Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 15:14
Static task
static1
Behavioral task
behavioral1
Sample
f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe
-
Size
523KB
-
MD5
f84639b1a82e588933fefaf668225dfc
-
SHA1
e74f65e5b1a461f4cf785f2de51f2b55da19ea07
-
SHA256
cc355b38337412c3e3c0269dcd4c9211fd3d89893479380143a9e135be445cbb
-
SHA512
fa598f258f0c85bca7f1ded374798f1a47612e2ad5c7647f978f06e1a8a4ccebc9e4d9ee02807c33a9abe3d2fc51bd30fc9708a9757c466e9bf6eb9bb034fd9b
-
SSDEEP
12288:IuQR86TZUJgushyTe3Chl9rxdk0ERno19p2N5188AUmxpXu3TdYZZZZZZZ:IuQfTZUJgushh3Cn9ldUY9Qr18TxETOB
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 10 IoCs
pid Process 2488 csrs.exe 2464 csrs.exe 620 csrs.exe 2344 csrs.exe 2832 csrs.exe 2672 csrs.exe 1224 csrs.exe 1512 csrs.exe 560 csrs.exe 2820 csrs.exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine csrs.exe -
Loads dropped DLL 20 IoCs
pid Process 2132 f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe 2132 f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe 2488 csrs.exe 2488 csrs.exe 2464 csrs.exe 2464 csrs.exe 620 csrs.exe 620 csrs.exe 2344 csrs.exe 2344 csrs.exe 2832 csrs.exe 2832 csrs.exe 2672 csrs.exe 2672 csrs.exe 1224 csrs.exe 1224 csrs.exe 1512 csrs.exe 1512 csrs.exe 560 csrs.exe 560 csrs.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\csrs.exe f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe File opened for modification C:\Windows\SysWOW64\csrs.exe csrs.exe File created C:\Windows\SysWOW64\csrs.exe csrs.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2488 2132 f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe 28 PID 2132 wrote to memory of 2488 2132 f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe 28 PID 2132 wrote to memory of 2488 2132 f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe 28 PID 2132 wrote to memory of 2488 2132 f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe 28 PID 2488 wrote to memory of 2464 2488 csrs.exe 29 PID 2488 wrote to memory of 2464 2488 csrs.exe 29 PID 2488 wrote to memory of 2464 2488 csrs.exe 29 PID 2488 wrote to memory of 2464 2488 csrs.exe 29 PID 2464 wrote to memory of 620 2464 csrs.exe 30 PID 2464 wrote to memory of 620 2464 csrs.exe 30 PID 2464 wrote to memory of 620 2464 csrs.exe 30 PID 2464 wrote to memory of 620 2464 csrs.exe 30 PID 620 wrote to memory of 2344 620 csrs.exe 31 PID 620 wrote to memory of 2344 620 csrs.exe 31 PID 620 wrote to memory of 2344 620 csrs.exe 31 PID 620 wrote to memory of 2344 620 csrs.exe 31 PID 2344 wrote to memory of 2832 2344 csrs.exe 34 PID 2344 wrote to memory of 2832 2344 csrs.exe 34 PID 2344 wrote to memory of 2832 2344 csrs.exe 34 PID 2344 wrote to memory of 2832 2344 csrs.exe 34 PID 2832 wrote to memory of 2672 2832 csrs.exe 35 PID 2832 wrote to memory of 2672 2832 csrs.exe 35 PID 2832 wrote to memory of 2672 2832 csrs.exe 35 PID 2832 wrote to memory of 2672 2832 csrs.exe 35 PID 2672 wrote to memory of 1224 2672 csrs.exe 36 PID 2672 wrote to memory of 1224 2672 csrs.exe 36 PID 2672 wrote to memory of 1224 2672 csrs.exe 36 PID 2672 wrote to memory of 1224 2672 csrs.exe 36 PID 1224 wrote to memory of 1512 1224 csrs.exe 37 PID 1224 wrote to memory of 1512 1224 csrs.exe 37 PID 1224 wrote to memory of 1512 1224 csrs.exe 37 PID 1224 wrote to memory of 1512 1224 csrs.exe 37 PID 1512 wrote to memory of 560 1512 csrs.exe 38 PID 1512 wrote to memory of 560 1512 csrs.exe 38 PID 1512 wrote to memory of 560 1512 csrs.exe 38 PID 1512 wrote to memory of 560 1512 csrs.exe 38 PID 560 wrote to memory of 2820 560 csrs.exe 39 PID 560 wrote to memory of 2820 560 csrs.exe 39 PID 560 wrote to memory of 2820 560 csrs.exe 39 PID 560 wrote to memory of 2820 560 csrs.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 636 "C:\Users\Admin\AppData\Local\Temp\f84639b1a82e588933fefaf668225dfc_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 692 "C:\Windows\SysWOW64\csrs.exe"3⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 688 "C:\Windows\SysWOW64\csrs.exe"4⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 704 "C:\Windows\SysWOW64\csrs.exe"5⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 708 "C:\Windows\SysWOW64\csrs.exe"6⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 684 "C:\Windows\SysWOW64\csrs.exe"7⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 700 "C:\Windows\SysWOW64\csrs.exe"8⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 712 "C:\Windows\SysWOW64\csrs.exe"9⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 720 "C:\Windows\SysWOW64\csrs.exe"10⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\csrs.exeC:\Windows\system32\csrs.exe 716 "C:\Windows\SysWOW64\csrs.exe"11⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in System32 directory
PID:2820
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
523KB
MD5f84639b1a82e588933fefaf668225dfc
SHA1e74f65e5b1a461f4cf785f2de51f2b55da19ea07
SHA256cc355b38337412c3e3c0269dcd4c9211fd3d89893479380143a9e135be445cbb
SHA512fa598f258f0c85bca7f1ded374798f1a47612e2ad5c7647f978f06e1a8a4ccebc9e4d9ee02807c33a9abe3d2fc51bd30fc9708a9757c466e9bf6eb9bb034fd9b