General

  • Target

    e48cb72b16cbffb605551ad83f758702_JaffaCakes118

  • Size

    29KB

  • Sample

    240916-l72atasarl

  • MD5

    e48cb72b16cbffb605551ad83f758702

  • SHA1

    afe6a611cad5418fd7c48d1496ef0762c4254d70

  • SHA256

    e28411bab38e50003e33fc22b0a3ef99dda6489994f76089d8e392b905c3e447

  • SHA512

    8dd1ee54eebb4a09c2627129233792fdc7b71464d5caa5070dc61c83e7c832e3f2a19732c59764976c2da8ad6ad138ce997e85eddd9146d5e38e9139e99bca85

  • SSDEEP

    768:DLe/oQbI8MykvfC9TXiPw7pQb1PLBVCs56ZfNUs+MXA:DCzUykvGpAVBhyMMXA

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      e48cb72b16cbffb605551ad83f758702_JaffaCakes118

    • Size

      29KB

    • MD5

      e48cb72b16cbffb605551ad83f758702

    • SHA1

      afe6a611cad5418fd7c48d1496ef0762c4254d70

    • SHA256

      e28411bab38e50003e33fc22b0a3ef99dda6489994f76089d8e392b905c3e447

    • SHA512

      8dd1ee54eebb4a09c2627129233792fdc7b71464d5caa5070dc61c83e7c832e3f2a19732c59764976c2da8ad6ad138ce997e85eddd9146d5e38e9139e99bca85

    • SSDEEP

      768:DLe/oQbI8MykvfC9TXiPw7pQb1PLBVCs56ZfNUs+MXA:DCzUykvGpAVBhyMMXA

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Drops file in Drivers directory

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks