Analysis
-
max time kernel
135s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 15:07
Static task
static1
Behavioral task
behavioral1
Sample
3abb7a1406539ab2076d4e0c46f17216_JaffaCakes118.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3abb7a1406539ab2076d4e0c46f17216_JaffaCakes118.vbs
Resource
win10v2004-20240426-en
General
-
Target
3abb7a1406539ab2076d4e0c46f17216_JaffaCakes118.vbs
-
Size
16KB
-
MD5
3abb7a1406539ab2076d4e0c46f17216
-
SHA1
3b734fbe6132bc632d38b21cf5d506e3a91d1354
-
SHA256
6dad1c90f06c2e2d2e3e9a4288ae4812814129678d0876d960ea7bd81551888f
-
SHA512
cfc9735d99092cfe96762c99a8218ded336da10cc39a2a903522aebe31b7107b61e7a78e13b42f323a05f99c5aa6703ce75c1975ffa670028e66809a2a833faf
-
SSDEEP
384:aNzlqK8oOrIOgiThHHsdQ0lz5q1QgE3LzTWEqmak44Cv7vKjshN4:axlqtIOVdsdFlz5mQgE3LzTWEqmYP7C/
Malware Config
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 1 4908 rundll32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WScript.exedescription pid process target process PID 1716 wrote to memory of 4908 1716 WScript.exe rundll32.exe PID 1716 wrote to memory of 4908 1716 WScript.exe rundll32.exe PID 1716 wrote to memory of 4908 1716 WScript.exe rundll32.exe PID 1716 wrote to memory of 4908 1716 WScript.exe rundll32.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3abb7a1406539ab2076d4e0c46f17216_JaffaCakes118.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1716-0-0x00007FFF52C15000-0x00007FFF52C16000-memory.dmpFilesize
4KB
-
memory/1716-1-0x00007FFF52960000-0x00007FFF53301000-memory.dmpFilesize
9.6MB
-
memory/1716-2-0x00000131F6770000-0x00000131F696A000-memory.dmpFilesize
2.0MB
-
memory/1716-3-0x00000131F5B70000-0x00000131F5B78000-memory.dmpFilesize
32KB
-
memory/1716-7-0x00007FFF52960000-0x00007FFF53301000-memory.dmpFilesize
9.6MB
-
memory/1716-6-0x00007FFF52960000-0x00007FFF53301000-memory.dmpFilesize
9.6MB
-
memory/4908-4-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB