metasploit | d26fca1218120a9f0304c6d06ccbaf7b1891edf9a58ab808197aa73459b5afa3

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 14:50

Target

4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe
Size

243KB
MD5

4a235ba58cbe5f002c3c9df13a90d284
SHA1

0b3a878119ca739d90d34696480a60418d0cc647
SHA256

d26fca1218120a9f0304c6d06ccbaf7b1891edf9a58ab808197aa73459b5afa3
SHA512

9b27c792c3102db514ceadc640a38a2e251390efb9d3dbd12dcc1589d9c362d067ba75990be980dcccc4741a4663e03f9d03031911ee885163a224c07bba75a8
SSDEEP

6144:NNh6b+z4AKoesoeOxNbjBIIhtScL32x78qLKXjJ:38KkAKoejew/BIySRx7pKV

Score

10^/10

Family

metasploit

Version

encoder/call4_dword_xor

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1784-5-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1784-6-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1784-4-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1784-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1784-8-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1784-11-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1784-9-0x0000000000400000-0x000000000044E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	1784	WerFault.exe	30

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 2440 wrote to memory of 1784	2440	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	30
PID 1784 wrote to memory of 1804	1784	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	31
PID 1784 wrote to memory of 1804	1784	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	31
PID 1784 wrote to memory of 1804	1784	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	31
PID 1784 wrote to memory of 1804	1784	4a235ba58cbe5f002c3c9df13a90d284_JaffaCakes118.exe	31

memory/1784-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-4-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-8-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-11-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-9-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download