metasploit | 14d7d42379fdfd4c49cc7f70ea1b9a1a6cd17c6fc274cf920c8020dfb7010e8c

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 22:59

Target
04462045c47dd272d10a89f78c82b573_JaffaCakes118.exe
Size 308KB
Sample240622-2yecpaydqf
SHA256 14d7d42379fdfd4c49cc7f70ea1b9a1a6cd17c6fc274cf920c8020dfb7010e8c
MD5 04462045c47dd272d10a89f78c82b573
SHA1 ebe93d36eaecb5bf2d9c86f1a6c623c9043fa446
SHA512 5d7c6c8af6f63703358cae123217d0daccf00c08b1830771d45ac1a43ca2a3e29ba38c9e8bd2b60e3c5c3403b6a75e436607d452de000f494c6b14d69be140fe
SSDEEP 6144:sDe2VXSMOeBiYKkiea/S3NiBXvz8Kwa/yrprmDpoljm:si2lSveBhjF30vANa/yrwl4m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3168	1292	04462045c47dd272d10a89f78c82b573_JaffaCakes118.exe	94
PID 1292 wrote to memory of 3168	1292	04462045c47dd272d10a89f78c82b573_JaffaCakes118.exe	94
PID 1292 wrote to memory of 3168	1292	04462045c47dd272d10a89f78c82b573_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\04462045c47dd272d10a89f78c82b573_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04462045c47dd272d10a89f78c82b573_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:3168

memory/1292-0-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download