Analysis

  • max time kernel
    144s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    23-06-2024 05:05

General

  • Target

    0541f52181897f5716033fee5b2eaf34_JaffaCakes118.exe

  • Size

    58KB

  • MD5

    0541f52181897f5716033fee5b2eaf34

  • SHA1

    b9e420ddb43e5e43cb92e9e299311988ff4dbc97

  • SHA256

    ad53990eca9fddf949020ae7a53e2549dc35a57a449a828eac33c0d563e16c38

  • SHA512

    0fc8a095c4e42e5d7769a7401d620270d13dca82980bec3eafc4e9dd49abcbb5597f74c9158f46b59a5c0c63718bc847d09f6133a63de8267554c99e731f81d9

  • SSDEEP

    768:oY0JV7zP9lGsSRAwxmkveRJrOvMBo2e4u1a9MeIaDh+Ef8YlgTgLEl2lojubvCnT:ozv7zCs4XgrH/iazvGT2l

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0541f52181897f5716033fee5b2eaf34_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0541f52181897f5716033fee5b2eaf34_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    PID:3028
  • C:\Windows\system\ting.exe
    "C:\Windows\system\ting.exe"
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system\ting.exe

    Filesize

    58KB

    MD5

    0541f52181897f5716033fee5b2eaf34

    SHA1

    b9e420ddb43e5e43cb92e9e299311988ff4dbc97

    SHA256

    ad53990eca9fddf949020ae7a53e2549dc35a57a449a828eac33c0d563e16c38

    SHA512

    0fc8a095c4e42e5d7769a7401d620270d13dca82980bec3eafc4e9dd49abcbb5597f74c9158f46b59a5c0c63718bc847d09f6133a63de8267554c99e731f81d9