Analysis

  • max time kernel
    128s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2024 20:19

General

  • Target

    8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe

  • Size

    47KB

  • MD5

    8d5122c138c32dc5ea4552db7d07efd5

  • SHA1

    222094a08700f80d5a4d6d2860206ac24d4d4da3

  • SHA256

    de24be2d94840040aa6d90ef65db61aaa5b1f64c6572a329562826ae2f35576e

  • SHA512

    0576e42615309cd63f32e9936b6ff9ecd1d347ddd105615060676f444a542f6b44c59afaffc61ab69896fccab5d42a506263c21f750da5a03ffedd64f0930002

  • SSDEEP

    768:z5scsxI71Hv2mTEb4YXVzancAloPCx+k2uIuHtod6gWtxVjkeaPnAJWAEnRmtl:z5sc375Ab4EBanICQFuIiyd6gWHpkea5

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Modifies firewall policy service 3 TTPs 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs .reg file with regedit 1 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Windows\SysWOW64\net.exe
        net stop SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2248
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\a.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:3284
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Security Center"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\net.exe
        net stop "Security Center"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1564
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Security Center"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4288
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net start SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Windows\SysWOW64\net.exe
        net start SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4580
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    640B

    MD5

    70237e6c7f12f17048117b2e1098aef9

    SHA1

    b9735214963e8e3b791bf7113bebbbbf65c4d36d

    SHA256

    6d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c

    SHA512

    bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee

  • \??\c:\a.bat

    Filesize

    1KB

    MD5

    d807ec0161c542b23e37898db356c95b

    SHA1

    0aac2ef8e1d77868d932a10007efcbd0b69ecdfc

    SHA256

    56cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37

    SHA512

    538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf

  • memory/2268-0-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/2268-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

    Filesize

    8KB

  • memory/2268-29-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB