Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
2845f330dde45ee528384e37f4826885_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2845f330dde45ee528384e37f4826885_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2845f330dde45ee528384e37f4826885_JaffaCakes118.exe
-
Size
250KB
-
MD5
2845f330dde45ee528384e37f4826885
-
SHA1
5d6aa18e6af5cd5a02048802f0345b54ba7fe250
-
SHA256
d38cfc73f632ad49cd23775b6030f4744ab5b485f7591b468553a0d21fa60d2d
-
SHA512
4e91596b66e43acd7b5ded1f5c0727b06e87975c6a35d84bb6cae220e60f90eff83074dba6d8c1cf0542734fa39cf17ec33a0fc652221fce1b253f7dbe5b283b
-
SSDEEP
6144:QQz2C+7C1+QjkEPeIFhr9jlIRscmExWhoCq:32CWC1feIFr6gExW4
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications wmpsa32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpsa32.exe = "C:\\Windows\\SysWOW64\\wmpsa32.exe:*:Enabled:Windows Media Daemon" wmpsa32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpsa32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wmpsa32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications wmpsa32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpsa32.exe = "C:\\Windows\\SysWOW64\\wmpsa32.exe:*:Enabled:Windows Media Daemon" wmpsa32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpsa32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile wmpsa32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 3380 wmpsa32.exe -
Executes dropped EXE 2 IoCs
pid Process 4504 wmpsa32.exe 3380 wmpsa32.exe -
resource yara_rule behavioral2/memory/3316-0-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3316-2-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3316-4-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3316-3-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3316-38-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3380-45-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3380-46-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3380-47-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3380-49-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3380-55-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media Daemon = "C:\\Windows\\SysWOW64\\wmpsa32.exe" wmpsa32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpsa32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpsa32.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpsa32.exe 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpsa32.exe 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpsa32.exe File opened for modification C:\Windows\SysWOW64\wmpsa32.exe wmpsa32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3892 set thread context of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 4504 set thread context of 3380 4504 wmpsa32.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3316 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 3316 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 3316 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 3316 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe 3380 wmpsa32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3892 wrote to memory of 3316 3892 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 83 PID 3316 wrote to memory of 4504 3316 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 86 PID 3316 wrote to memory of 4504 3316 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 86 PID 3316 wrote to memory of 4504 3316 2845f330dde45ee528384e37f4826885_JaffaCakes118.exe 86 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 4504 wrote to memory of 3380 4504 wmpsa32.exe 87 PID 3380 wrote to memory of 3424 3380 wmpsa32.exe 56 PID 3380 wrote to memory of 3424 3380 wmpsa32.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\2845f330dde45ee528384e37f4826885_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2845f330dde45ee528384e37f4826885_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2845f330dde45ee528384e37f4826885_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2845f330dde45ee528384e37f4826885_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\wmpsa32.exe"C:\Windows\SysWOW64\wmpsa32.exe" C:\Users\Admin\AppData\Local\Temp\2845F3~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\wmpsa32.exe"C:\Windows\SysWOW64\wmpsa32.exe" C:\Users\Admin\AppData\Local\Temp\2845F3~1.EXE5⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3380
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD52845f330dde45ee528384e37f4826885
SHA15d6aa18e6af5cd5a02048802f0345b54ba7fe250
SHA256d38cfc73f632ad49cd23775b6030f4744ab5b485f7591b468553a0d21fa60d2d
SHA5124e91596b66e43acd7b5ded1f5c0727b06e87975c6a35d84bb6cae220e60f90eff83074dba6d8c1cf0542734fa39cf17ec33a0fc652221fce1b253f7dbe5b283b