Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 17:44
Static task
static1
Behavioral task
behavioral1
Sample
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe
-
Size
121KB
-
MD5
fd47f7fac3ec650eae715795086bc6d7
-
SHA1
33817ba286395cec76a64f24ee3d6392ac448591
-
SHA256
289b9b7e2bd6678218e33d77c6464d2c5c5807f99d6e7e4037ba87b98530e274
-
SHA512
2074b6cbf166bd1999917d895a7c7f24ac339e02790d922bc028a5ac1fe49a155aed6c78a469914403be3211c950ec3c926d6f248b9787ee00c9dc36a4df7fad
-
SSDEEP
768:fjXEU8CPfbgDI2yDv5iKakaRLpWvry0j4zLRahqPLpnfFSdxwhl:jeDgkKapRI8Ex
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\ghdrive32.exe" fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
ghdrive32.exeghdrive32.exepid process 4504 ghdrive32.exe 4204 ghdrive32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\ghdrive32.exe" fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exeghdrive32.exedescription pid process target process PID 3716 set thread context of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 4504 set thread context of 4204 4504 ghdrive32.exe ghdrive32.exe -
Drops file in Windows directory 3 IoCs
Processes:
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exeghdrive32.exedescription ioc process File created C:\Windows\ghdrive32.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe File opened for modification C:\Windows\ghdrive32.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe File created C:\Windows\%windir%\lfffile32.log ghdrive32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exepid process 2708 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe 2708 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe 2708 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe 2708 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exefd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exeghdrive32.exedescription pid process target process PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 3716 wrote to memory of 2708 3716 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe PID 2708 wrote to memory of 4504 2708 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe ghdrive32.exe PID 2708 wrote to memory of 4504 2708 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe ghdrive32.exe PID 2708 wrote to memory of 4504 2708 fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe PID 4504 wrote to memory of 4204 4504 ghdrive32.exe ghdrive32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\ghdrive32.exe"C:\Windows\ghdrive32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\ghdrive32.exe"C:\Windows\ghdrive32.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4204
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD5fd47f7fac3ec650eae715795086bc6d7
SHA133817ba286395cec76a64f24ee3d6392ac448591
SHA256289b9b7e2bd6678218e33d77c6464d2c5c5807f99d6e7e4037ba87b98530e274
SHA5122074b6cbf166bd1999917d895a7c7f24ac339e02790d922bc028a5ac1fe49a155aed6c78a469914403be3211c950ec3c926d6f248b9787ee00c9dc36a4df7fad