Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
05-12-2024 13:48
General
-
Target
c7fe68e6099b569defcb2604d7199d69_JaffaCakes118.exe
-
Size
743KB
-
MD5
c7fe68e6099b569defcb2604d7199d69
-
SHA1
542f3c4066a044f1e34ced019fca8dd4e2430ccc
-
SHA256
ce4ab38153192c36ba73f9ad864c5accd00a380fbb3d8bf408b5d5f2ca8a2909
-
SHA512
0a5e454fd2f7295700d32e1e741bf204bab7629472e1268c74e3c04ff429110e1c4b24d7fa72daa708e7eff77f6b0b943633bc9e3608fe496cd3d24d6065ad07
-
SSDEEP
12288:+ANXlD0nHUJfoaHuLSbJpU2ZT5ONE+2oZJy/kMpCfeU59gW/n8vuhdCg/NcnJ+M5:+O90ncbHS+zUfE+N4VSfXgW/XdCeu+MK
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Drops file in Drivers directory 2 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7fe68e6099b569defcb2604d7199d69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c7fe68e6099b569defcb2604d7199d69_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
52KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB