Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 12:10

General

  • Target

    7f273c8dc5aad25e95c84bf550330efe_JaffaCakes118.exe

  • Size

    84KB

  • MD5

    7f273c8dc5aad25e95c84bf550330efe

  • SHA1

    21acee00753ae4c89f323ebb7adede353df5683a

  • SHA256

    d9377bd1fdd2708c15bcd1cba1ebf70fa20093f54808849203f8fa788aadb403

  • SHA512

    220ab9e96c4491451460f08b0ea3e4db35d5c7c77a2a4b15769f1a99509f2c8a944e510eaef47d57eda023aed4fdc047962ef41082c87b8b3772467ea3e8ad4d

  • SSDEEP

    1536:GkWmOwtj91Lv/aLc7f26+h4OQCUwljFf+NDHV:G1wth1Lv/Ccu4Ojtl+V

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f273c8dc5aad25e95c84bf550330efe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7f273c8dc5aad25e95c84bf550330efe_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\7f273c8dc5aad25e95c84bf550330efe_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7f273c8dc5aad25e95c84bf550330efe_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\widrive32.exe
        "C:\Windows\widrive32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Windows\widrive32.exe
          "C:\Windows\widrive32.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\widrive32.exe

    Filesize

    84KB

    MD5

    7f273c8dc5aad25e95c84bf550330efe

    SHA1

    21acee00753ae4c89f323ebb7adede353df5683a

    SHA256

    d9377bd1fdd2708c15bcd1cba1ebf70fa20093f54808849203f8fa788aadb403

    SHA512

    220ab9e96c4491451460f08b0ea3e4db35d5c7c77a2a4b15769f1a99509f2c8a944e510eaef47d57eda023aed4fdc047962ef41082c87b8b3772467ea3e8ad4d

  • memory/2824-2-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2824-4-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2824-5-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2824-6-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2824-16-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-29-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-32-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-27-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-28-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-24-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-30-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-31-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-25-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-33-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-34-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-35-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-36-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-37-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-38-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2932-39-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB