metasploit | 93dfeab95f0eec73d64836326103388098fe784a1549c111f569915a4ae2f7a3

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 20:53

Target
00626085f40c9cc27572a73e0c480324_JaffaCakes118.exe
Size 72KB
Sample240623-zpmxcs1epf
SHA256 93dfeab95f0eec73d64836326103388098fe784a1549c111f569915a4ae2f7a3
MD5 00626085f40c9cc27572a73e0c480324
SHA1 20d74695c0c8e8c9681b7fb73b4a3bf2dc49c197
SHA512 1041e772fc1073224bd17875dcfc45ea1df0fdd0dd761e54d3e69348eed12ac42f4d45ed3ff72852636326348859f599531e2c679b011b49d7a6f83f692b58f1
SSDEEP 1536:ICKaJDXnpLdmP83+UOZewX6inDo7RkcdyHMb+KR0Nc8QsJq39:JKaJDTm03+UOAwXvDykgyHe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1464	1720	WerFault.exe	80
1920	1720	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\00626085f40c9cc27572a73e0c480324_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00626085f40c9cc27572a73e0c480324_JaffaCakes118.exe"
1⤵
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 260
  2⤵
  - Program crash
  PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 268
  2⤵
  - Program crash
  PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 1720
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1720 -ip 1720
1⤵
PID:4592

memory/1720-0-0x0000000000560000-0x0000000000561000-memory.dmp

Download