runs net.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4480 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 4480 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 4480 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 3236 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Windows\SysWOW64\cmd.exe
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 3292 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd
PID 2096 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2096 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 2096 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3236 wrote to memory of 4220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 3236 wrote to memory of 4220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 3236 wrote to memory of 4220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4220 wrote to memory of 1920 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4220 wrote to memory of 1920 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4220 wrote to memory of 1920 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3136 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe
PID 1656 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1656 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1656 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4564 wrote to memory of 4076 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4564 wrote to memory of 4076 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4564 wrote to memory of 4076 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3136 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Install\Host.exe C:\Users\Admin\AppData\Roaming\Install\Host.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f1583cede77b634f2dd7f8807319d4f0_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"

C:\Windows\SysWOW64\cmd.exe

/c net stop MpsSvc

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

C:\Users\Admin\AppData\Roaming\Install\Host.exe

-m "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd"

C:\Windows\SysWOW64\net.exe

net stop MpsSvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MpsSvc

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Roaming\Install\Host.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"

C:\Windows\SysWOW64\cmd.exe

/c net stop MpsSvc

C:\Users\Admin\AppData\Roaming\Install\Host.exe

C:\Users\Admin\AppData\Roaming\Install\Host.exe

C:\Windows\SysWOW64\net.exe

net stop MpsSvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MpsSvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 107.27.33.23.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 88.119.175.41:3365 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 88.119.175.41:3365 tcp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 88.119.175.41:3365 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 88.119.175.41:3365 tcp
US 88.119.175.41:3365 tcp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cmd

MD5 de8517147501bb8972fb16635580f3ba
SHA1 7f806c1ceca11217110c85ffb8ce4d076179b40a
SHA256 d7a3315f872243c28bd95fb75ed3b007821a2dea25f78afd8cbaaca1d853ef4f
SHA512 c6dd32cd44569e9367ae447791c1554903bdba7c35729e46cdfec8cbdd3194aa192cdc95fe224917b7cf7c8c7818cb0da0bf787d59e7e4dbad925dd8426d940f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\@.cm_

MD5 654ac265df471b3b1747695fa19cc226
SHA1 1a0b7674e906b8661977c17c74f66b2172524085
SHA256 f1ead6d6c1b1515a0f781783cf8f929cd403aeaaeaef55ee03c3c1e7a983148a
SHA512 5a23074054cc8261f77835d55355cecaf3914982ca4bc705bce0f29a259fea6b750b65e753ec1d98b2c4d4e4f893426ccdc3d1451899e7247e5d903bb0ee0f21

memory/3292-13-0x00000000020F0000-0x00000000020F5000-memory.dmp

memory/2096-18-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2096-26-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2096-22-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/2096-20-0x0000000000400000-0x0000000000FB8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

MD5 0c34c1e07c3a00dd4f6c4185b40c66c4
SHA1 980a47c9c6d44ddff853282e903a4b561fac5942
SHA256 9c50ec3824a267d8756bc8e137bff24126afb044937468a507cb688a1a31fdf6
SHA512 4db5410845364484f4d9bdb9766d5e235095d7d65f8488fb9faa9cf06bc19a597bee03571a4e09be9c598d36da5b91f8feb2afcdedd028920e9672ef2cb81355

memory/3460-40-0x0000000000400000-0x0000000000FB8000-memory.dmp

memory/3460-43-0x0000000000400000-0x000000000041E000-memory.dmp