Analysis

  • max time kernel
    147s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06-12-2024 09:22

General

  • Target

    cc3d29e605581e20fde808580ae82031_JaffaCakes118.exe

  • Size

    57KB

  • MD5

    cc3d29e605581e20fde808580ae82031

  • SHA1

    b2ca7544873a2b13a7d8e2aa9bffaddaaf44c982

  • SHA256

    fa94dceea66dfa6744e59dbe4707ad587469c79376a0389160763896bbbb8875

  • SHA512

    43fea5ebb7680c0a0e18dbca8a559042cfe3aab625807142466d540c09ee38999937843d420493b17e9beaa029774721f957dd998c138ff8b41d69b9cf0c77e6

  • SSDEEP

    1536:W5faTt6llw7XQRaQ7XQRaSpUPSR6hdrJBCrH:uI4lw7gRx7gR4xzrJBGH

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc3d29e605581e20fde808580ae82031_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cc3d29e605581e20fde808580ae82031_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3012
      • C:\Users\Admin\AppData\Local\Temp\cc3d29e605581e20fde808580ae82031_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\cc3d29e605581e20fde808580ae82031_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\aadrive32.exe
          "C:\Windows\aadrive32.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1104
          • C:\Windows\aadrive32.exe
            "C:\Windows\aadrive32.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2704

    Network

    • flag-us
      DNS
      haaaaaaa.ishtiben.com
      aadrive32.exe
      Remote address:
      8.8.8.8:53
      Request
      haaaaaaa.ishtiben.com
      IN A
      Response
    No results found
    • 8.8.8.8:53
      haaaaaaa.ishtiben.com
      dns
      aadrive32.exe
      67 B
      140 B
      1
      1

      DNS Request

      haaaaaaa.ishtiben.com

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\aadrive32.exe

      Filesize

      57KB

      MD5

      cc3d29e605581e20fde808580ae82031

      SHA1

      b2ca7544873a2b13a7d8e2aa9bffaddaaf44c982

      SHA256

      fa94dceea66dfa6744e59dbe4707ad587469c79376a0389160763896bbbb8875

      SHA512

      43fea5ebb7680c0a0e18dbca8a559042cfe3aab625807142466d540c09ee38999937843d420493b17e9beaa029774721f957dd998c138ff8b41d69b9cf0c77e6

    • memory/1480-0-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1480-2-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1480-12-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1480-13-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1480-10-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1480-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1480-6-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1480-4-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-41-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-45-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-40-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-36-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-42-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-43-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-44-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-37-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-46-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-47-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-48-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-49-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-50-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-51-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-52-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2704-53-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.