Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-07-2024 00:24

General

  • Target

    273ae39e7e10a40aa1fb1f38caef167d_JaffaCakes118.exe

  • Size

    31KB

  • MD5

    273ae39e7e10a40aa1fb1f38caef167d

  • SHA1

    290d8f10e7d9065dccb7b41c4c0678c665161e7a

  • SHA256

    a1a1e7d238ccf05cc95937d3eca4921ce142ca8f1a7d9318e1da848eb18838b9

  • SHA512

    89500b29146965dc1969f2f16c9ba61a6fb31be0fccc7b9460c006177be4d40d156c6ae576ee54abef5a24a2341688371692ce9268591c0c70da764ea099f9b6

  • SSDEEP

    768:dDzS2Slqri8Tmqa2sF8S5l3vHXS55lfuMtC:xGDWsCil3/I5G

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\273ae39e7e10a40aa1fb1f38caef167d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\273ae39e7e10a40aa1fb1f38caef167d_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    PID:2384
  • C:\Windows\system\svchost.exe
    "C:\Windows\system\svchost.exe"
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System\svchost.exe

    Filesize

    31KB

    MD5

    273ae39e7e10a40aa1fb1f38caef167d

    SHA1

    290d8f10e7d9065dccb7b41c4c0678c665161e7a

    SHA256

    a1a1e7d238ccf05cc95937d3eca4921ce142ca8f1a7d9318e1da848eb18838b9

    SHA512

    89500b29146965dc1969f2f16c9ba61a6fb31be0fccc7b9460c006177be4d40d156c6ae576ee54abef5a24a2341688371692ce9268591c0c70da764ea099f9b6

  • memory/2384-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2384-5-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-11-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-13-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-8-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-9-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-10-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-6-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-12-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-7-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-14-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-15-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-16-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-17-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-18-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/3640-19-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB