Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15/07/2024, 19:25
General
-
Target
4b130b34030a3a86dfe2ccab118700f8_JaffaCakes118.exe
-
Size
4KB
-
MD5
4b130b34030a3a86dfe2ccab118700f8
-
SHA1
87505e60b2dbd08d6087815ac264d6bf6efd5a23
-
SHA256
879a7f3e67233135044df6364c507a5da19f1bb79f611cb19141986e26a7a917
-
SHA512
3edb8c46cc4d0a7946b9b026b05920fb0dc441d5d02caf770b0067c25770686e20a2d7ea98938abf4534d36138dcd0aa211742fe9e5229992f952ba42456d048
-
SSDEEP
96:1MJHOGrYN/6GKTxtxhAZ9yfq+YhMfIS/WB:iRUNiTxtMyf8CIS/WB
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b130b34030a3a86dfe2ccab118700f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4b130b34030a3a86dfe2ccab118700f8_JaffaCakes118.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 2202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 2602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3024 -ip 30241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3024 -ip 30241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
16KB