metasploit | 921824355fea6d9b9858fdd133049040107bad179ae9363073dade896e37e4a0

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:56

Target

46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe
Size

264KB
MD5

46b35bea84564f35bdb23085aa3dad6e
SHA1

1cbccac474f7fbf92a71c3fe4f4bd1eefe6925dc
SHA256

921824355fea6d9b9858fdd133049040107bad179ae9363073dade896e37e4a0
SHA512

d1fd9f3c2ab835c29cf1af3cb810742187cb7181c22ac9db33f1ae1ca962316f4327307c5ecdcdafd2f8e34af03b60624acc32ac1d90bae90cc741b7d183cef4
SSDEEP

3072:LT28W9YPtyW25amH+V1tLFxldMgZtxwtnPZOGqaO7C+BOradJXPQj:LT286ZvCDZ3yn0Gqbe+BOOw

Score

10^/10

Family

metasploit

Version

encoder/call4_dword_xor

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2708-5-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2708-9-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2708-8-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2708-7-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2708-4-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2708-2-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2708-11-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 824 set thread context of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	2708	WerFault.exe	30

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 824 wrote to memory of 2708	824	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2732	2708	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	31
PID 2708 wrote to memory of 2732	2708	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	31
PID 2708 wrote to memory of 2732	2708	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	31
PID 2708 wrote to memory of 2732	2708	46b35bea84564f35bdb23085aa3dad6e_JaffaCakes118.exe	31

memory/2708-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2708-5-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2708-9-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2708-8-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2708-7-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2708-4-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2708-2-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2708-11-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download