Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 17:44

General

  • Target

    fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe

  • Size

    121KB

  • MD5

    fd47f7fac3ec650eae715795086bc6d7

  • SHA1

    33817ba286395cec76a64f24ee3d6392ac448591

  • SHA256

    289b9b7e2bd6678218e33d77c6464d2c5c5807f99d6e7e4037ba87b98530e274

  • SHA512

    2074b6cbf166bd1999917d895a7c7f24ac339e02790d922bc028a5ac1fe49a155aed6c78a469914403be3211c950ec3c926d6f248b9787ee00c9dc36a4df7fad

  • SSDEEP

    768:fjXEU8CPfbgDI2yDv5iKakaRLpWvry0j4zLRahqPLpnfFSdxwhl:jeDgkKapRI8Ex

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fd47f7fac3ec650eae715795086bc6d7_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\ghdrive32.exe
        "C:\Windows\ghdrive32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Windows\ghdrive32.exe
          "C:\Windows\ghdrive32.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\ghdrive32.exe

    Filesize

    121KB

    MD5

    fd47f7fac3ec650eae715795086bc6d7

    SHA1

    33817ba286395cec76a64f24ee3d6392ac448591

    SHA256

    289b9b7e2bd6678218e33d77c6464d2c5c5807f99d6e7e4037ba87b98530e274

    SHA512

    2074b6cbf166bd1999917d895a7c7f24ac339e02790d922bc028a5ac1fe49a155aed6c78a469914403be3211c950ec3c926d6f248b9787ee00c9dc36a4df7fad

  • memory/2708-1-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2708-4-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2708-5-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/3716-0-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3716-2-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/4204-21-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-27-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-19-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-20-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-32-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-22-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-23-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-24-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-25-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-26-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-16-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-28-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-29-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-30-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4204-31-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4504-14-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB