metasploit | d909f7803768e385aa99ce982a5a4814fb88674bdb2b100999d0387dbb96472d

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 23:13

Target

f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe
Size

7KB
MD5

f6c89285fe6c7f1291a4ad68c02da235
SHA1

b76f868e4ddd9faaba60a1dc98ed039806395aa4
SHA256

d909f7803768e385aa99ce982a5a4814fb88674bdb2b100999d0387dbb96472d
SHA512

e1ab1390a9c53c45ab7119b80990a0092876f2039daf4103c6ee0d5c393bfc79c9c777778333839dfd094b81974e894990a8541bc6aa694c94f51e1a5bae8aba
SSDEEP

96:/mbLb+V6BKaVXawWD4/woeE3nlxJlbLYU4wBhymZTzuzNtL:/cP5BFRlz/dfbL+2kmZXod

Score

10^/10

Family

metasploit

Version

windows/exec

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe

description	pid	process	target process
PID 1268 wrote to memory of 2728	1268	f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe	calc.exe
PID 1268 wrote to memory of 2728	1268	f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe	calc.exe
PID 1268 wrote to memory of 2728	1268	f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe	calc.exe
PID 1268 wrote to memory of 2728	1268	f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6c89285fe6c7f1291a4ad68c02da235_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268

memory/1268-0-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/1268-1-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1268-3-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1268-2-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/1268-5-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download