metasploit | 3e3ddd4761c4e0990b3a6da07a4150e943d1052d2c1a23aa0ceae34825577b23

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 20:38

Target
03cbb412f08a849c0aa9218b6fd961f7_JaffaCakes118.exe
Size 72KB
Sample240622-zer4bstbje
SHA256 3e3ddd4761c4e0990b3a6da07a4150e943d1052d2c1a23aa0ceae34825577b23
MD5 03cbb412f08a849c0aa9218b6fd961f7
SHA1 0cd5f41afdd3b7d4485a44326e3cdc73a3221de5
SHA512 95fdde1251a734ed2e05289b4ff7a4146f9cf1e1e8b2206222c45887e8b6e0ef5ce22a3b0b2a1bd48d0d90ce30afd85b9624cb967a4570605e15e6716db52829
SSDEEP 1536:IuMNTTkgZGQoMhDTi/SN78LLrCdse75Mb+KR0Nc8QsJq39:kTTkgBn3iaNSCds65e0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	202.134.32.78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3768	5072	03cbb412f08a849c0aa9218b6fd961f7_JaffaCakes118.exe	93
PID 5072 wrote to memory of 3768	5072	03cbb412f08a849c0aa9218b6fd961f7_JaffaCakes118.exe	93
PID 5072 wrote to memory of 3768	5072	03cbb412f08a849c0aa9218b6fd961f7_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\03cbb412f08a849c0aa9218b6fd961f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03cbb412f08a849c0aa9218b6fd961f7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:3768

memory/5072-0-0x0000000000770000-0x0000000000771000-memory.dmp

Download