metasploit | 6b6e26f45afd287f7e04072a30268891bd88a58c114e780fdcc9ab3be3288964

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 20:24

Target

2b8bc7d2c08fe87af682d4c0685cfce0_JaffaCakes118.exe
Size

72KB
MD5

2b8bc7d2c08fe87af682d4c0685cfce0
SHA1

c4ea61f643e26af344fb3466fdefae79fc72bd21
SHA256

6b6e26f45afd287f7e04072a30268891bd88a58c114e780fdcc9ab3be3288964
SHA512

5a614a246c3e64b72af8028b7f7c2322f0635339abe7dedb31707c70d012d6df1a3e16f73e2bb347872909bc17928f74e22a3f6e4c19a9cb138f76c32e2227d0
SSDEEP

1536:IbTV7wYtrezSdgvUekCpyhDdeMb+KR0Nc8QsJq39:iaCy+mUeW6e0Nc8QsC9

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4888	1520	WerFault.exe	2b8bc7d2c08fe87af682d4c0685cfce0_JaffaCakes118.exe
4024	1520	WerFault.exe	2b8bc7d2c08fe87af682d4c0685cfce0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2b8bc7d2c08fe87af682d4c0685cfce0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b8bc7d2c08fe87af682d4c0685cfce0_JaffaCakes118.exe"
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 260
2⤵
- Program crash
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 280
2⤵
- Program crash
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1520 -ip 1520
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1520 -ip 1520
1⤵
PID:3976

memory/1520-0-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download