General

  • Target

    e556d7813c977fc360cbb52697915334_JaffaCakes118

  • Size

    480KB

  • Sample

    240916-wtdmpssdrj

  • MD5

    e556d7813c977fc360cbb52697915334

  • SHA1

    ad397272fa4e477843392c1483529dae8ba08e52

  • SHA256

    4c3f6fd30bd0fbffee37cfe923f1bcc426aacbd76eb393a832466ae2c703b71d

  • SHA512

    1a454f2fb909d989122a5b9116234f4a95d819db63e9ee9e445db09b4a9f474cb55cc59d8d198294b2748cfd6a66b73b118a2cea168d6f3e3ea2fcf9e06785c2

  • SSDEEP

    6144:VNi0C7+KQ8ISTJ4/FmdYBxT9FzbHc31pLYm4Kf0Y35iZZSHCX61Hs0yqFf42vMJS:biz/IMaNBxa/9iCnCJqxLvf2KnLdx

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      e556d7813c977fc360cbb52697915334_JaffaCakes118

    • Size

      480KB

    • MD5

      e556d7813c977fc360cbb52697915334

    • SHA1

      ad397272fa4e477843392c1483529dae8ba08e52

    • SHA256

      4c3f6fd30bd0fbffee37cfe923f1bcc426aacbd76eb393a832466ae2c703b71d

    • SHA512

      1a454f2fb909d989122a5b9116234f4a95d819db63e9ee9e445db09b4a9f474cb55cc59d8d198294b2748cfd6a66b73b118a2cea168d6f3e3ea2fcf9e06785c2

    • SSDEEP

      6144:VNi0C7+KQ8ISTJ4/FmdYBxT9FzbHc31pLYm4Kf0Y35iZZSHCX61Hs0yqFf42vMJS:biz/IMaNBxa/9iCnCJqxLvf2KnLdx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks