Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 08:13
Behavioral task
behavioral1
Sample
27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe
-
Size
664KB
-
MD5
27dc6b3f41d7a3c0455f4147234be0e0
-
SHA1
d958d5f0d13a5175a66645a34843423e7f5e4ece
-
SHA256
c7caa041ca930baf0cb3ef335b78c9e8f974a70ed0467d02d8d0123b75a3da30
-
SHA512
9acb8e19586db457ce04fb560827fccec68390f609899367b963fc43308914d42e93ee1f92c265c4a1999b92f05d90b1044b2d9bde509fc235c33fd376121ca4
-
SSDEEP
12288:BHnW5AirU08MxpsuiA3dV9YsDXBQ0gV7InWLapR0YwWMjiQBOe6+:5nW5rlvxAM/DRQ0O7In0wR0YAjJBO7+
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 10 IoCs
pid Process 2748 iexplarer .exe 2200 iexplarer .exe 1352 iexplarer .exe 2244 iexplarer .exe 864 iexplarer .exe 2152 iexplarer .exe 2456 iexplarer .exe 2720 iexplarer .exe 2620 iexplarer .exe 1988 iexplarer .exe -
Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine iexplarer .exe -
Loads dropped DLL 20 IoCs
pid Process 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 2748 iexplarer .exe 2748 iexplarer .exe 2200 iexplarer .exe 2200 iexplarer .exe 1352 iexplarer .exe 1352 iexplarer .exe 2244 iexplarer .exe 2244 iexplarer .exe 864 iexplarer .exe 864 iexplarer .exe 2152 iexplarer .exe 2152 iexplarer .exe 2456 iexplarer .exe 2456 iexplarer .exe 2720 iexplarer .exe 2720 iexplarer .exe 2620 iexplarer .exe 2620 iexplarer .exe -
resource yara_rule behavioral1/memory/2056-0-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2056-3-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2056-4-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2056-5-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/files/0x000a000000012029-15.dat themida behavioral1/memory/2748-18-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2056-16-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2748-23-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2748-21-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2748-24-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2748-25-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2748-28-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2200-32-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2200-35-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2200-34-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2200-36-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2200-40-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/1352-42-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/1352-45-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/1352-46-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/1352-47-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/1352-51-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2244-54-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2244-56-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2244-59-0x0000000005040000-0x000000000525B000-memory.dmp themida behavioral1/memory/864-61-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2244-62-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/864-63-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2152-67-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/864-69-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2152-70-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2456-74-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2152-76-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2456-77-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2720-81-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2456-83-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2720-84-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2720-88-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2620-89-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/1988-93-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/2620-95-0x0000000000400000-0x000000000061B000-memory.dmp themida behavioral1/memory/1988-96-0x0000000000400000-0x000000000061B000-memory.dmp themida -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File created C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe File opened for modification C:\Windows\SysWOW64\iexplarer .exe iexplarer .exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
