Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 06:31
Static task
static1
Behavioral task
behavioral1
Sample
278ff709c033015ad27ec9d8efff4ba8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
278ff709c033015ad27ec9d8efff4ba8_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
278ff709c033015ad27ec9d8efff4ba8_JaffaCakes118.exe
-
Size
72KB
-
MD5
278ff709c033015ad27ec9d8efff4ba8
-
SHA1
38692efe581e0c2f3a3e5145e5566dfc64788ee2
-
SHA256
91a92317a83eeae8c79f611337d0672cc81708619ca00e5732b4ef1cbdc1b1b5
-
SHA512
32c8d65b7cc9b3edcb4ab7184e484f9301e6b0d1d8f0b306605ea0588bfe4f212d3e4d65f94caa2024ae32250c8936555ad1b2e1eac01dd6bcd935cc5e7c472c
-
SSDEEP
1536:IAMYbWRfSlHk8dV0qBoYK2G798Mb+KR0Nc8QsJq39:LiwRk8VklKe0Nc8QsC9
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3696 2904 WerFault.exe 81 868 2904 WerFault.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\278ff709c033015ad27ec9d8efff4ba8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\278ff709c033015ad27ec9d8efff4ba8_JaffaCakes118.exe"1⤵PID:2904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 2602⤵
- Program crash
PID:3696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 2682⤵
- Program crash
PID:868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2904 -ip 29041⤵PID:2932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2904 -ip 29041⤵PID:2280