Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 04:50
Static task
static1
Behavioral task
behavioral1
Sample
c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe
-
Size
252KB
-
MD5
c0e45514fd5a3d753d5dcf88025f52ea
-
SHA1
4e154be021ddc5c52ca30136cdbd82911700f4ac
-
SHA256
bda852e75c054e1bbfcc880af4b3a8ead19bb8130921aada2a1541f328f1c9c9
-
SHA512
6babbd91b562d8aafc9b0bfa9e4df5d43f8d0f63bfc1b833a3c199e3fe5a2031e8b0a205f27115bc2ac3a33518edec1bfcba4767368fe26361431406fd45dc72
-
SSDEEP
3072:g4UlooTl0f9Idj9ebUYv7SX9TmeF/7HT4cj8+pBk5mUsURNZNeRRR:g48/yadjQblGt3F/7Hl/pBPURNZN
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2380 set thread context of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 -
resource yara_rule behavioral1/memory/2664-6-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2664-11-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2664-9-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2664-8-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2664-5-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2664-4-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2664-2-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2664-12-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2800 2664 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2664 2380 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 30 PID 2664 wrote to memory of 2800 2664 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2800 2664 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2800 2664 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2800 2664 c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0e45514fd5a3d753d5dcf88025f52ea_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 1403⤵
- Program crash
PID:2800
-
-