Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe
-
Size
88KB
-
MD5
ee4c17a615094e87e2d53c538ec7f784
-
SHA1
83e8ce3ab3e766980d33626fcd0f7f94c1d34ca5
-
SHA256
ebdf2f82030f476384179ffccd0d20b24bc1e90c561ccb5d939b4d8293fdb21d
-
SHA512
cce0804a3f7c53761994e855c06e3b94dfea306ce254a36d306b3c18000387c2891431aa5adf395b80d60c0bc8701d8a13ce8f94b30e46d2ceaf48594cf044f1
-
SSDEEP
1536:j+iFaEtB4Y//aXoo7YMMHYKXrX7QTW3j/VFVi/MV2CJMfdT:j+iFaEtiY/iXooMMMRXb7CW3j/j4SAT
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\yodrive32.exe" ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 4812 yodrive32.exe 3028 yodrive32.exe 1412 yodrive32.exe 1216 yodrive32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\yodrive32.exe" ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2184 set thread context of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 4812 set thread context of 1216 4812 yodrive32.exe 88 -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\yodrive32.exe ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe File opened for modification C:\Windows\yodrive32.exe ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe File opened for modification C:\Windows\yodrive32.exe yodrive32.exe File created C:\Windows\%windir%\lfffile32.log yodrive32.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yodrive32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yodrive32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1068 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 82 PID 2184 wrote to memory of 1068 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 82 PID 2184 wrote to memory of 1068 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 82 PID 2184 wrote to memory of 4344 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 83 PID 2184 wrote to memory of 4344 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 83 PID 2184 wrote to memory of 4344 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 83 PID 2184 wrote to memory of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 2184 wrote to memory of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 2184 wrote to memory of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 2184 wrote to memory of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 2184 wrote to memory of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 2184 wrote to memory of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 2184 wrote to memory of 336 2184 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 84 PID 336 wrote to memory of 4812 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 85 PID 336 wrote to memory of 4812 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 85 PID 336 wrote to memory of 4812 336 ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe 85 PID 4812 wrote to memory of 3028 4812 yodrive32.exe 86 PID 4812 wrote to memory of 3028 4812 yodrive32.exe 86 PID 4812 wrote to memory of 3028 4812 yodrive32.exe 86 PID 4812 wrote to memory of 1412 4812 yodrive32.exe 87 PID 4812 wrote to memory of 1412 4812 yodrive32.exe 87 PID 4812 wrote to memory of 1412 4812 yodrive32.exe 87 PID 4812 wrote to memory of 1216 4812 yodrive32.exe 88 PID 4812 wrote to memory of 1216 4812 yodrive32.exe 88 PID 4812 wrote to memory of 1216 4812 yodrive32.exe 88 PID 4812 wrote to memory of 1216 4812 yodrive32.exe 88 PID 4812 wrote to memory of 1216 4812 yodrive32.exe 88 PID 4812 wrote to memory of 1216 4812 yodrive32.exe 88 PID 4812 wrote to memory of 1216 4812 yodrive32.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"2⤵PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"2⤵PID:4344
-
-
C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee4c17a615094e87e2d53c538ec7f784_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\yodrive32.exe"C:\Windows\yodrive32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\yodrive32.exe"C:\Windows\yodrive32.exe"4⤵
- Executes dropped EXE
PID:3028
-
-
C:\Windows\yodrive32.exe"C:\Windows\yodrive32.exe"4⤵
- Executes dropped EXE
PID:1412
-
-
C:\Windows\yodrive32.exe"C:\Windows\yodrive32.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1216
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5ee4c17a615094e87e2d53c538ec7f784
SHA183e8ce3ab3e766980d33626fcd0f7f94c1d34ca5
SHA256ebdf2f82030f476384179ffccd0d20b24bc1e90c561ccb5d939b4d8293fdb21d
SHA512cce0804a3f7c53761994e855c06e3b94dfea306ce254a36d306b3c18000387c2891431aa5adf395b80d60c0bc8701d8a13ce8f94b30e46d2ceaf48594cf044f1