Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-09-2024 08:21
General
-
Target
dc1dfba31b85f94cc5e321c0a9f4807a_JaffaCakes118.exe
-
Size
46KB
-
MD5
dc1dfba31b85f94cc5e321c0a9f4807a
-
SHA1
64de2e606362ed548f4c0c85cdc83b5e342f36ef
-
SHA256
9f478bc1a43b8e07a69a993da856967e816db8894ab2be7b6180adc62af54150
-
SHA512
9acb7445d10222dd7dd71fd050730df1d5d292dc8bb9a03456a0ee7904fccf970bb3f26984f78e1694d06420aff06d88fa796e8589678e0602dc6b879ee2d574
-
SSDEEP
768:Iy95FvSErx3qsqbsmleFtdMibv6+PibMEBwY7qZt7+KcevhRq7jGTq3:IynFqAxa1b9iFilBVU7+30hA7Iq3
Malware Config
Extracted
metasploit
windows/download_exec
http://slicky.myvnc.com:80/INITM
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc1dfba31b85f94cc5e321c0a9f4807a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc1dfba31b85f94cc5e321c0a9f4807a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
100KB