metasploit | a0c24b1eebf120fb0d466e8b01c08c5586b500a4bb1e56cba346936ed7dd7d10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 17:09

Target

f3efa8e3ef02723f7cada0ec70c10073_JaffaCakes118.exe
Size

480KB
MD5

f3efa8e3ef02723f7cada0ec70c10073
SHA1

597055975903db29a9e52968f116b93976d45f84
SHA256

a0c24b1eebf120fb0d466e8b01c08c5586b500a4bb1e56cba346936ed7dd7d10
SHA512

232a49b706a10b834f0fc2af404cc3e3950f4ddf8a6af3c392c9713d46a50ce0ad03c26663cf3f95b422c760174bed54e38d8c0c95ce5e47092854ed807e3ae4
SSDEEP

12288:s743NHanev1s4kd83ubHX2+v1g8YyCCTlaG9PnV6I:ogN6nY13ebHX2+tlNl7V6

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
768	5028	WerFault.exe	f3efa8e3ef02723f7cada0ec70c10073_JaffaCakes118.exe
1180	5028	WerFault.exe	f3efa8e3ef02723f7cada0ec70c10073_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f3efa8e3ef02723f7cada0ec70c10073_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3efa8e3ef02723f7cada0ec70c10073_JaffaCakes118.exe"
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 548
2⤵
- Program crash
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 948
2⤵
- Program crash
PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5028 -ip 5028
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5028 -ip 5028
1⤵
PID:3052

memory/5028-0-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/5028-1-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download