Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-12-2024 05:03
General
-
Target
cb2de216a16266ffc0c031750d652917_JaffaCakes118.exe
-
Size
717KB
-
MD5
cb2de216a16266ffc0c031750d652917
-
SHA1
cd8fd54cf6fef6910200103d586e1f3f6b22dff1
-
SHA256
02c0e50dd577fe7727f4c050bee9d9d260021839d8b7798e77d289264ad59b66
-
SHA512
0ebf884745b3def76a55f771d28bdc71d98264e91167bb5974d505cc497608a3ff769229ed67705f6dfd24b2973c0fdc3c38927c574569bf28d8556f54de43b6
-
SSDEEP
12288:r5g1NPZi5cwyFpl900fIMel0RtAdWFdFv+JS1Zu6v/WLVa5TFp:r5GZi5Yk0Q74t6WFnM6vDTF
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Drops file in Drivers directory 2 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb2de216a16266ffc0c031750d652917_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cb2de216a16266ffc0c031750d652917_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
52KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB