metasploit | 6dad1c90f06c2e2d2e3e9a4288ae4812814129678d0876d960ea7bd81551888f

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 15:07

Target

3abb7a1406539ab2076d4e0c46f17216_JaffaCakes118.vbs
Size

16KB
MD5

3abb7a1406539ab2076d4e0c46f17216
SHA1

3b734fbe6132bc632d38b21cf5d506e3a91d1354
SHA256

6dad1c90f06c2e2d2e3e9a4288ae4812814129678d0876d960ea7bd81551888f
SHA512

cfc9735d99092cfe96762c99a8218ded336da10cc39a2a903522aebe31b7107b61e7a78e13b42f323a05f99c5aa6703ce75c1975ffa670028e66809a2a833faf
SSDEEP

384:aNzlqK8oOrIOgiThHHsdQ0lz5q1QgE3LzTWEqmak44Cv7vKjshN4:axlqtIOVdsdFlz5mQgE3LzTWEqmYP7C/

Score

10^/10

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 4908 rundll32.exe

flow	pid	process
1	4908	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1716 wrote to memory of 4908	1716	WScript.exe	rundll32.exe
PID 1716 wrote to memory of 4908	1716	WScript.exe	rundll32.exe
PID 1716 wrote to memory of 4908	1716	WScript.exe	rundll32.exe
PID 1716 wrote to memory of 4908	1716	WScript.exe	rundll32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3abb7a1406539ab2076d4e0c46f17216_JaffaCakes118.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Blocklisted process makes network request
PID:4908

memory/1716-0-0x00007FFF52C15000-0x00007FFF52C16000-memory.dmp

Filesize
4KB

Download
memory/1716-1-0x00007FFF52960000-0x00007FFF53301000-memory.dmp

Filesize
9.6MB

Download
memory/1716-2-0x00000131F6770000-0x00000131F696A000-memory.dmp

Filesize
2.0MB

Download
memory/1716-3-0x00000131F5B70000-0x00000131F5B78000-memory.dmp

Filesize
32KB

Download
memory/1716-7-0x00007FFF52960000-0x00007FFF53301000-memory.dmp

Filesize
9.6MB

Download
memory/1716-6-0x00007FFF52960000-0x00007FFF53301000-memory.dmp

Filesize
9.6MB

Download
memory/4908-4-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download