Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-09-2024 05:14

General

  • Target

    e61e537ec9ef36fb87796bd1c9aeda1b_JaffaCakes118.exe

  • Size

    2.0MB

  • MD5

    e61e537ec9ef36fb87796bd1c9aeda1b

  • SHA1

    f41e4e062c56c1ff1e3ea094c951192f5bd7740d

  • SHA256

    bc11fde3ed27f54bb1bb2ce983ecacc195c412d38a2f0fb4df54c8dd6e22c5be

  • SHA512

    3932017e6fe47b55da1d671079bfac520c637e505064b12f5bcdda9839a9676f424acdb26bce6e31021a52769fe01411b4e301115de39c70aae51199087d8cf7

  • SSDEEP

    24576:eda8u3G0eSaU2az1+meg7iWhYvEp7HFqSCmHQuQk+Ec0xMkU8JsU3Aobd0Mzjkx4:8a8u3G0a3az177iWh0fQKYd0MzjkxwF

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e61e537ec9ef36fb87796bd1c9aeda1b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e61e537ec9ef36fb87796bd1c9aeda1b_JaffaCakes118.exe"
    1⤵
      PID:2844

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2844-0-0x0000000000400000-0x0000000000530000-memory.dmp

      Filesize

      1.2MB

    • memory/2844-1-0x00000000009B0000-0x00000000009E2000-memory.dmp

      Filesize

      200KB