metasploit | d085afb656f664c6492355cc6bf3e6cf6f76420fbfeac21009baec2d19e987b1

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe689f470ae3177a2f930e5522f916ba_JaffaCakes118.exe
Size

1.7MB
MD5

fe689f470ae3177a2f930e5522f916ba
SHA1

34f3d685fd737ad2dbf014778bae7fa3dd295225
SHA256

d085afb656f664c6492355cc6bf3e6cf6f76420fbfeac21009baec2d19e987b1
SHA512

d3406b1715ff82dbfeff953126903cb529bf4dee9e3f401d5fd85697d87adbbfe56feb0360a1fc81592f17ea10906f78c2dc11315534f955cb939f4fff9254a5
SSDEEP

24576:e4fXSohkQN+CeoJ2Gag+XxSTP0FscwM+n1Y1piSsGPYzIbC/liB0olLXU600phhi:XfXSoCQNeh/gIxST3pTY+SsG/tlLfhRo

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.89.128:6732

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fe689f470ae3177a2f930e5522f916ba_JaffaCakes118.exe

description	pid	process	target process
PID 2336 wrote to memory of 2192	2336	fe689f470ae3177a2f930e5522f916ba_JaffaCakes118.exe	WerFault.exe
PID 2336 wrote to memory of 2192	2336	fe689f470ae3177a2f930e5522f916ba_JaffaCakes118.exe	WerFault.exe
PID 2336 wrote to memory of 2192	2336	fe689f470ae3177a2f930e5522f916ba_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fe689f470ae3177a2f930e5522f916ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe689f470ae3177a2f930e5522f916ba_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2336 -s 36
2⤵
PID:2192

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads