Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06-07-2024 00:24

General

  • Target

    273ae39e7e10a40aa1fb1f38caef167d_JaffaCakes118.exe

  • Size

    31KB

  • MD5

    273ae39e7e10a40aa1fb1f38caef167d

  • SHA1

    290d8f10e7d9065dccb7b41c4c0678c665161e7a

  • SHA256

    a1a1e7d238ccf05cc95937d3eca4921ce142ca8f1a7d9318e1da848eb18838b9

  • SHA512

    89500b29146965dc1969f2f16c9ba61a6fb31be0fccc7b9460c006177be4d40d156c6ae576ee54abef5a24a2341688371692ce9268591c0c70da764ea099f9b6

  • SSDEEP

    768:dDzS2Slqri8Tmqa2sF8S5l3vHXS55lfuMtC:xGDWsCil3/I5G

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\273ae39e7e10a40aa1fb1f38caef167d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\273ae39e7e10a40aa1fb1f38caef167d_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    PID:2156
  • C:\Windows\system\svchost.exe
    "C:\Windows\system\svchost.exe"
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of FindShellTrayWindow
    PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system\svchost.exe

    Filesize

    31KB

    MD5

    273ae39e7e10a40aa1fb1f38caef167d

    SHA1

    290d8f10e7d9065dccb7b41c4c0678c665161e7a

    SHA256

    a1a1e7d238ccf05cc95937d3eca4921ce142ca8f1a7d9318e1da848eb18838b9

    SHA512

    89500b29146965dc1969f2f16c9ba61a6fb31be0fccc7b9460c006177be4d40d156c6ae576ee54abef5a24a2341688371692ce9268591c0c70da764ea099f9b6

  • memory/2156-5-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2156-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-11-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-13-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-8-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-9-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-10-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-4-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-12-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-7-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-14-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-15-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-16-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-17-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-18-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-19-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2540-20-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB