Analysis
-
max time kernel
128s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2024 20:19
Static task
static1
Behavioral task
behavioral1
Sample
8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe
-
Size
47KB
-
MD5
8d5122c138c32dc5ea4552db7d07efd5
-
SHA1
222094a08700f80d5a4d6d2860206ac24d4d4da3
-
SHA256
de24be2d94840040aa6d90ef65db61aaa5b1f64c6572a329562826ae2f35576e
-
SHA512
0576e42615309cd63f32e9936b6ff9ecd1d347ddd105615060676f444a542f6b44c59afaffc61ab69896fccab5d42a506263c21f750da5a03ffedd64f0930002
-
SSDEEP
768:z5scsxI71Hv2mTEb4YXVzancAloPCx+k2uIuHtod6gWtxVjkeaPnAJWAEnRmtl:z5sc375Ab4EBanICQFuIiyd6gWHpkea5
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" regedit.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" regedit.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" regedit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\serivces.exe 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\serivces.exe 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3284 regedit.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3720 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 84 PID 2268 wrote to memory of 3720 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 84 PID 2268 wrote to memory of 3720 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 84 PID 3720 wrote to memory of 4004 3720 cmd.exe 86 PID 3720 wrote to memory of 4004 3720 cmd.exe 86 PID 3720 wrote to memory of 4004 3720 cmd.exe 86 PID 4004 wrote to memory of 2248 4004 net.exe 87 PID 4004 wrote to memory of 2248 4004 net.exe 87 PID 4004 wrote to memory of 2248 4004 net.exe 87 PID 2268 wrote to memory of 3436 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 90 PID 2268 wrote to memory of 3436 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 90 PID 2268 wrote to memory of 3436 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 90 PID 3436 wrote to memory of 3284 3436 cmd.exe 91 PID 3436 wrote to memory of 3284 3436 cmd.exe 91 PID 3436 wrote to memory of 3284 3436 cmd.exe 91 PID 2268 wrote to memory of 2384 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 93 PID 2268 wrote to memory of 2384 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 93 PID 2268 wrote to memory of 2384 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 93 PID 2268 wrote to memory of 3904 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 94 PID 2268 wrote to memory of 3904 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 94 PID 2268 wrote to memory of 3904 2268 8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe 94 PID 3904 wrote to memory of 4580 3904 cmd.exe 98 PID 3904 wrote to memory of 4580 3904 cmd.exe 98 PID 3904 wrote to memory of 4580 3904 cmd.exe 98 PID 2384 wrote to memory of 1564 2384 cmd.exe 97 PID 2384 wrote to memory of 1564 2384 cmd.exe 97 PID 2384 wrote to memory of 1564 2384 cmd.exe 97 PID 4580 wrote to memory of 4832 4580 net.exe 99 PID 1564 wrote to memory of 4288 1564 net.exe 100 PID 4580 wrote to memory of 4832 4580 net.exe 99 PID 4580 wrote to memory of 4832 4580 net.exe 99 PID 1564 wrote to memory of 4288 1564 net.exe 100 PID 1564 wrote to memory of 4288 1564 net.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d5122c138c32dc5ea4552db7d07efd5_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:2248
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\a.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\regedit.exeREGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg3⤵
- Modifies firewall policy service
- Modifies security service
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:3284
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop "Security Center"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\net.exenet stop "Security Center"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"4⤵
- System Location Discovery: System Language Discovery
PID:4288
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\net.exenet start SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:4832
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640B
MD570237e6c7f12f17048117b2e1098aef9
SHA1b9735214963e8e3b791bf7113bebbbbf65c4d36d
SHA2566d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c
SHA512bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee
-
Filesize
1KB
MD5d807ec0161c542b23e37898db356c95b
SHA10aac2ef8e1d77868d932a10007efcbd0b69ecdfc
SHA25656cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37
SHA512538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf