metasploit | 5ed907dbad20604899e87d9da0e41f1a3e87cba9d93533f736d0ef9f28639340

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 04:41

Target

18a78b322bcc7dfabb02811cadea7967_JaffaCakes118.exe
Size

1.7MB
MD5

18a78b322bcc7dfabb02811cadea7967
SHA1

013621a68d0875e1c9c94745a8b945542eb2cf3d
SHA256

5ed907dbad20604899e87d9da0e41f1a3e87cba9d93533f736d0ef9f28639340
SHA512

1c74ede15f601b4a23da73585650f855a9aa704801a6eedf2c13b4c4d407e0420ccdcfad01d09856ba999bbebc5c7434913ce56195393b673d46d3ab067e7f8c
SSDEEP

49152:jG8+5WGKZrb/TMvO90dL3BmAFd4A64nsfJUM/gTR55Ib7gz1:jG5uGvP

Score

10^/10

Family

metasploit

Version

windows/reverse_tcp

127.0.0.1:444

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

go-memexec-916387047.exe

pid process

2476 go-memexec-916387047.exe

pid	process
2476	go-memexec-916387047.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

18a78b322bcc7dfabb02811cadea7967_JaffaCakes118.exe

description	pid	process	target process
PID 4520 wrote to memory of 2476	4520	18a78b322bcc7dfabb02811cadea7967_JaffaCakes118.exe	go-memexec-916387047.exe
PID 4520 wrote to memory of 2476	4520	18a78b322bcc7dfabb02811cadea7967_JaffaCakes118.exe	go-memexec-916387047.exe
PID 4520 wrote to memory of 2476	4520	18a78b322bcc7dfabb02811cadea7967_JaffaCakes118.exe	go-memexec-916387047.exe

C:\Users\Admin\AppData\Local\Temp\18a78b322bcc7dfabb02811cadea7967_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18a78b322bcc7dfabb02811cadea7967_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\go-memexec-916387047.exe
C:\Users\Admin\AppData\Local\Temp\go-memexec-916387047.exe
2⤵
- Executes dropped EXE
PID:2476

C:\Users\Admin\AppData\Local\Temp\go-memexec-916387047.exe
Filesize
72KB

MD5
95383025241f374407fa9df4ed3f8b0b

SHA1
24ff2573734655a371dc6f03778a85a4ee60e20b

SHA256
5bf2fd31d3e97d96878a00836dfb36ca45d4cc5e57c568a04a12a2d6313590a9

SHA512
e04fe742d6787825eef4b1ec7e99b0e191144351d0c0600377cbba03ab78f3dc75712ecabe6449b6673e9de3ee467c2e17963ffb8f3cae0a04a75b13cadb1b1d

Download Submit
memory/2476-4-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download