General

  • Target

    28ff5a07929044716b9882ba18ba0fb3_JaffaCakes118

  • Size

    64KB

  • Sample

    240706-vz1hzswhkq

  • MD5

    28ff5a07929044716b9882ba18ba0fb3

  • SHA1

    9c922bf09ece95d4c72389ccd3e224ee64d5c3a1

  • SHA256

    41d6256243b51cea257cabe91e980316109f20230a06d0074c97dd405e59bc2a

  • SHA512

    96de2bc7aa19ee62c300c994a3e83e2dce7f99c97bab53bd9940d764d41a56bf173d466666fa8efb37a7f495d9ff9e979dfff83ca5ea6e225c1b310bdece47a0

  • SSDEEP

    1536:gIzcC6DlS/59YvX9vft41hwCU6Cu+OUv:gMOlY9YPl1wjPZ

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      28ff5a07929044716b9882ba18ba0fb3_JaffaCakes118

    • Size

      64KB

    • MD5

      28ff5a07929044716b9882ba18ba0fb3

    • SHA1

      9c922bf09ece95d4c72389ccd3e224ee64d5c3a1

    • SHA256

      41d6256243b51cea257cabe91e980316109f20230a06d0074c97dd405e59bc2a

    • SHA512

      96de2bc7aa19ee62c300c994a3e83e2dce7f99c97bab53bd9940d764d41a56bf173d466666fa8efb37a7f495d9ff9e979dfff83ca5ea6e225c1b310bdece47a0

    • SSDEEP

      1536:gIzcC6DlS/59YvX9vft41hwCU6Cu+OUv:gMOlY9YPl1wjPZ

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks