metasploit | b9b1b010fa73851916f7c4137baf75926c1413ad78175b65d9db5705c4ac4670

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:47

Target

1c1b5b8115e116c18d1fbc22f73be568_JaffaCakes118.exe
Size

72KB
MD5

1c1b5b8115e116c18d1fbc22f73be568
SHA1

c9c90d9c2ce1d3100858323f2c36d9fef8d6ee8a
SHA256

b9b1b010fa73851916f7c4137baf75926c1413ad78175b65d9db5705c4ac4670
SHA512

79451de09bddd9bd31726212e171a5a3de25135b248b12fcd822b589a811ba998e3f78ce1b9376de86cdeb011b50b5370bdbc2da0e309903c49429e4298657eb
SSDEEP

1536:Ii1GShcYst0Z1roOicQOJWewTE2HcZJOMb+KR0Nc8Qs:F11hcHE1rKcQOwA2be0Nc8Qs

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1120	1596	WerFault.exe	82
4496	1596	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\1c1b5b8115e116c18d1fbc22f73be568_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c1b5b8115e116c18d1fbc22f73be568_JaffaCakes118.exe"
1⤵
PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 192
  2⤵
  - Program crash
  PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 184
  2⤵
  - Program crash
  PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1596 -ip 1596
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1596 -ip 1596
1⤵
PID:2080

memory/1596-0-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download