Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 05:05
Behavioral task
behavioral1
Sample
JaffaCakes118_a4135183ab6542751a8b8f9e527ea68c1e41bce08f85506025dae1c329e786ad.msi
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_a4135183ab6542751a8b8f9e527ea68c1e41bce08f85506025dae1c329e786ad.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
JaffaCakes118_a4135183ab6542751a8b8f9e527ea68c1e41bce08f85506025dae1c329e786ad.msi
-
Size
156KB
-
MD5
b1ff5a52f6e3c537ef1f89bcc2919843
-
SHA1
fb2fc853a6ebbcfe48c9f1934e64b51416d408c1
-
SHA256
a4135183ab6542751a8b8f9e527ea68c1e41bce08f85506025dae1c329e786ad
-
SHA512
071ff588a52de4937ea6e10557c534fd0eb4a7d7eb952677c7d81784bbd57cbca29bb308c4042296637cd51d542d2267a6f95af890e35874512920481b10492e
-
SSDEEP
1536:Ek7K+T5fUWtIU4Dpgm+9/FSL0r/DAln9XMb+KR0Nc8QsJq3UDj0D:v7K+TJUwIjp1iS8Aln9Xe0Nc8QsC
Malware Config
Extracted
Family
metasploit
Version
windows/reverse_tcp
C2
52.14.18.129:16935
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\f76f670.msi msiexec.exe File opened for modification C:\Windows\Installer\f76f670.msi msiexec.exe File created C:\Windows\Installer\f76f671.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f76f671.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIF73A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF74C.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2092 MSIF74C.tmp -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2384 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIF74C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1592 msiexec.exe 1592 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 2384 msiexec.exe Token: SeIncreaseQuotaPrivilege 2384 msiexec.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeTakeOwnershipPrivilege 1592 msiexec.exe Token: SeSecurityPrivilege 1592 msiexec.exe Token: SeCreateTokenPrivilege 2384 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2384 msiexec.exe Token: SeLockMemoryPrivilege 2384 msiexec.exe Token: SeIncreaseQuotaPrivilege 2384 msiexec.exe Token: SeMachineAccountPrivilege 2384 msiexec.exe Token: SeTcbPrivilege 2384 msiexec.exe Token: SeSecurityPrivilege 2384 msiexec.exe Token: SeTakeOwnershipPrivilege 2384 msiexec.exe Token: SeLoadDriverPrivilege 2384 msiexec.exe Token: SeSystemProfilePrivilege 2384 msiexec.exe Token: SeSystemtimePrivilege 2384 msiexec.exe Token: SeProfSingleProcessPrivilege 2384 msiexec.exe Token: SeIncBasePriorityPrivilege 2384 msiexec.exe Token: SeCreatePagefilePrivilege 2384 msiexec.exe Token: SeCreatePermanentPrivilege 2384 msiexec.exe Token: SeBackupPrivilege 2384 msiexec.exe Token: SeRestorePrivilege 2384 msiexec.exe Token: SeShutdownPrivilege 2384 msiexec.exe Token: SeDebugPrivilege 2384 msiexec.exe Token: SeAuditPrivilege 2384 msiexec.exe Token: SeSystemEnvironmentPrivilege 2384 msiexec.exe Token: SeChangeNotifyPrivilege 2384 msiexec.exe Token: SeRemoteShutdownPrivilege 2384 msiexec.exe Token: SeUndockPrivilege 2384 msiexec.exe Token: SeSyncAgentPrivilege 2384 msiexec.exe Token: SeEnableDelegationPrivilege 2384 msiexec.exe Token: SeManageVolumePrivilege 2384 msiexec.exe Token: SeImpersonatePrivilege 2384 msiexec.exe Token: SeCreateGlobalPrivilege 2384 msiexec.exe Token: SeBackupPrivilege 2448 vssvc.exe Token: SeRestorePrivilege 2448 vssvc.exe Token: SeAuditPrivilege 2448 vssvc.exe Token: SeBackupPrivilege 1592 msiexec.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeRestorePrivilege 2844 DrvInst.exe Token: SeRestorePrivilege 2844 DrvInst.exe Token: SeRestorePrivilege 2844 DrvInst.exe Token: SeRestorePrivilege 2844 DrvInst.exe Token: SeRestorePrivilege 2844 DrvInst.exe Token: SeRestorePrivilege 2844 DrvInst.exe Token: SeRestorePrivilege 2844 DrvInst.exe Token: SeLoadDriverPrivilege 2844 DrvInst.exe Token: SeLoadDriverPrivilege 2844 DrvInst.exe Token: SeLoadDriverPrivilege 2844 DrvInst.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeTakeOwnershipPrivilege 1592 msiexec.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeTakeOwnershipPrivilege 1592 msiexec.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeTakeOwnershipPrivilege 1592 msiexec.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeTakeOwnershipPrivilege 1592 msiexec.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeTakeOwnershipPrivilege 1592 msiexec.exe Token: SeRestorePrivilege 1592 msiexec.exe Token: SeTakeOwnershipPrivilege 1592 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2384 msiexec.exe 2384 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1592 wrote to memory of 2920 1592 msiexec.exe 35 PID 1592 wrote to memory of 2920 1592 msiexec.exe 35 PID 1592 wrote to memory of 2920 1592 msiexec.exe 35 PID 1592 wrote to memory of 2920 1592 msiexec.exe 35 PID 1592 wrote to memory of 2920 1592 msiexec.exe 35 PID 1592 wrote to memory of 2920 1592 msiexec.exe 35 PID 1592 wrote to memory of 2920 1592 msiexec.exe 35 PID 1592 wrote to memory of 2092 1592 msiexec.exe 36 PID 1592 wrote to memory of 2092 1592 msiexec.exe 36 PID 1592 wrote to memory of 2092 1592 msiexec.exe 36 PID 1592 wrote to memory of 2092 1592 msiexec.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a4135183ab6542751a8b8f9e527ea68c1e41bce08f85506025dae1c329e786ad.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2384
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9629A203A8DCD4DB3CC91243819FE9A72⤵
- System Location Discovery: System Language Discovery
PID:2920
-
-
C:\Windows\Installer\MSIF74C.tmp"C:\Windows\Installer\MSIF74C.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B8" "0000000000000590"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD560039734d27e552a58dd6e983ab73b42
SHA11a053b364f73ebdbf1a0947d7a55b72dfed92524
SHA2564f00243cf76a6d1b75785942f637604acde7e502203fd0365790c585a2c0232c
SHA5128637e6a255f5cdb12f9c819058d81794bc9f4ab1d2e995375b2d071fab50e9170e6ec7b4bd8be301a8978397c3cf6ca159efc8c916fe445fca8fcfe3107025f7