Analysis

  • max time kernel
    13s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 01:55

General

  • Target

    8e92878d4df3ee8df1a3a922ef25ab08_JaffaCakes118.exe

  • Size

    258KB

  • MD5

    8e92878d4df3ee8df1a3a922ef25ab08

  • SHA1

    2dd9583cf1f4d40209af84efaffcdc7707df62a2

  • SHA256

    b66d49a7a1fdd3a31abb25496cc6d303ac2e9991e82a7557b01db07a08738efb

  • SHA512

    18ce36cb1eb7cbb1cdc6164edcfca4569adb40453ea308edff4319ca75184debab48f1447cf26c413e212ce6432cd388d4dfb407d6ca7400feded964fa41224e

  • SSDEEP

    3072:evMPh0vdMKd68W96tOY6gALbFF5AqkKdwNzWs2H4MIlo3L:evMPh0Wfp1FaqkKdwxWsj

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e92878d4df3ee8df1a3a922ef25ab08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8e92878d4df3ee8df1a3a922ef25ab08_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Local\Temp\8e92878d4df3ee8df1a3a922ef25ab08_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8e92878d4df3ee8df1a3a922ef25ab08_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:324
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 140
        3⤵
        • Program crash
        PID:668

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/324-1-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB

        • memory/324-11-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB

        • memory/324-9-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB

        • memory/324-8-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB

        • memory/324-6-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB

        • memory/324-5-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB

        • memory/324-4-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB

        • memory/324-2-0x0000000000400000-0x0000000000467000-memory.dmp

          Filesize

          412KB