Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2024 22:27

General

  • Target

    0423fc7135f0b7ac671d03ad09a69b26_JaffaCakes118.exe

  • Size

    691KB

  • MD5

    0423fc7135f0b7ac671d03ad09a69b26

  • SHA1

    9762188fa1d59e9dadc551c415991e4acbf59c5f

  • SHA256

    334e56e333eaebbe621bbf0184fd45de0bf3ba3ab667f4086a5d993c03c2ec0e

  • SHA512

    0f490edf575612d0ded1c4d58f22084e701780a291de5af1214edf6d7f515ef3df21ae5909883172536d887ab9db66146526ed7e2682067408017021e592827c

  • SSDEEP

    12288:sCx1kJpmp7HMYjTcvWVez4zqDvYRIQnIfHjAXd5eqBFtJTcXPca0amUVRFtSn9ou:FKJpu7sJHA4g1IrAN5htJg/zfFIn9b

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Gathers network information 2 TTPs 21 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0423fc7135f0b7ac671d03ad09a69b26_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0423fc7135f0b7ac671d03ad09a69b26_JaffaCakes118.exe"
    1⤵
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2884
  • C:\Windows\system\wmibusn.exe
    "C:\Windows\system\wmibusn.exe"
    1⤵
    • Drops file in Drivers directory
    • Deletes itself
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2396
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1136
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2660
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1600
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2912
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1436
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2244
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:828
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:3060
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2364
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1560
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:612
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1884
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1700
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1180
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:840
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1728
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2900
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2964
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:2148
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      2⤵
      • Gathers network information
      PID:1172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system\wmibusn.exe

    Filesize

    691KB

    MD5

    0423fc7135f0b7ac671d03ad09a69b26

    SHA1

    9762188fa1d59e9dadc551c415991e4acbf59c5f

    SHA256

    334e56e333eaebbe621bbf0184fd45de0bf3ba3ab667f4086a5d993c03c2ec0e

    SHA512

    0f490edf575612d0ded1c4d58f22084e701780a291de5af1214edf6d7f515ef3df21ae5909883172536d887ab9db66146526ed7e2682067408017021e592827c

  • memory/2692-21-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-13-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-38-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-22-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-37-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-36-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-9-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-23-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-35-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-11-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-14-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-16-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-18-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-24-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-20-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-34-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-33-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-32-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-19-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-25-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-26-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-27-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-28-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-29-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-30-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2692-31-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-3-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-4-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-0-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-12-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-2-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-7-0x0000000000400000-0x00000000005CA000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-1-0x0000000000401000-0x0000000000409000-memory.dmp

    Filesize

    32KB