Analysis

  • max time kernel
    146s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 10:19

General

  • Target

    0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe

  • Size

    662KB

  • MD5

    0517b0613e9bc016de8232847e25d92c

  • SHA1

    8242dc29e7cf0dfcc003d516ea2519bb988f1331

  • SHA256

    511c0e53d4d823a3a916eb3e7c777f1d4f9d38f0da43af7cdaeb878f5108ae65

  • SHA512

    b7107640651dbd3c229f8f17c45c8b2cd3146748b0f956a5813240658fcae4cdfab20766f613be1e5cc3713958d124f7e8d4da6c92d58674b6868e66f343f07d

  • SSDEEP

    12288:rqGZ8ncXHupt22tY433iuw12IFztImgZahByYw0GWFTsZtUYTj/wefpI:Cc3/43yuSWmC0UtZj/wAI

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe"
    1⤵
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Program Files (x86)\SYSTMEM.EXE
      "C:\Program Files (x86)\\SYSTMEM.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Checks BIOS information in registry
      • Deletes itself
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Windows security modification
      • Drops file in Program Files directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2788

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

5
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Virtualization/Sandbox Evasion

1
T1497

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\SYSTMEM.EXE
    Filesize

    662KB

    MD5

    0517b0613e9bc016de8232847e25d92c

    SHA1

    8242dc29e7cf0dfcc003d516ea2519bb988f1331

    SHA256

    511c0e53d4d823a3a916eb3e7c777f1d4f9d38f0da43af7cdaeb878f5108ae65

    SHA512

    b7107640651dbd3c229f8f17c45c8b2cd3146748b0f956a5813240658fcae4cdfab20766f613be1e5cc3713958d124f7e8d4da6c92d58674b6868e66f343f07d

  • memory/2124-16-0x0000000004850000-0x0000000004A34000-memory.dmp
    Filesize

    1.9MB

  • memory/2124-1-0x0000000000401000-0x000000000040E000-memory.dmp
    Filesize

    52KB

  • memory/2124-2-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2124-4-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2124-3-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2124-7-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2124-15-0x0000000004850000-0x0000000004A34000-memory.dmp
    Filesize

    1.9MB

  • memory/2124-0-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-26-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-30-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-21-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-22-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-23-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-24-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-25-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-17-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-27-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-28-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-29-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-19-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-31-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-32-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-33-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-35-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-36-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-37-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-38-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-39-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-40-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-41-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-42-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB

  • memory/2788-43-0x0000000000400000-0x00000000005E4000-memory.dmp
    Filesize

    1.9MB