General

  • Target

    21765f63172870bb8292795f00439963_JaffaCakes118

  • Size

    308KB

  • Sample

    240507-yh1zzafb69

  • MD5

    21765f63172870bb8292795f00439963

  • SHA1

    c875b785fc7394c3c1f7eddd3245c832cb75f4b3

  • SHA256

    83ca149ecde483d012d0738afe33632dec8041ee8bf14719ffb1911a96e35e35

  • SHA512

    2b1584399bc8460e9a3d7d6d2730b6e15d9866b5bec5d2dce10b314cb8b29e42f2c5fcce5f611c7e660a7a09d366c6ed5228d38c51e6966efce15772a9168b01

  • SSDEEP

    6144:wdEYL1jOJyNtqq8h/1MWHWqEnmz3CWb6qacZ2yNiaWq+CTVtdE:oBjTfcq5HmLROdRtx8Tv2

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

10.0.1.11:4444

Targets

    • Target

      21765f63172870bb8292795f00439963_JaffaCakes118

    • Size

      308KB

    • MD5

      21765f63172870bb8292795f00439963

    • SHA1

      c875b785fc7394c3c1f7eddd3245c832cb75f4b3

    • SHA256

      83ca149ecde483d012d0738afe33632dec8041ee8bf14719ffb1911a96e35e35

    • SHA512

      2b1584399bc8460e9a3d7d6d2730b6e15d9866b5bec5d2dce10b314cb8b29e42f2c5fcce5f611c7e660a7a09d366c6ed5228d38c51e6966efce15772a9168b01

    • SSDEEP

      6144:wdEYL1jOJyNtqq8h/1MWHWqEnmz3CWb6qacZ2yNiaWq+CTVtdE:oBjTfcq5HmLROdRtx8Tv2

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

MITRE ATT&CK Enterprise v15

Tasks