Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 14:04
Static task
static1
Behavioral task
behavioral1
Sample
1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe
-
Size
88KB
-
MD5
1a680fe49a0f6e9484bcd8bd9ed6ee93
-
SHA1
be80e8eb995e28b3bf26a3c6835d3d05d8ba1bf1
-
SHA256
097da0f6ba79e4a715d8610543f352da68a250f124e25a70725d9efed3b15d8f
-
SHA512
8ec7fc3fbd8250b437887823b630f54a296d5674270dadcc2d82c913865002266273150182e5da041ad7d4c51779c8c9ea1c2b3ea28e82803487b1321ab07ea3
-
SSDEEP
1536:dMq8Qgj984qyx/mY73WQX0XrVor1Pmn7rTYRHTCHWivHZ/Zm:m9uyx/mqGQerVoJPm7YdWDZRm
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 2 IoCs
Processes:
AdobeARMS.exeAdobeARMS.exepid process 4300 AdobeARMS.exe 908 AdobeARMS.exe -
Processes:
resource yara_rule behavioral2/memory/1412-1-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/1412-0-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/1412-6-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/1412-8-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/1412-9-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/1412-7-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/1412-2-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/908-25-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/1412-28-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/908-29-0x0000000000400000-0x000000000048B000-memory.dmp upx behavioral2/memory/908-30-0x0000000000400000-0x000000000048B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exeAdobeARMS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\patches = "1" 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "\\AdobeARMS.exe" AdobeARMS.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe" AdobeARMS.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exeAdobeARMS.exedescription pid process target process PID 4872 set thread context of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4300 set thread context of 908 4300 AdobeARMS.exe AdobeARMS.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4404 4872 WerFault.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1972 4300 WerFault.exe AdobeARMS.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exeAdobeARMS.exedescription pid process target process PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 4872 wrote to memory of 1412 4872 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe PID 1412 wrote to memory of 4300 1412 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe AdobeARMS.exe PID 1412 wrote to memory of 4300 1412 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe AdobeARMS.exe PID 1412 wrote to memory of 4300 1412 1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe PID 4300 wrote to memory of 908 4300 AdobeARMS.exe AdobeARMS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 3762⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exeC:\Users\Admin\AppData\Roaming\AdobeARMS.exe 916 "C:\Users\Admin\AppData\Local\Temp\1a680fe49a0f6e9484bcd8bd9ed6ee93_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 3764⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4872 -ip 48721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4300 -ip 43001⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AdobeARMS.exeFilesize
88KB
MD51a680fe49a0f6e9484bcd8bd9ed6ee93
SHA1be80e8eb995e28b3bf26a3c6835d3d05d8ba1bf1
SHA256097da0f6ba79e4a715d8610543f352da68a250f124e25a70725d9efed3b15d8f
SHA5128ec7fc3fbd8250b437887823b630f54a296d5674270dadcc2d82c913865002266273150182e5da041ad7d4c51779c8c9ea1c2b3ea28e82803487b1321ab07ea3
-
memory/908-30-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/908-29-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/908-25-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-7-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-9-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-1-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-2-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-8-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-6-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-28-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/1412-0-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/4300-24-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4872-5-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB