Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 13:11
General
-
Target
eb66fa4da4302a452084adbd95d70201_JaffaCakes118.exe
-
Size
51KB
-
MD5
eb66fa4da4302a452084adbd95d70201
-
SHA1
429cf0863a87e372b447e092f4c67b9ca1b7476a
-
SHA256
d5c0564d32e918275d9b2191b5103a3d61f813db127aed59ec7dac029e6b49b5
-
SHA512
ba7077376acc85bf987b652efe04df037c911ff1430db18472bc678520904998af8a3ad7849f813f64dca4e053f85328088e7a16f4e2398cf0f5cddbc67e8736
-
SSDEEP
768:sblDCHUOheZwfQPNGiXQqtKIrqc8P5hUTDM9K3c+GZIgk6XFmLdQfsv2XiDkR:klDCTheZjXQqYrFwDdc856XzK2Xi
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb66fa4da4302a452084adbd95d70201_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb66fa4da4302a452084adbd95d70201_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
256KB