Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 07:32

General

  • Target

    040e493067d91d59ca9a69c12d070212_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    040e493067d91d59ca9a69c12d070212

  • SHA1

    be4c68e85a77c7323e3a08c33492d6ec1dd763b7

  • SHA256

    f313c28a96fa229d96065668431fe24ab36739fa6010c66932b5690def862dce

  • SHA512

    2c2631b25d1829ad9dae82f9e5a8814d2fb3917f7d165042560f6a5ebd1884cb2336a5d8293c7c53ff62f7f3661ef62fe883e3ffd9d7c0fd0693a62cf458eb03

  • SSDEEP

    1536:II5gf4aAnnZgIMMzwuPh8hHlBnVoO8Mb+KR0Nc8QsJq39:tdL/wuZ4LR8e0Nc8QsC9

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\040e493067d91d59ca9a69c12d070212_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\040e493067d91d59ca9a69c12d070212_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\SysWOW64\cmd.exe
      cmd
      2⤵
        PID:2056

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2352-0-0x0000000000020000-0x0000000000021000-memory.dmp
      Filesize

      4KB