Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:13
Static task
static1
Behavioral task
behavioral1
Sample
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe
-
Size
528KB
-
MD5
1c01bc2c2bbd72336530eefb258166a5
-
SHA1
95cc61a79c10dbf1beefb6306ee6de367d73d022
-
SHA256
16801c285de9f40edd59951515bfaaaddaf586defcdb309b730f4d20acbd07bc
-
SHA512
32aefca83f8d0f73e3acd1ca330c34c5630995825e809c43655991fdb5b57477137d5cb415cb6b4ef8ebb5d2657d20e7f3cd464cd54bdd4dd8c20d4b2b0c01c8
-
SSDEEP
12288:m+LBj05NcFwKUynJ9ypCT6NNqavSR5SFgeiqRFpfZ6Mi:BVYwFlUynJXmstax6Mi
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
192.168.1.4:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exedescription pid process target process PID 1548 set thread context of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe -
Modifies registry class 5 IoCs
Processes:
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DEFB3B6-9E79-0723-9E79-07239E790723}\ = "Broadcast Event Service" 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DEFB3B6-9E79-0723-9E79-07239E790723}\InprocServer32 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DEFB3B6-9E79-0723-9E79-07239E790723}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msvidctl.dll" 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DEFB3B6-9E79-0723-9E79-07239E790723}\InprocServer32\ThreadingModel = "Both" 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DEFB3B6-9E79-0723-9E79-07239E790723} 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exedescription pid process Token: 33 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exepid process 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exedescription pid process target process PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe PID 1548 wrote to memory of 2840 1548 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe 1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c01bc2c2bbd72336530eefb258166a5_JaffaCakes118.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1548-33-0x0000000000530000-0x0000000000579000-memory.dmpFilesize
292KB
-
memory/1548-0-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1548-6-0x0000000000530000-0x0000000000579000-memory.dmpFilesize
292KB
-
memory/1548-32-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1548-8-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1548-9-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1548-7-0x0000000000400000-0x00000000004AF000-memory.dmpFilesize
700KB
-
memory/1548-13-0x0000000000530000-0x0000000000579000-memory.dmpFilesize
292KB
-
memory/1548-10-0x0000000000530000-0x0000000000579000-memory.dmpFilesize
292KB
-
memory/1548-1-0x0000000000530000-0x0000000000579000-memory.dmpFilesize
292KB
-
memory/2840-15-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2840-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2840-23-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2840-21-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2840-19-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2840-27-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2840-17-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2840-30-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB