General
- Target 112545ce8d8f7540ccb721fc48aae555_JaffaCakes118
- Size 31KB
- Sample240504-b4st6ada76
- SHA256 e317815f5173425f785998bea9e1f5c2951581877596941b5efe745f7483a6a6
- MD5 112545ce8d8f7540ccb721fc48aae555
- SHA1 98758407af0c9b716ac065ef6cbc6d5acd09d482
- SHA512 ddb2427a99b0321059f7adf4749c9ea43b1adf61c9d19e3533b098dccf0bd820434f565b55dffedc69e72e5562d524c299e8cfcd2fff1de310687256c1b779ce
- SSDEEP 768:/D1uBKyYbLkjBBqgXsgNe15Xg14sYv3NGn1zdAhWf5+Q+MrFLj+p/TY:/JuBKyYbLkjBBqgXsgNe15Xg1VYv3NG0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Behavioral task
behavioral1
Sample
112545ce8d8f7540ccb721fc48aae555_JaffaCakes118.xls
Resource
win7-20240221-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
112545ce8d8f7540ccb721fc48aae555_JaffaCakes118.xls
Resource
win10v2004-20240419-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
192.168.198.145:443
Targets
-
- Target 112545ce8d8f7540ccb721fc48aae555_JaffaCakes118
- Size 31KB
- SHA256 e317815f5173425f785998bea9e1f5c2951581877596941b5efe745f7483a6a6
- MD5 112545ce8d8f7540ccb721fc48aae555
- SHA1 98758407af0c9b716ac065ef6cbc6d5acd09d482
- SHA512 ddb2427a99b0321059f7adf4749c9ea43b1adf61c9d19e3533b098dccf0bd820434f565b55dffedc69e72e5562d524c299e8cfcd2fff1de310687256c1b779ce
- SSDEEP 768:/D1uBKyYbLkjBBqgXsgNe15Xg14sYv3NGn1zdAhWf5+Q+MrFLj+p/TY:/JuBKyYbLkjBBqgXsgNe15Xg1VYv3NG0
- MD5 SHA1 SHA512 SSDEEP
Score10/10MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.