metasploit | babc36457d3fa6435266c8d598f1f47d2b8348d5c29a4c87527005c2c836333a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 21:16

Target

f5605709b88f4b9ace8337c29da1b378_JaffaCakes118.exe
Size

60KB
MD5

f5605709b88f4b9ace8337c29da1b378
SHA1

d200a2041446d12f3086516f83c375bec432a8af
SHA256

babc36457d3fa6435266c8d598f1f47d2b8348d5c29a4c87527005c2c836333a
SHA512

956e1714e2d2c4d3f56fea63fb1ff95e026f91f572389c97dd75c61c73fe2dfb1af9b8650954e76f16e3c74c349d07933e0ea7ea69e03bdd7434c62305f8a131
SSDEEP

1536:BsgIm1Ia0usczq8e3wx6H6OSb01XjLWU:BsgZ1INcjOpu

Score

10^/10

Family

metasploit

Version

encoder/fnstenv_mov

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f5605709b88f4b9ace8337c29da1b378_JaffaCakes118.exe

pid process

1116 f5605709b88f4b9ace8337c29da1b378_JaffaCakes118.exe

pid	process
1116	f5605709b88f4b9ace8337c29da1b378_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5605709b88f4b9ace8337c29da1b378_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5605709b88f4b9ace8337c29da1b378_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:1116

memory/1116-1-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/1116-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1116-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1116-2-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/1116-9-0x0000000000320000-0x0000000000343000-memory.dmp

Filesize
140KB

Download
memory/1116-8-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download