Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24-09-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe
-
Size
92KB
-
MD5
f3c367f6a6477a7c34e2d3e0ce4d98e2
-
SHA1
e5d6f21233fb09ba632c053f05604de80a69c229
-
SHA256
ad1d151e16ee8fb73a670053df6cabc879a09312eabb1684d19d907be25444fd
-
SHA512
99d9b495d8fb6c7a1f2ff8cd59593bc7978feae6e85f7814b553cebabcba8505e31c5eaff1c20495eabdb81c40f27196cbf20bf571a1020d6e32c8f4f23850f4
-
SSDEEP
1536:SSquE20GQhzD4axzIYD8WwHBCrwPbX2u7GfGwNt07OWGVIK1DYTcLGz2abWRzXQ:VUVxD1whCcbCfGwNtsOWGVIsDY4LGz28
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 2 IoCs
pid Process 2408 AdobeARMS.exe 2764 AdobeARMS.exe -
Loads dropped DLL 3 IoCs
pid Process 2976 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 2976 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 2408 AdobeARMS.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\patches = "1" f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "\\AdobeARMS.exe" AdobeARMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" AdobeARMS.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2360 set thread context of 2976 2360 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 31 PID 2408 set thread context of 2764 2408 AdobeARMS.exe 33 -
resource yara_rule behavioral1/memory/2976-9-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2976-10-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2976-8-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2976-4-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2976-23-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2764-33-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2764-37-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2764-36-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2764-35-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2764-34-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2764-38-0x0000000000400000-0x000000000048C000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeARMS.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2976 2360 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2976 2360 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2976 2360 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2976 2360 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2976 2360 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 31 PID 2360 wrote to memory of 2976 2360 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 31 PID 2976 wrote to memory of 2408 2976 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 32 PID 2976 wrote to memory of 2408 2976 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 32 PID 2976 wrote to memory of 2408 2976 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 32 PID 2976 wrote to memory of 2408 2976 f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe 32 PID 2408 wrote to memory of 2764 2408 AdobeARMS.exe 33 PID 2408 wrote to memory of 2764 2408 AdobeARMS.exe 33 PID 2408 wrote to memory of 2764 2408 AdobeARMS.exe 33 PID 2408 wrote to memory of 2764 2408 AdobeARMS.exe 33 PID 2408 wrote to memory of 2764 2408 AdobeARMS.exe 33 PID 2408 wrote to memory of 2764 2408 AdobeARMS.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Roaming\AdobeARMS.exeC:\Users\Admin\AppData\Roaming\AdobeARMS.exe 388 "C:\Users\Admin\AppData\Local\Temp\f3c367f6a6477a7c34e2d3e0ce4d98e2_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2764
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5f3c367f6a6477a7c34e2d3e0ce4d98e2
SHA1e5d6f21233fb09ba632c053f05604de80a69c229
SHA256ad1d151e16ee8fb73a670053df6cabc879a09312eabb1684d19d907be25444fd
SHA51299d9b495d8fb6c7a1f2ff8cd59593bc7978feae6e85f7814b553cebabcba8505e31c5eaff1c20495eabdb81c40f27196cbf20bf571a1020d6e32c8f4f23850f4