Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe
-
Size
84KB
-
MD5
f83a490c3a3c5e1b2457f256b0a8b348
-
SHA1
f6ccb40f6773e84cb4eb5307a87f2e70e4e56ea5
-
SHA256
7db2d5b7da6f5d42d962aff9193c25849129581f84017676f3cd8d8ef123d8ed
-
SHA512
deff50309465645dedfe306e9bd227b5bc32a8e7ed3961e598a30bc3c5a323014f2f6affa0ab2e4947845e721946f513ede90ee36d09814392df126c74179b5b
-
SSDEEP
1536:/lz2dDpLakqt4dvPiwWKVOzuMNeWd4ybWj5HoDOfU1gBRUhrGvVI:wB4vt4dvPiwWKV8NmeOs1ORaoW
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe" f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 4144 jodrive32.exe 2500 jodrive32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe" f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4968 set thread context of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 4144 set thread context of 2500 4144 jodrive32.exe 84 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\jodrive32.exe f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe File opened for modification C:\Windows\jodrive32.exe f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe File created C:\Windows\%windir%\eilfiie32.log jodrive32.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jodrive32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jodrive32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 904 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 904 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 904 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 904 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4968 wrote to memory of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 4968 wrote to memory of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 4968 wrote to memory of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 4968 wrote to memory of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 4968 wrote to memory of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 4968 wrote to memory of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 4968 wrote to memory of 904 4968 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 82 PID 904 wrote to memory of 4144 904 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 83 PID 904 wrote to memory of 4144 904 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 83 PID 904 wrote to memory of 4144 904 f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe 83 PID 4144 wrote to memory of 2500 4144 jodrive32.exe 84 PID 4144 wrote to memory of 2500 4144 jodrive32.exe 84 PID 4144 wrote to memory of 2500 4144 jodrive32.exe 84 PID 4144 wrote to memory of 2500 4144 jodrive32.exe 84 PID 4144 wrote to memory of 2500 4144 jodrive32.exe 84 PID 4144 wrote to memory of 2500 4144 jodrive32.exe 84 PID 4144 wrote to memory of 2500 4144 jodrive32.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f83a490c3a3c5e1b2457f256b0a8b348_JaffaCakes118.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\jodrive32.exe"C:\Windows\jodrive32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\jodrive32.exeC:\Windows\jodrive32.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2500
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5f83a490c3a3c5e1b2457f256b0a8b348
SHA1f6ccb40f6773e84cb4eb5307a87f2e70e4e56ea5
SHA2567db2d5b7da6f5d42d962aff9193c25849129581f84017676f3cd8d8ef123d8ed
SHA512deff50309465645dedfe306e9bd227b5bc32a8e7ed3961e598a30bc3c5a323014f2f6affa0ab2e4947845e721946f513ede90ee36d09814392df126c74179b5b