pid Process 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 2748 iexplarer .exe 2200 iexplarer .exe 1352 iexplarer .exe 2244 iexplarer .exe 864 iexplarer .exe 2152 iexplarer .exe 2456 iexplarer .exe 2720 iexplarer .exe 2620 iexplarer .exe 1988 iexplarer .exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 2748 iexplarer .exe 2200 iexplarer .exe 1352 iexplarer .exe 2244 iexplarer .exe 864 iexplarer .exe 2152 iexplarer .exe 2456 iexplarer .exe 2720 iexplarer .exe 2620 iexplarer .exe 1988 iexplarer .exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2748 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 30 PID 2056 wrote to memory of 2748 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 30 PID 2056 wrote to memory of 2748 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 30 PID 2056 wrote to memory of 2748 2056 27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe 30 PID 2748 wrote to memory of 2200 2748 iexplarer .exe 32 PID 2748 wrote to memory of 2200 2748 iexplarer .exe 32 PID 2748 wrote to memory of 2200 2748 iexplarer .exe 32 PID 2748 wrote to memory of 2200 2748 iexplarer .exe 32 PID 2200 wrote to memory of 1352 2200 iexplarer .exe 33 PID 2200 wrote to memory of 1352 2200 iexplarer .exe 33 PID 2200 wrote to memory of 1352 2200 iexplarer .exe 33 PID 2200 wrote to memory of 1352 2200 iexplarer .exe 33 PID 1352 wrote to memory of 2244 1352 iexplarer .exe 34 PID 1352 wrote to memory of 2244 1352 iexplarer .exe 34 PID 1352 wrote to memory of 2244 1352 iexplarer .exe 34 PID 1352 wrote to memory of 2244 1352 iexplarer .exe 34 PID 2244 wrote to memory of 864 2244 iexplarer .exe 35 PID 2244 wrote to memory of 864 2244 iexplarer .exe 35 PID 2244 wrote to memory of 864 2244 iexplarer .exe 35 PID 2244 wrote to memory of 864 2244 iexplarer .exe 35 PID 864 wrote to memory of 2152 864 iexplarer .exe 36 PID 864 wrote to memory of 2152 864 iexplarer .exe 36 PID 864 wrote to memory of 2152 864 iexplarer .exe 36 PID 864 wrote to memory of 2152 864 iexplarer .exe 36 PID 2152 wrote to memory of 2456 2152 iexplarer .exe 37 PID 2152 wrote to memory of 2456 2152 iexplarer .exe 37 PID 2152 wrote to memory of 2456 2152 iexplarer .exe 37 PID 2152 wrote to memory of 2456 2152 iexplarer .exe 37 PID 2456 wrote to memory of 2720 2456 iexplarer .exe 38 PID 2456 wrote to memory of 2720 2456 iexplarer .exe 38 PID 2456 wrote to memory of 2720 2456 iexplarer .exe 38 PID 2456 wrote to memory of 2720 2456 iexplarer .exe 38 PID 2720 wrote to memory of 2620 2720 iexplarer .exe 39 PID 2720 wrote to memory of 2620 2720 iexplarer .exe 39 PID 2720 wrote to memory of 2620 2720 iexplarer .exe 39 PID 2720 wrote to memory of 2620 2720 iexplarer .exe 39 PID 2620 wrote to memory of 1988 2620 iexplarer .exe 40 PID 2620 wrote to memory of 1988 2620 iexplarer .exe 40 PID 2620 wrote to memory of 1988 2620 iexplarer .exe 40 PID 2620 wrote to memory of 1988 2620 iexplarer .exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 664 "C:\Users\Admin\AppData\Local\Temp\27dc6b3f41d7a3c0455f4147234be0e0_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 692 "C:\Windows\SysWOW64\iexplarer .exe"3⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 700 "C:\Windows\SysWOW64\iexplarer .exe"4⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 696 "C:\Windows\SysWOW64\iexplarer .exe"5⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 712 "C:\Windows\SysWOW64\iexplarer .exe"6⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 708 "C:\Windows\SysWOW64\iexplarer .exe"7⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 716 "C:\Windows\SysWOW64\iexplarer .exe"8⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 704 "C:\Windows\SysWOW64\iexplarer .exe"9⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 724 "C:\Windows\SysWOW64\iexplarer .exe"10⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\iexplarer .exeC:\Windows\system32\iexplarer .exe 728 "C:\Windows\SysWOW64\iexplarer .exe"11⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD527dc6b3f41d7a3c0455f4147234be0e0
SHA1d958d5f0d13a5175a66645a34843423e7f5e4ece
SHA256c7caa041ca930baf0cb3ef335b78c9e8f974a70ed0467d02d8d0123b75a3da30
SHA5129acb8e19586db457ce04fb560827fccec68390f609899367b963fc43308914d42e93ee1f92c265c4a1999b92f05d90b1044b2d9bde509fc235c33fd376121ca4