Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 12:13
Static task
static1
Behavioral task
behavioral1
Sample
f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe
-
Size
92KB
-
MD5
f7f7bb064a43b9f12e48ddf1da5844ab
-
SHA1
bb8779a3f2328b4c542630ecbdb830da3f32b8a8
-
SHA256
10d49d57039175208b2c0689f29328df23d5a39ef0ae021d70faf2bcb4037348
-
SHA512
fdeda9a4821effcc0dbf6d74b050e0bee07593aa1aa647625354ad14a8bd9bd827ca3f2ceefd6074bf56c4e4ac79cce323c2bb07f30172d780572946b75eb629
-
SSDEEP
1536:Y4m3M16T3xNKfvTcR8i8+QNDvCk849KyCmSwevSc:m3M16Th8fvTFkEvCkdU3wev/
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe" f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 1212 aadrive32.exe 2364 aadrive32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe" f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1600 set thread context of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 1212 set thread context of 2364 1212 aadrive32.exe 89 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\aadrive32.exe f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe File opened for modification C:\Windows\aadrive32.exe f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe File created C:\Windows\%windir%\lfffile32.log aadrive32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4256 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 4256 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 4256 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 4256 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1600 wrote to memory of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 1600 wrote to memory of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 1600 wrote to memory of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 1600 wrote to memory of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 1600 wrote to memory of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 1600 wrote to memory of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 1600 wrote to memory of 4256 1600 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 87 PID 4256 wrote to memory of 1212 4256 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 88 PID 4256 wrote to memory of 1212 4256 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 88 PID 4256 wrote to memory of 1212 4256 f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe 88 PID 1212 wrote to memory of 2364 1212 aadrive32.exe 89 PID 1212 wrote to memory of 2364 1212 aadrive32.exe 89 PID 1212 wrote to memory of 2364 1212 aadrive32.exe 89 PID 1212 wrote to memory of 2364 1212 aadrive32.exe 89 PID 1212 wrote to memory of 2364 1212 aadrive32.exe 89 PID 1212 wrote to memory of 2364 1212 aadrive32.exe 89 PID 1212 wrote to memory of 2364 1212 aadrive32.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f7f7bb064a43b9f12e48ddf1da5844ab_JaffaCakes118.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\aadrive32.exe"C:\Windows\aadrive32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\aadrive32.exeC:\Windows\aadrive32.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2364
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5f7f7bb064a43b9f12e48ddf1da5844ab
SHA1bb8779a3f2328b4c542630ecbdb830da3f32b8a8
SHA25610d49d57039175208b2c0689f29328df23d5a39ef0ae021d70faf2bcb4037348
SHA512fdeda9a4821effcc0dbf6d74b050e0bee07593aa1aa647625354ad14a8bd9bd827ca3f2ceefd6074bf56c4e4ac79cce323c2bb07f30172d780572946b75eb629