Analysis

  • max time kernel
    92s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-12-2024 11:58

General

  • Target

    c26d53699dc7dbfdc640fb675afa54f1_JaffaCakes118.exe

  • Size

    473KB

  • MD5

    c26d53699dc7dbfdc640fb675afa54f1

  • SHA1

    1a1383addff6a6010539df71491a4ac7ab6e68ff

  • SHA256

    a8302286de7c10c6f37c0a975f765bbe791a455f4ddcd0136ae192ab3b5406fa

  • SHA512

    325cb7adc3d4df1aaea3e3f69cdc74e180c14bf530c3d1faa810516c3054faa280d358604d546854677dca266f9cf3211d3f02b58f843174cec251c4ff11f2bd

  • SSDEEP

    6144:IFeLlS5FZCABeVkGrMO3N9hF4fe6ByMnk/I6pSDy4N5q39dVdnNn1u9/TPr5P6uQ:CD6AYhMarNu1nVYeE8RhpQetCz

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c26d53699dc7dbfdc640fb675afa54f1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c26d53699dc7dbfdc640fb675afa54f1_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Users\Admin\AppData\Local\Temp\c26d53699dc7dbfdc640fb675afa54f1_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\c26d53699dc7dbfdc640fb675afa54f1_JaffaCakes118.exe"
      2⤵
        PID:3148
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 200
          3⤵
          • Program crash
          PID:1996
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 240
          3⤵
          • Program crash
          PID:5064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3148 -ip 3148
      1⤵
        PID:5004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3148 -ip 3148
        1⤵
          PID:4268

        Network

        • flag-us
          DNS
          58.55.71.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          58.55.71.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          75.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          75.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          97.17.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          97.17.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          217.106.137.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          217.106.137.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          212.20.149.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          212.20.149.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          241.42.69.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          241.42.69.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          240.221.184.93.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          240.221.184.93.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          23.236.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          23.236.111.52.in-addr.arpa
          IN PTR
          Response
        No results found
        • 8.8.8.8:53
          58.55.71.13.in-addr.arpa
          dns
          70 B
          144 B
          1
          1

          DNS Request

          58.55.71.13.in-addr.arpa

        • 8.8.8.8:53
          75.159.190.20.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          75.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
          144 B
          1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          97.17.167.52.in-addr.arpa
          dns
          71 B
          145 B
          1
          1

          DNS Request

          97.17.167.52.in-addr.arpa

        • 8.8.8.8:53
          217.106.137.52.in-addr.arpa
          dns
          73 B
          147 B
          1
          1

          DNS Request

          217.106.137.52.in-addr.arpa

        • 8.8.8.8:53
          212.20.149.52.in-addr.arpa
          dns
          72 B
          146 B
          1
          1

          DNS Request

          212.20.149.52.in-addr.arpa

        • 8.8.8.8:53
          241.42.69.40.in-addr.arpa
          dns
          71 B
          145 B
          1
          1

          DNS Request

          241.42.69.40.in-addr.arpa

        • 8.8.8.8:53
          240.221.184.93.in-addr.arpa
          dns
          73 B
          144 B
          1
          1

          DNS Request

          240.221.184.93.in-addr.arpa

        • 8.8.8.8:53
          23.236.111.52.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          23.236.111.52.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3148-0-0x0000000000400000-0x000000000050D000-memory.dmp

          Filesize

          1.1MB

        • memory/3148-2-0x0000000000400000-0x000000000050D000-memory.dmp

          Filesize

          1.1MB

        • memory/3148-3-0x0000000000400000-0x000000000050D000-memory.dmp

          Filesize

          1.1MB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.