Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe
-
Size
488KB
-
MD5
f3ac5a3e525f30d153392d0ef6e85673
-
SHA1
4c4a336c0428ee12b71b1d02b4c6ac69cba1b754
-
SHA256
6b50fdd2cc899f1cfe0b191c30ad8217514f52ca2fec5896ddbf5f9e1c6be43f
-
SHA512
2290edd41ec4c8faab7ab0ceb97a0a2d59a7f0fbd5003759c439ebdc1abdda7a5528356077c1951b5b7a01ef4f46ea0c58dcf1b7ba4b384c35b6e24864d029c3
-
SSDEEP
12288:7ReCXbFcHAc9r5pmcrIW+61dTdxGmnOY/6:48FSJDm7fMdTH75/6
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 6 IoCs
Processes:
autoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exepid process 2164 autoformat.exe 3956 autoformat.exe 4752 autoformat.exe 4584 autoformat.exe 1284 autoformat.exe 4352 autoformat.exe -
Drops file in System32 directory 6 IoCs
Processes:
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exedescription ioc process File opened for modification C:\Windows\SysWOW64\autoformat.exe f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe autoformat.exe File created C:\Windows\SysWOW64\autoformat.exe f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exepid process 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 2164 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4752 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 4584 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe 1284 autoformat.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exeautoformat.exeautoformat.exeautoformat.exeautoformat.exedescription pid process target process PID 5080 wrote to memory of 2164 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe autoformat.exe PID 5080 wrote to memory of 2164 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe autoformat.exe PID 5080 wrote to memory of 2164 5080 f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe autoformat.exe PID 2164 wrote to memory of 3956 2164 autoformat.exe autoformat.exe PID 2164 wrote to memory of 3956 2164 autoformat.exe autoformat.exe PID 2164 wrote to memory of 3956 2164 autoformat.exe autoformat.exe PID 4752 wrote to memory of 4584 4752 autoformat.exe autoformat.exe PID 4752 wrote to memory of 4584 4752 autoformat.exe autoformat.exe PID 4752 wrote to memory of 4584 4752 autoformat.exe autoformat.exe PID 4584 wrote to memory of 1284 4584 autoformat.exe autoformat.exe PID 4584 wrote to memory of 1284 4584 autoformat.exe autoformat.exe PID 4584 wrote to memory of 1284 4584 autoformat.exe autoformat.exe PID 1284 wrote to memory of 4352 1284 autoformat.exe autoformat.exe PID 1284 wrote to memory of 4352 1284 autoformat.exe autoformat.exe PID 1284 wrote to memory of 4352 1284 autoformat.exe autoformat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Users\Admin\AppData\Local\Temp\f3ac5a3e525f30d153392d0ef6e85673_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe3⤵
- Executes dropped EXE
PID:3956 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\autoformat.exeC:\Windows\system32\autoformat.exe -bai C:\Windows\SysWOW64\autoformat.exe7⤵
- Executes dropped EXE
PID:4352
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\autoformat.exeFilesize
488KB
MD5f3ac5a3e525f30d153392d0ef6e85673
SHA14c4a336c0428ee12b71b1d02b4c6ac69cba1b754
SHA2566b50fdd2cc899f1cfe0b191c30ad8217514f52ca2fec5896ddbf5f9e1c6be43f
SHA5122290edd41ec4c8faab7ab0ceb97a0a2d59a7f0fbd5003759c439ebdc1abdda7a5528356077c1951b5b7a01ef4f46ea0c58dcf1b7ba4b384c35b6e24864d029c3
-
memory/1284-1164-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/1284-1156-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2164-481-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/2164-490-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/3956-491-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/3956-494-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/4584-938-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/4584-931-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/4752-711-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/4752-703-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/5080-33-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-39-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-8-0x0000000002560000-0x0000000002561000-memory.dmpFilesize
4KB
-
memory/5080-9-0x0000000002520000-0x0000000002521000-memory.dmpFilesize
4KB
-
memory/5080-10-0x0000000002A90000-0x0000000002A92000-memory.dmpFilesize
8KB
-
memory/5080-11-0x0000000002B10000-0x0000000002B2B000-memory.dmpFilesize
108KB
-
memory/5080-12-0x0000000002B10000-0x0000000002B2B000-memory.dmpFilesize
108KB
-
memory/5080-13-0x0000000002B10000-0x0000000002B2B000-memory.dmpFilesize
108KB
-
memory/5080-14-0x0000000002B10000-0x0000000002B2B000-memory.dmpFilesize
108KB
-
memory/5080-15-0x0000000002AF0000-0x0000000002AF1000-memory.dmpFilesize
4KB
-
memory/5080-16-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-17-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-18-0x0000000002B00000-0x0000000002B01000-memory.dmpFilesize
4KB
-
memory/5080-19-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-20-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-21-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-22-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-23-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-24-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-25-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-26-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-27-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-28-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-30-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/5080-29-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/5080-31-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/5080-32-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/5080-6-0x0000000002530000-0x0000000002531000-memory.dmpFilesize
4KB
-
memory/5080-34-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-35-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-36-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-37-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-38-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-7-0x0000000002AA0000-0x0000000002AA5000-memory.dmpFilesize
20KB
-
memory/5080-40-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-41-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-42-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-43-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-44-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-45-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-46-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-47-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-48-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-49-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-50-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-51-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-52-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-53-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-54-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-55-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-56-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-57-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-58-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-59-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-60-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-5-0x0000000002590000-0x0000000002591000-memory.dmpFilesize
4KB
-
memory/5080-4-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/5080-3-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/5080-2-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/5080-1-0x0000000002370000-0x00000000023BB000-memory.dmpFilesize
300KB
-
memory/5080-0-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB
-
memory/5080-61-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-62-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-63-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/5080-237-0x0000000000400000-0x000000000058A000-memory.dmpFilesize
1.5MB