Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/09/2024, 11:02

General

  • Target

    f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe

  • Size

    84KB

  • MD5

    f83a490c3a3c5e1b2457f256b0a8b348

  • SHA1

    f6ccb40f6773e84cb4eb5307a87f2e70e4e56ea5

  • SHA256

    7db2d5b7da6f5d42d962aff9193c25849129581f84017676f3cd8d8ef123d8ed

  • SHA512

    deff50309465645dedfe306e9bd227b5bc32a8e7ed3961e598a30bc3c5a323014f2f6affa0ab2e4947845e721946f513ede90ee36d09814392df126c74179b5b

  • SSDEEP

    1536:/lz2dDpLakqt4dvPiwWKVOzuMNeWd4ybWj5HoDOfU1gBRUhrGvVI:wB4vt4dvPiwWKV8NmeOs1ORaoW

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Windows\jodrive32.exe
        "C:\Windows\jodrive32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Windows\jodrive32.exe
          C:\Windows\jodrive32.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\jodrive32.exe

    Filesize

    84KB

    MD5

    f83a490c3a3c5e1b2457f256b0a8b348

    SHA1

    f6ccb40f6773e84cb4eb5307a87f2e70e4e56ea5

    SHA256

    7db2d5b7da6f5d42d962aff9193c25849129581f84017676f3cd8d8ef123d8ed

    SHA512

    deff50309465645dedfe306e9bd227b5bc32a8e7ed3961e598a30bc3c5a323014f2f6affa0ab2e4947845e721946f513ede90ee36d09814392df126c74179b5b

  • memory/904-22-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/904-31-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/904-19-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/904-23-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-56-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-65-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-69-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-68-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-67-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-66-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-64-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-63-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-57-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-58-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-59-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-60-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-61-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/2500-62-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4144-52-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4144-49-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4144-39-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4968-0-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4968-20-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/4968-8-0x0000000000620000-0x0000000000720000-memory.dmp

    Filesize

    1024KB

  • memory/4968-18-0x0000000000620000-0x0000000000720000-memory.dmp

    Filesize

    1024KB