Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-12-2024 12:25
General
-
Target
bd6343ee092d1db1e805257467c5ede6_JaffaCakes118.exe
-
Size
664KB
-
MD5
bd6343ee092d1db1e805257467c5ede6
-
SHA1
221c8c0b806e2e04ddbcbe2d32442ab037f8dc36
-
SHA256
0230a60bbe2eba375c47faa589247283baaded8bc36d7e8e8ca8928e8af7473a
-
SHA512
95766903945a8643a209c03491ff8c3d7ca6125f9fd860bd23e665eda98253d1c888b5a2f1b9a6a90a9fcc5ecdeb9a8c60f08a8dd140278f832f691f4c545b8a
-
SSDEEP
6144:rIN4KH8q7lVdspX4ruPQp7gEByECUgiVAXAADnCRc/smfGSs8pccagsHZv5w9Syl:kTT7vda4ruPo7/EvxX5GR6G98CCCifl
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 10 IoCs
-
Loads dropped DLL 20 IoCs
-
Drops file in System32 directory 20 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
NTFS ADS 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd6343ee092d1db1e805257467c5ede6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd6343ee092d1db1e805257467c5ede6_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 676 "C:\Users\Admin\AppData\Local\Temp\bd6343ee092d1db1e805257467c5ede6_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 760 "C:\Windows\SysWOW64\uptmgr.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 764 "C:\Windows\SysWOW64\uptmgr.exe"4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 756 "C:\Windows\SysWOW64\uptmgr.exe"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 768 "C:\Windows\SysWOW64\uptmgr.exe"6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 752 "C:\Windows\SysWOW64\uptmgr.exe"7⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 780 "C:\Windows\SysWOW64\uptmgr.exe"8⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 772 "C:\Windows\SysWOW64\uptmgr.exe"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 792 "C:\Windows\SysWOW64\uptmgr.exe"10⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\uptmgr.exeC:\Windows\system32\uptmgr.exe 788 "C:\Windows\SysWOW64\uptmgr.exe"11⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104B
MD573dcd73d8c4c41e0e1af5e3b01d0281c
SHA1e906e809c0927145b21cc2c82dc09d048c29857b
SHA2562dcb5e482972399bc83135e6ba5934279b18414f91cab11d2d0a066600527c74
SHA5122b6c4cf843bb05c096c27eeb88e77a5b3ef2f90678ffaf31dc66cd3888747427627a1f4875429e2a06b0250d698086f81c3faff360a455ad870c41b89a96b226
-
Filesize
104B
MD5894ffc2a658b76e541dab1d61abc969b
SHA1a45d815b13e9700420ddb86f081700e26f69128a
SHA256265987cd00de9c107e0f6ac711d5e71cfe10c4416092b2f72d2543cbc76c03d1
SHA512890061b82044de64d30ae2afb432f8080250bc6ed28e8eb8f05d40ea40138b27eecac9c319fc081e763280a8abb203f35a95753b0cdc743692db91806a274154
-
Filesize
104B
MD5f29ef7e1143181cfc4a890d015e32d27
SHA1076847555df092c71ff569c3a6985bd5a90f27b2
SHA25618a37b4ec5763404130bbedbd7d71a5f4cdb97a14be236402af7a26d582b6d05
SHA512e60c32a84d0e6382ff07f0577a48913656359fd5c1486689a7ed22dcf36c1eb4acac738ea99b5ac0503bd234ea08191fa46f2fab500cde4bff5a03da03f1e06f
-
Filesize
104B
MD514656496939686cf5ef2c915aaa751c2
SHA1d78f34685b0a1e37d33da006c789a944af474d9b
SHA2569270d233712660d306490d571614c8e14fac6c7ba99ec384a4010389a88f5c0e
SHA5120b0d2e4002beacd92e15a88425a0dd31bef3710f625631268dd1f3f1dbc40bdab7873f6f3b7da71f95ecf3d9a8b6b536fc1a4f6b3ad2816bcd473702195cec2c
