Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 07:16
Static task
static1
Behavioral task
behavioral1
Sample
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe
-
Size
164KB
-
MD5
058524baa2ab984ae42e38bea409e19b
-
SHA1
615866bc6118eb416078a1ff21227c6aa103a9c2
-
SHA256
234a3979e6539ae7cb03d274bc7a24443f855b8fd5b56c6911b6889b6a3500c2
-
SHA512
6fcb594d8281c233517e550fddd57224add4a728e7571a77875577552dfa901e71dd100ce3a69c113b827aee6d7985bfb780a92bad722a4d9c21a520f380e26f
-
SSDEEP
3072:Pt74elV4KOH33pZWh1bsepg3JMIpu/AXyG/5iMCC1Wa:Fsid43PWvbDgAAjb13
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 3 TTPs 4 IoCs
Processes:
wmpdl32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdl32.exe = "C:\\Windows\\SysWOW64\\wmpdl32.exe:*:Enabled:Windows Data Launcher" wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpdl32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdl32.exe = "C:\\Windows\\SysWOW64\\wmpdl32.exe:*:Enabled:Windows Data Launcher" wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpdl32.exe -
Deletes itself 1 IoCs
Processes:
wmpdl32.exepid process 2620 wmpdl32.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpdl32.exewmpdl32.exepid process 2744 wmpdl32.exe 2620 wmpdl32.exe -
Loads dropped DLL 2 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exepid process 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2244-6-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2244-4-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2244-3-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2244-2-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2244-7-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2244-9-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2244-8-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2244-22-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2620-31-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2620-32-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2620-34-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2620-33-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2620-35-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2620-36-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2620-43-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wmpdl32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Data Launcher = "C:\\Windows\\SysWOW64\\wmpdl32.exe" wmpdl32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdl32.exe -
Drops file in System32 directory 4 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exedescription ioc process File created C:\Windows\SysWOW64\wmpdl32.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdl32.exe File opened for modification C:\Windows\SysWOW64\ 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpdl32.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exedescription pid process target process PID 2180 set thread context of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2744 set thread context of 2620 2744 wmpdl32.exe wmpdl32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exepid process 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 2620 wmpdl32.exe 2620 wmpdl32.exe 2620 wmpdl32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wmpdl32.exedescription pid process Token: SeDebugPrivilege 2620 wmpdl32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exewmpdl32.exedescription pid process target process PID 2180 wrote to memory of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2180 wrote to memory of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2180 wrote to memory of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2180 wrote to memory of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2180 wrote to memory of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2180 wrote to memory of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2180 wrote to memory of 2244 2180 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 2244 wrote to memory of 2744 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe wmpdl32.exe PID 2244 wrote to memory of 2744 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe wmpdl32.exe PID 2244 wrote to memory of 2744 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe wmpdl32.exe PID 2244 wrote to memory of 2744 2244 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe wmpdl32.exe PID 2744 wrote to memory of 2620 2744 wmpdl32.exe wmpdl32.exe PID 2744 wrote to memory of 2620 2744 wmpdl32.exe wmpdl32.exe PID 2744 wrote to memory of 2620 2744 wmpdl32.exe wmpdl32.exe PID 2744 wrote to memory of 2620 2744 wmpdl32.exe wmpdl32.exe PID 2744 wrote to memory of 2620 2744 wmpdl32.exe wmpdl32.exe PID 2744 wrote to memory of 2620 2744 wmpdl32.exe wmpdl32.exe PID 2744 wrote to memory of 2620 2744 wmpdl32.exe wmpdl32.exe PID 2620 wrote to memory of 1104 2620 wmpdl32.exe taskhost.exe PID 2620 wrote to memory of 1172 2620 wmpdl32.exe Dwm.exe PID 2620 wrote to memory of 1204 2620 wmpdl32.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\wmpdl32.exe"C:\Windows\SysWOW64\wmpdl32.exe" C:\Users\Admin\AppData\Local\Temp\058524~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\wmpdl32.exe"C:\Windows\SysWOW64\wmpdl32.exe" C:\Users\Admin\AppData\Local\Temp\058524~1.EXE5⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5058524baa2ab984ae42e38bea409e19b
SHA1615866bc6118eb416078a1ff21227c6aa103a9c2
SHA256234a3979e6539ae7cb03d274bc7a24443f855b8fd5b56c6911b6889b6a3500c2
SHA5126fcb594d8281c233517e550fddd57224add4a728e7571a77875577552dfa901e71dd100ce3a69c113b827aee6d7985bfb780a92bad722a4d9c21a520f380e26f