Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 10:19
Static task
static1
Behavioral task
behavioral1
Sample
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe
-
Size
662KB
-
MD5
0517b0613e9bc016de8232847e25d92c
-
SHA1
8242dc29e7cf0dfcc003d516ea2519bb988f1331
-
SHA256
511c0e53d4d823a3a916eb3e7c777f1d4f9d38f0da43af7cdaeb878f5108ae65
-
SHA512
b7107640651dbd3c229f8f17c45c8b2cd3146748b0f956a5813240658fcae4cdfab20766f613be1e5cc3713958d124f7e8d4da6c92d58674b6868e66f343f07d
-
SSDEEP
12288:rqGZ8ncXHupt22tY433iuw12IFztImgZahByYw0GWFTsZtUYTj/wefpI:Cc3/43yuSWmC0UtZj/wAI
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SYSTMEM.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe %PROGRAMFILES%\\SYSTMEM.EXE" SYSTMEM.EXE -
Modifies security service 2 TTPs 1 IoCs
Processes:
SYSTMEM.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" SYSTMEM.EXE -
Processes:
SYSTMEM.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" SYSTMEM.EXE -
Disables RegEdit via registry modification 1 IoCs
Processes:
SYSTMEM.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SYSTMEM.EXE -
Disables Task Manager via registry modification
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exeSYSTMEM.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SYSTMEM.EXE -
Deletes itself 1 IoCs
Processes:
SYSTMEM.EXEpid process 2788 SYSTMEM.EXE -
Executes dropped EXE 1 IoCs
Processes:
SYSTMEM.EXEpid process 2788 SYSTMEM.EXE -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
SYSTMEM.EXE0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Wine SYSTMEM.EXE Key opened \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Wine 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
Processes:
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exepid process 2124 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe 2124 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe -
Processes:
SYSTMEM.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" SYSTMEM.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" SYSTMEM.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SYSTMEM.EXE = "C:\\Program Files (x86)\\\\SYSTMEM.EXE" 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe -
Drops file in Program Files directory 4 IoCs
Processes:
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exeSYSTMEM.EXEdescription ioc process File created C:\Program Files (x86)\SYSTMEM.EXE 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\SYSTMEM.EXE 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\SYSTMEM.EXE SYSTMEM.EXE File created C:\Program Files (x86)\SYSTMEM.EXE SYSTMEM.EXE -
Modifies data under HKEY_USERS 9 IoCs
Processes:
SYSTMEM.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT SYSTMEM.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SYSTMEM.EXE Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" SYSTMEM.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System SYSTMEM.EXE Key created \REGISTRY\USER\.DEFAULT\Software SYSTMEM.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft SYSTMEM.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows SYSTMEM.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion SYSTMEM.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies SYSTMEM.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
SYSTMEM.EXEpid process 2788 SYSTMEM.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SYSTMEM.EXEdescription pid process Token: SeDebugPrivilege 2788 SYSTMEM.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exedescription pid process target process PID 2124 wrote to memory of 2788 2124 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe SYSTMEM.EXE PID 2124 wrote to memory of 2788 2124 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe SYSTMEM.EXE PID 2124 wrote to memory of 2788 2124 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe SYSTMEM.EXE PID 2124 wrote to memory of 2788 2124 0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe SYSTMEM.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0517b0613e9bc016de8232847e25d92c_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SYSTMEM.EXE"C:\Program Files (x86)\\SYSTMEM.EXE"2⤵
- Modifies WinLogon for persistence
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
5Impair Defenses
2Disable or Modify Tools
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\SYSTMEM.EXEFilesize
662KB
MD50517b0613e9bc016de8232847e25d92c
SHA18242dc29e7cf0dfcc003d516ea2519bb988f1331
SHA256511c0e53d4d823a3a916eb3e7c777f1d4f9d38f0da43af7cdaeb878f5108ae65
SHA512b7107640651dbd3c229f8f17c45c8b2cd3146748b0f956a5813240658fcae4cdfab20766f613be1e5cc3713958d124f7e8d4da6c92d58674b6868e66f343f07d
-
memory/2124-16-0x0000000004850000-0x0000000004A34000-memory.dmpFilesize
1.9MB
-
memory/2124-1-0x0000000000401000-0x000000000040E000-memory.dmpFilesize
52KB
-
memory/2124-2-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2124-4-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2124-3-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2124-7-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2124-15-0x0000000004850000-0x0000000004A34000-memory.dmpFilesize
1.9MB
-
memory/2124-0-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-26-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-30-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-21-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-22-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-23-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-24-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-25-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-17-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-27-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-28-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-29-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-19-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-31-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-32-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-33-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-35-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-36-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-37-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-38-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-39-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-40-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-41-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-42-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB
-
memory/2788-43-0x0000000000400000-0x00000000005E4000-memory.dmpFilesize
1.9MB