metasploit | ac230042be32ae41358e3595d1d534592d996264e71f7c930697efa2e3d14943

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 02:05

Target

15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe
Size

9KB
MD5

15cea4ee77457d9c5b10bd6c1b447f12
SHA1

eb3de54578c9d8d0dd49c0a6fd3f2e55e22118bb
SHA256

ac230042be32ae41358e3595d1d534592d996264e71f7c930697efa2e3d14943
SHA512

c8bb4b26873fb640fb906a7cd37e29ce774d459f3fe35492227f0d9cc67f91d77699ef81f31b4bff754ee35dae20f7b38eebf3b20cc1d8479f58757f4293cac1
SSDEEP

192:dmlYlvrYmJIjnjOmj87E5pz6XVSN/25MEq:ElErVJgnj87INe5MEq

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe

description	pid	process	target process
PID 936 wrote to memory of 2388	936	15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe	calc.exe
PID 936 wrote to memory of 2388	936	15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe	calc.exe
PID 936 wrote to memory of 2388	936	15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe	calc.exe
PID 936 wrote to memory of 2388	936	15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15cea4ee77457d9c5b10bd6c1b447f12_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936

memory/936-0-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download