Analysis

  • max time kernel
    105s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-07-2024 14:02

General

  • Target

    4621aa0ffe4005dc7b5cc918cc7daffb_JaffaCakes118.exe

  • Size

    47KB

  • MD5

    4621aa0ffe4005dc7b5cc918cc7daffb

  • SHA1

    a9ff5499dd9836fa5755e40b2b5f3e27540a1b5d

  • SHA256

    7085b9ae1fc9b45af16e3c9a839f0614fccdf8318d06596e4acb2a146b322a1c

  • SHA512

    ab59936157f3597da899b0b3e86ad34322099b3b966c0bc989f5c8cdfcba6e26cfe56ab557b64467880ae3c36f77a28764667a82cd0fa4ea0c7bf151017d527a

  • SSDEEP

    768:58n9HTiKPcc3LwlbsQ0SRSGOdKldqtm8D36comLa3TDCfxiQ1SOeQkXq3I:58ntmKUc7bQPZMKlotQHCf0yoXq3I

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.1.103:4444

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4621aa0ffe4005dc7b5cc918cc7daffb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4621aa0ffe4005dc7b5cc918cc7daffb_JaffaCakes118.exe"
    1⤵
      PID:956

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/956-0-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/956-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

      Filesize

      4KB

    • memory/956-2-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB