Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 14:49
Static task
static1
Behavioral task
behavioral1
Sample
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe
-
Size
300KB
-
MD5
f83ab9d63b5240615fc403229d04f83a
-
SHA1
5194a6f47a969678312e475aaa68c9623e7f6c26
-
SHA256
f8eec64a72e4b70f9756a58ac88552d57851089d5edd49a7a8e0c7c2f25d29fe
-
SHA512
ffae1f73dcb99951649fc5f6ba29274dc3e7ef34da310f98cd4e7a09a2582c551d1e2289bada3086982b01cda627da40bdf5b08db8952422d2e585b24e2240a7
-
SSDEEP
6144:SxzH46QfUP/MXM4tg6hIxmnMInq1ewM7EG7erjqNr3Q:i/h+9IxYnqC7gOrg
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mitnick2 = "C:\\WINDOWS\\system32\\microsoftNS.exe" f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
microsoftNS.exemicrosoftNS.exepid process 2652 microsoftNS.exe 1600 microsoftNS.exe -
Loads dropped DLL 3 IoCs
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exemicrosoftNS.exepid process 2768 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe 2768 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe 2652 microsoftNS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\billgates = "C:\\WINDOWS\\system32\\microsoftNS.exe" f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exemicrosoftNS.exedescription ioc process File opened for modification \??\PhysicalDrive0 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 microsoftNS.exe -
Drops file in System32 directory 4 IoCs
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exemicrosoftNS.exedescription ioc process File created C:\WINDOWS\SysWOW64\microsoftNS.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\microsoftNS.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\microsoftNS.exe microsoftNS.exe File created C:\WINDOWS\SysWOW64\microsoftNS.exe microsoftNS.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exemicrosoftNS.exedescription pid process target process PID 1728 set thread context of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 2652 set thread context of 1600 2652 microsoftNS.exe microsoftNS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exemicrosoftNS.exepid process 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe 2652 microsoftNS.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exef83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exemicrosoftNS.exedescription pid process target process PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 1728 wrote to memory of 2768 1728 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe PID 2768 wrote to memory of 2652 2768 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe microsoftNS.exe PID 2768 wrote to memory of 2652 2768 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe microsoftNS.exe PID 2768 wrote to memory of 2652 2768 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe microsoftNS.exe PID 2768 wrote to memory of 2652 2768 f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe PID 2652 wrote to memory of 1600 2652 microsoftNS.exe microsoftNS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f83ab9d63b5240615fc403229d04f83a_JaffaCakes118.exe" c:\users\admin\appdata\local\temp\Program.exe2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\SysWOW64\microsoftNS.exe"C:\WINDOWS\system32\microsoftNS.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\SysWOW64\microsoftNS.exe"C:\WINDOWS\SysWOW64\microsoftNS.exe" c:\users\admin\appdata\local\temp\Program.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\index.htmFilesize
1B
MD57215ee9c7d9dc229d2921a40e899ec5f
SHA1b858cb282617fb0956d960215c8e84d1ccf909c6
SHA25636a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
-
\Windows\SysWOW64\microsoftNS.exeFilesize
300KB
MD5f83ab9d63b5240615fc403229d04f83a
SHA15194a6f47a969678312e475aaa68c9623e7f6c26
SHA256f8eec64a72e4b70f9756a58ac88552d57851089d5edd49a7a8e0c7c2f25d29fe
SHA512ffae1f73dcb99951649fc5f6ba29274dc3e7ef34da310f98cd4e7a09a2582c551d1e2289bada3086982b01cda627da40bdf5b08db8952422d2e585b24e2240a7
-
memory/1600-80-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-75-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-81-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-68-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-79-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-78-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-64-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-77-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-76-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-82-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-67-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-74-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-73-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-83-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-72-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-71-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1600-66-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1728-0-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1728-9-0x0000000002570000-0x00000000025BB000-memory.dmpFilesize
300KB
-
memory/1728-21-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2652-65-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2652-36-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2652-50-0x0000000002A00000-0x0000000002A4B000-memory.dmpFilesize
300KB
-
memory/2768-23-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-35-0x0000000001ED0000-0x0000000001F1B000-memory.dmpFilesize
300KB
-
memory/2768-25-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-24-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-42-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-20-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2768-16-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-14-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-12-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/2768-10-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB