metasploit | 21ee03b40610d47f2bc50312cfb7603ff712382935b902eadf2f4d9f62562bc1

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 16:14

Target
9b450e95a50c768c179d3c3a9dbcc259_JaffaCakes118.exe
Size 216KB
Sample240610-tpwavatbjp
SHA256 21ee03b40610d47f2bc50312cfb7603ff712382935b902eadf2f4d9f62562bc1
MD5 9b450e95a50c768c179d3c3a9dbcc259
SHA1 83e0979d6559a4d95d62c05e1bf0d19806534a64
SHA512 2b30a7c37c693600c33a4d2a36883aa9d32efe1bcf26d62a0d1ad2557a1c2dceff145c0a7f91bb893d737cb57a7ae2de3a8a63d5db3ff2aae9a0e2c8bc96ed7b
SSDEEP 3072:dyBEch9nqPK49QEySIqfm65jEdZHMDctEOSh4bIslduhu384sI9o:dyBERPK49QEtIqfm65gS0IO7X
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3904	1152	9b450e95a50c768c179d3c3a9dbcc259_JaffaCakes118.exe	95
PID 1152 wrote to memory of 3904	1152	9b450e95a50c768c179d3c3a9dbcc259_JaffaCakes118.exe	95
PID 1152 wrote to memory of 3904	1152	9b450e95a50c768c179d3c3a9dbcc259_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\9b450e95a50c768c179d3c3a9dbcc259_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b450e95a50c768c179d3c3a9dbcc259_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3896,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
1⤵
PID:2828

memory/1152-0-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1152-1-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/1152-3-0x0000000000400000-0x0000000000453000-memory.dmp

Download