Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 10:49

General

  • Target

    054bca9b3135d12ce00c4575a94c7c07_JaffaCakes118.exe

  • Size

    256KB

  • MD5

    054bca9b3135d12ce00c4575a94c7c07

  • SHA1

    4c2215ffa79dab32b6e90aa13a7f94b103cda32f

  • SHA256

    96c37b8dd61b1c3d6cd8fa04c6bf2e4d806d4a02bcb31d19f4133632dffe34c2

  • SHA512

    ee63a89d6610352ea508b5cbcb9edb4d7e189a9717b3afc3608f816e94a13eae5006c79c7281f8679f234c56d3d9a0f3112fb8e600612cf8f4610d90adccf9c0

  • SSDEEP

    6144:NtmdbOsHCU8TCOXlUS9f6mLTjr58l88oKtJ+w3Uff2diRj:/ISsHCU8T5f9imLndx8bJ+eUfuO

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies firewall policy service 3 TTPs 4 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\054bca9b3135d12ce00c4575a94c7c07_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\054bca9b3135d12ce00c4575a94c7c07_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Users\Admin\AppData\Local\Temp\054bca9b3135d12ce00c4575a94c7c07_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\054bca9b3135d12ce00c4575a94c7c07_JaffaCakes118.exe"
          3⤵
          • Loads dropped DLL
          • Maps connected drives based on registry
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2220
          • C:\Windows\SysWOW64\wmpdk86.exe
            "C:\Windows\SysWOW64\wmpdk86.exe" C:\Users\Admin\AppData\Local\Temp\054BCA~1.EXE
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2296
            • C:\Windows\SysWOW64\wmpdk86.exe
              "C:\Windows\SysWOW64\wmpdk86.exe" C:\Users\Admin\AppData\Local\Temp\054BCA~1.EXE
              5⤵
              • Modifies firewall policy service
              • Deletes itself
              • Executes dropped EXE
              • Adds Run key to start application
              • Maps connected drives based on registry
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2692

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Impair Defenses

    1
    T1562

    Disable or Modify System Firewall

    1
    T1562.004

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\SysWOW64\wmpdk86.exe
      Filesize

      256KB

      MD5

      054bca9b3135d12ce00c4575a94c7c07

      SHA1

      4c2215ffa79dab32b6e90aa13a7f94b103cda32f

      SHA256

      96c37b8dd61b1c3d6cd8fa04c6bf2e4d806d4a02bcb31d19f4133632dffe34c2

      SHA512

      ee63a89d6610352ea508b5cbcb9edb4d7e189a9717b3afc3608f816e94a13eae5006c79c7281f8679f234c56d3d9a0f3112fb8e600612cf8f4610d90adccf9c0

    • memory/1216-40-0x0000000002160000-0x0000000002161000-memory.dmp
      Filesize

      4KB

    • memory/1216-38-0x0000000002140000-0x000000000215E000-memory.dmp
      Filesize

      120KB

    • memory/2220-5-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2220-33-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2220-4-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2220-2-0x0000000000432000-0x000000000044B000-memory.dmp
      Filesize

      100KB

    • memory/2220-0-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2220-7-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2220-9-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2220-10-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2220-32-0x0000000000400000-0x0000000000448000-memory.dmp
      Filesize

      288KB

    • memory/2220-8-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2692-37-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2692-36-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2692-24-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB

    • memory/2692-41-0x0000000000400000-0x000000000044C000-memory.dmp
      Filesize

      304KB