-
Filesize
104B
MD540014664b16f26e82bdee3449dfca0fc
SHA1a3146d7bee329de4dd9641bc9ffbc9d7c816aac3
SHA25662d2a534db090bf49dc84164be8e1d041a2d018b4cad82b4402a52d8a4e3dcb0
SHA512491b88f31049a66edd17f110005de0d2826362533092ca2a6ca4abe70b0e41ed8eb708d2fee0a37181a034700c6ba34cee1c145bd7db5b2408af41971c80f436
-
Filesize
104B
MD59699fea577fe65567151d78d357411e8
SHA1c278481bb29245bcb3fe9bbdd519ed20e750e735
SHA256dd96ef4b1087318fc5d50027a2e10ce1a34f99df2684030951cf1506e5798c3f
SHA512a15f59cc28cd47e169a7f94ca73e9bbac8a365fa09450ca5a0286697a94be073eeca5978448dd570ad237fcf511aa5b3a4cd2f49def46b68fa72a1ca3725614a
-
Filesize
104B
MD5848ea49fb06257578004cde05b403683
SHA141a3bc395c3a6c176a8c14bd41ca68ac2acd5ee7
SHA256717aaed871d7dd5aafa57397c1810b9ab426252f5682799d06395b56686cf9aa
SHA51261a66208c4f02d520396ad46187f8e860013d0731f86a124bf796fac62e957b2ae194f8cdef664bb58334d7a59cb023bb3dcd0c91904e70f95ae16a49820da6c
-
Filesize
104B
MD546c1412e1aa4fe49bc19e01d485f5d85
SHA161927e5532bdf0ffc561f08cacdff7429c13fbaa
SHA25626d1da1153344d533601c63938104ed91d13c432333f077a6b85525e9c10ae21
SHA51259f327eb694571bae389d94b4cd35f60710376edc083b50e7742489fced58047cc94fe008e759a6268e889fb5508ee4bd5361a6862343764fa7eed9df17f3cc4
-
Filesize
104B
MD565f9d1d945066a7f8d68a5164f060000
SHA182e7207be4f93c4555cb22ba6724ffded6baef58
SHA2563266cbd532ec5d8e625e93dcbdf9337016a17a33de05d72c9ed0699024586107
SHA512111c23be3697b06c3560780c3f40a20c4ed02619e2242f3d9d6701cf068630641e8ca91b2211aab00294b2442c1f3a696cce9cffbfa62b92c4e139709e3c2fe8
-
Filesize
104B
MD542b79a13d751eb8a8a11df7882805535
SHA1c0752e53e299d101de06480bf5bd3f6b17e8b36b
SHA256c594b63dfd6a7b08d8d9fbe03cbce87cfde222e714aa4fe47ee927af518130cd
SHA512827a3fa4375a7184defb0ae0d3efc240c26748d98da33449c600a5b2e5b4ae78ffe3ebe4f7e0a5ed39790bb299546c530ccc83b703fb41d9ad41bb4620af7b11
-
Filesize
104B
MD5351f07784ea6ae0ff2e0181b0c255cfb
SHA1bc5ae3f23c36afd44898e335209efd1009454973
SHA2568a96e6063b545f7dc54b14647d69d65974920ed10e7f6fd238e51944b5bda173
SHA5126c9459bdbf0baa1309b40592ef0e62ab5f09102bd51d5fdcdc04658e5441c23d019e9459b6c82847c9cc9d30e5842bfb47a2f69289a7cd36fe72066c1e91993b
-
Filesize
104B
MD51f61542fb214582d2997efac730152cb
SHA11d48127007a71d25814dba186e7611ed742fd6fe
SHA256f490ccfdcde8e06d624e11a0884cf32155fe15ccd6d21d1828ac56ebe4461084
SHA5124f93a00e8609e5ca335eaee5c3832aaa1d1b9b61e2862937977bd4a03fd1df98c5e0df4d32d106a714a3cbec83e0e684eaec7e61ef949c6acea3a755465bfa03
-
Filesize
104B
MD5378eafecdb28bf9510a4e023e01d3774
SHA1b160635932f12f3983240ee57931bc7b06a16d48
SHA256a3d18339b6a6743d98d3e8effdcafc53b1a1ee280e4090061ecaa8d9df89a534
SHA51221a908dba347555f32f876396bb50e2266c412f7c1251193584bd25285763ffe8f0e408413814fa17c8cb20b1c0e5f858cd1e1bd3e7325e446f0d6afefedfc87
-
Filesize
664KB
MD5bd6343ee092d1db1e805257467c5ede6
SHA1221c8c0b806e2e04ddbcbe2d32442ab037f8dc36
SHA2560230a60bbe2eba375c47faa589247283baaded8bc36d7e8e8ca8928e8af7473a
SHA51295766903945a8643a209c03491ff8c3d7ca6125f9fd860bd23e665eda98253d1c888b5a2f1b9a6a90a9fcc5ecdeb9a8c60f08a8dd140278f832f691f4c545b8a
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB