Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe
-
Size
488KB
-
MD5
f3ac5a3e525f30d153392d0ef6e85673
-
SHA1
4c4a336c0428ee12b71b1d02b4c6ac69cba1b754
-
SHA256
6b50fdd2cc899f1cfe0b191c30ad8217514f52ca2fec5896ddbf5f9e1c6be43f
-
SHA512
2290edd41ec4c8faab7ab0ceb97a0a2d59a7f0fbd5003759c439ebdc1abdda7a5528356077c1951b5b7a01ef4f46ea0c58dcf1b7ba4b384c35b6e24864d029c3
-
SSDEEP
12288:7ReCXbFcHAc9r5pmcrIW+61dTdxGmnOY/6:48FSJDm7fMdTH75/6
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 6 IoCs
Processes:
autoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exepid process 2116 autoformat.exe 2316 autoformat.exe 2920 autoformat.exe 360 autoformat.exe 1996 autoformat.exe 2464 autoformat.exe -
Loads dropped DLL 12 IoCs
Processes:
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exepid process 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 2116 autoformat.exe 2116 autoformat.exe 2316 autoformat.exe 2316 autoformat.exe 2920 autoformat.exe 2920 autoformat.exe 360 autoformat.exe 360 autoformat.exe 1996 autoformat.exe 1996 autoformat.exe -
Drops file in System32 directory 7 IoCs
Processes:
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exedescription ioc process File created C:\Windows\SysWOW64\autoformat.exe f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\autoformat.exe f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exepid process 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 2116 autoformat.exe 2116 autoformat.exe 2116 autoformat.exe 2116 autoformat.exe 2116 autoformat.exe 2116 autoformat.exe 2316 autoformat.exe 2316 autoformat.exe 2316 autoformat.exe 2316 autoformat.exe 2316 autoformat.exe 2316 autoformat.exe 2920 autoformat.exe 2920 autoformat.exe 2920 autoformat.exe 2920 autoformat.exe 2920 autoformat.exe 2920 autoformat.exe 360 autoformat.exe 360 autoformat.exe 360 autoformat.exe 360 autoformat.exe 360 autoformat.exe 360 autoformat.exe 1996 autoformat.exe 1996 autoformat.exe 1996 autoformat.exe 1996 autoformat.exe 1996 autoformat.exe 1996 autoformat.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exedescription pid process target process PID 1976 wrote to memory of 2116 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe autoformat.exe PID 1976 wrote to memory of 2116 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe autoformat.exe PID 1976 wrote to memory of 2116 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe autoformat.exe PID 1976 wrote to memory of 2116 1976 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe autoformat.exe PID 2116 wrote to memory of 2316 2116 autoformat.exe autoformat.exe PID 2116 wrote to memory of 2316 2116 autoformat.exe autoformat.exe PID 2116 wrote to memory of 2316 2116 autoformat.exe autoformat.exe PID 2116 wrote to memory of 2316 2116 autoformat.exe autoformat.exe PID 2316 wrote to memory of 2920 2316 autoformat.exe autoformat.exe PID 2316 wrote to memory of 2920 2316 autoformat.exe autoformat.exe PID 2316 wrote to memory of 2920 2316 autoformat.exe autoformat.exe PID 2316 wrote to memory of 2920 2316 autoformat.exe autoformat.exe PID 2920 wrote to memory of 360 2920 autoformat.exe autoformat.exe PID 2920 wrote to memory of 360 2920 autoformat.exe autoformat.exe PID 2920 wrote to memory of 360 2920 autoformat.exe autoformat.exe PID 2920 wrote to memory of 360 2920 autoformat.exe autoformat.exe PID 360 wrote to memory of 1996 360 autoformat.exe autoformat.exe PID 360 wrote to memory of 1996 360 autoformat.exe autoformat.exe PID 360 wrote to memory of 1996 360 autoformat.exe autoformat.exe PID 360 wrote to memory of 1996 360 autoformat.exe autoformat.exe PID 1996 wrote to memory of 2464 1996 autoformat.exe autoformat.exe PID 1996 wrote to memory of 2464 1996 autoformat.exe autoformat.exe PID 1996 wrote to memory of 2464 1996 autoformat.exe autoformat.exe PID 1996 wrote to memory of 2464 1996 autoformat.exe autoformat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Users\Admin\AppData\Local\Temp\f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe7⤵
- Executes dropped EXE
PID:2464
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\autoformat.exeFilesize
488KB
MD5f3ac5a3e525f30d153392d0ef6e85673
SHA14c4a336c0428ee12b71b1d02b4c6ac69cba1b754
SHA2566b50fdd2cc899f1cfe0b191c30ad8217514f52ca2fec5896ddbf5f9e1c6be43f
SHA5122290edd41ec4c8faab7ab0ceb97a0a2d59a7f0fbd5003759c439ebdc1abdda7a5528356077c1951b5b7a01ef4f46ea0c58dcf1b7ba4b384c35b6e24864d029c3
-
memory/360-85-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/360-80-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/360-81-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/360-79-0x0000000000270000-0x00000000002BB000-memory.dmpFilesize
300KB
-
memory/360-77-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/360-75-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/360-86-0x0000000000270000-0x00000000002BB000-memory.dmpFilesize
300KB
-
memory/360-76-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/360-74-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/360-73-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/360-71-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/360-72-0x0000000000270000-0x00000000002BB000-memory.dmpFilesize
300KB
-
memory/1976-5-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/1976-3-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/1976-14-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/1976-23-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/1976-24-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1976-11-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/1976-0-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/1976-12-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/1976-2-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1976-13-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/1976-4-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/1976-6-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/1976-7-0x0000000002880000-0x0000000002885000-memory.dmpFilesize
20KB
-
memory/1976-8-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/1976-9-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/1976-10-0x0000000002870000-0x0000000002872000-memory.dmpFilesize
8KB
-
memory/1976-1-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1996-99-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/1996-87-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/1996-88-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/1996-89-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/1996-90-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/1996-91-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/1996-92-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/1996-93-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/1996-94-0x0000000002080000-0x0000000002081000-memory.dmpFilesize
4KB
-
memory/1996-95-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/1996-96-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/1996-97-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/1996-105-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2116-25-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/2116-38-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2116-26-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2116-27-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2116-28-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/2116-29-0x0000000002080000-0x0000000002081000-memory.dmpFilesize
4KB
-
memory/2116-30-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/2116-31-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/2116-32-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/2116-34-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2316-43-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/2316-42-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/2316-52-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/2316-51-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/2316-50-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/2316-49-0x0000000000380000-0x00000000003CB000-memory.dmpFilesize
300KB
-
memory/2316-47-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2316-57-0x0000000000380000-0x00000000003CB000-memory.dmpFilesize
300KB
-
memory/2316-46-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/2316-45-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/2316-44-0x00000000028F0000-0x00000000029F0000-memory.dmpFilesize
1024KB
-
memory/2316-56-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2316-41-0x0000000000380000-0x00000000003CB000-memory.dmpFilesize
300KB
-
memory/2316-40-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2920-60-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/2920-67-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2920-58-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/2920-59-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/2920-69-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/2920-70-0x0000000002010000-0x0000000002011000-memory.dmpFilesize
4KB
-
memory/2920-63-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2920-62-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/2920-61-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB