Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-04-2024 01:39

General

  • Target

    f938fc9db448a786e0f335b08d3e49b3_JaffaCakes118.exe

  • Size

    5.6MB

  • MD5

    f938fc9db448a786e0f335b08d3e49b3

  • SHA1

    6c43310964cf66c3122673899164022ff25df508

  • SHA256

    36f73e1b174faf36802edbb9cb999a566112fc61aada6a393788593048b7a7a3

  • SHA512

    44ad069dfb8c9e646c75ba76439e6d15d33d3f548dccb5d5f14e52f545ab196c4c3ba5f46d4c88158b3abc1cc30d59ff5db6467b142ea975171a7894146abb90

  • SSDEEP

    98304:aGdUKip5Wn9VvFeHmi/jmANuvqKmGlSuftdcNSWJVMg2YRW+P2KEkUeQ:ldi3WZi7MqKmGwu1yNSWnV2IW5dJ

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f938fc9db448a786e0f335b08d3e49b3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f938fc9db448a786e0f335b08d3e49b3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\Internet Download Manager installer\6, 11, 7, 1\1435.12.09T20.36\Virtual\STUBEXE\8.0.1112\@APPDATALOCAL@\Temp\Download_Manager1.exe
      "C:\Users\Admin\AppData\Local\Temp\Download_Manager1.exe"
      2⤵
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of AdjustPrivilegeToken
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Xenocode\Sandbox\Internet Download Manager installer\6, 11, 7, 1\1435.12.09T20.36\Virtual\STUBEXE\8.0.1112\@APPDATALOCAL@\Temp\Download_Manager1.exe

    Filesize

    17KB

    MD5

    8306f3109ad8ffe3cdb2729182d28824

    SHA1

    ebc35a31509b54f0a5538b149a2c2520beb644a7

    SHA256

    8082a7a74ad4d1c1e18a4d5e18e095d1a5ae5d95502cbfb221965f06ef1be2a1

    SHA512

    a7c46a96c059b1e03d4cbdaed25ec7d7388c0feb98ec2defb06ee023a0b9888a83210e3900e36bfa2312b6f96057bb575642559a2cc2babd93c4d281862a92c4

  • memory/2240-21-0x0000000000650000-0x00000000006C2000-memory.dmp

    Filesize

    456KB

  • memory/2240-1-0x0000000000650000-0x00000000006C2000-memory.dmp

    Filesize

    456KB

  • memory/2240-0-0x0000000010000000-0x0000000010037000-memory.dmp

    Filesize

    220KB

  • memory/2240-5-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2240-4-0x0000000010000000-0x0000000010037000-memory.dmp

    Filesize

    220KB

  • memory/2240-6-0x0000000010000000-0x0000000010037000-memory.dmp

    Filesize

    220KB

  • memory/2240-7-0x0000000010000000-0x0000000010037000-memory.dmp

    Filesize

    220KB

  • memory/2240-8-0x0000000000650000-0x00000000006C2000-memory.dmp

    Filesize

    456KB

  • memory/2240-9-0x0000000000650000-0x00000000006C2000-memory.dmp

    Filesize

    456KB

  • memory/2240-2-0x0000000010000000-0x0000000010037000-memory.dmp

    Filesize

    220KB

  • memory/2240-11-0x00000000047E0000-0x0000000004938000-memory.dmp

    Filesize

    1.3MB

  • memory/2240-12-0x00000000047E0000-0x0000000004938000-memory.dmp

    Filesize

    1.3MB

  • memory/2240-90-0x0000000000650000-0x00000000006C2000-memory.dmp

    Filesize

    456KB

  • memory/2240-3-0x0000000077440000-0x0000000077441000-memory.dmp

    Filesize

    4KB

  • memory/2680-59-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-52-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-15-0x0000000077440000-0x0000000077441000-memory.dmp

    Filesize

    4KB

  • memory/2680-19-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-88-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-17-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2680-16-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-23-0x0000000000370000-0x00000000003E2000-memory.dmp

    Filesize

    456KB

  • memory/2680-47-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-48-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-49-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-50-0x0000000000370000-0x00000000003E2000-memory.dmp

    Filesize

    456KB

  • memory/2680-51-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-18-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-53-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-54-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-55-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-57-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-58-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-22-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-60-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-61-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-64-0x0000000000370000-0x00000000003E2000-memory.dmp

    Filesize

    456KB

  • memory/2680-20-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/2680-14-0x0000000000370000-0x00000000003E2000-memory.dmp

    Filesize

    456KB