metasploit | 29cd19a547dc9b9f066496e8cb18008da0742cd4335b98a6439e15d823cdb0f6

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 12:36

Target
0b82118d4bedef3dbfab67317bc19815_JaffaCakes118.exe
Size 72KB
Sample240621-ps8ywstemm
SHA256 29cd19a547dc9b9f066496e8cb18008da0742cd4335b98a6439e15d823cdb0f6
MD5 0b82118d4bedef3dbfab67317bc19815
SHA1 f4121b5ce1a706049770e6b0cb9d4f3719bc869f
SHA512 2bc8904232acebe12e61f757c3c8a8b7117f1327f43ce7ca43819500640313150f9102df8182e427a7bc6cddffb54e9c375181ed1ec14da4625ece8e2aca7dc6
SSDEEP 1536:I/j6DXHPU1esjM7EsREBZ1O1jLWMb+KR0Nc8QsJq39:w67H81esoi1KjLWe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 2608	4044	0b82118d4bedef3dbfab67317bc19815_JaffaCakes118.exe	101
PID 4044 wrote to memory of 2608	4044	0b82118d4bedef3dbfab67317bc19815_JaffaCakes118.exe	101
PID 4044 wrote to memory of 2608	4044	0b82118d4bedef3dbfab67317bc19815_JaffaCakes118.exe	101

C:\Users\Admin\AppData\Local\Temp\0b82118d4bedef3dbfab67317bc19815_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b82118d4bedef3dbfab67317bc19815_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4624,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
1⤵
PID:4472

memory/4044-0-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download