Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
29-11-2024 09:13
General
-
Target
b03e560065ab6214f693cbeefb7eebb2_JaffaCakes118.exe
-
Size
571KB
-
MD5
b03e560065ab6214f693cbeefb7eebb2
-
SHA1
8217549dcaa794db6120f40a97a40ce0e8402fd9
-
SHA256
d318be6ac749bfb58f0108cda57fb3bf766ae71cdb449df01de58e4304c25ffc
-
SHA512
ad033157ccb06601066f16c394efd381ac0e3b55d0e70e112c855c712dbdd77e92f3d3a6e24d1e74c3a5051e2e39fe126277733edd7c724d31e3f60aef851d14
-
SSDEEP
12288:leAdV0FMRfmRSktcuvDHi7E7DZOidezNrKmVF9sBsea7JwHs66edZib:0GV0FwA7rzZR45rDVLsBDa1feib
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b03e560065ab6214f693cbeefb7eebb2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b03e560065ab6214f693cbeefb7eebb2_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
36KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB