General

  • Target

    f2b7222978fa35c91ebf8bf2f6cc82ca_JaffaCakes118

  • Size

    380KB

  • Sample

    240923-vgczzatdpn

  • MD5

    f2b7222978fa35c91ebf8bf2f6cc82ca

  • SHA1

    b874df673b962b8be271fb4e99aee36e92aba1fa

  • SHA256

    4346d4ffe30e8d047302a42211e45fd5bfd88621376a5f507f1266e0f7a2fd50

  • SHA512

    488d4116f55bd3ba19cb258ec02252f631272ef81118958cf661cfa413c537174a7e9ed02c8d2321c1ba65d2c639aaab0fa9da4ceb5a020d6eadb1c449f4060c

  • SSDEEP

    6144:WRjfpbvNzGn6+MT1k6CW3e0dZfFgCZTdsmnElX9mzHsmaEJFLaXupTR5QWfd:WRjfHza6+M5ko1dTdxGmnOX9uhL+KT42

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      f2b7222978fa35c91ebf8bf2f6cc82ca_JaffaCakes118

    • Size

      380KB

    • MD5

      f2b7222978fa35c91ebf8bf2f6cc82ca

    • SHA1

      b874df673b962b8be271fb4e99aee36e92aba1fa

    • SHA256

      4346d4ffe30e8d047302a42211e45fd5bfd88621376a5f507f1266e0f7a2fd50

    • SHA512

      488d4116f55bd3ba19cb258ec02252f631272ef81118958cf661cfa413c537174a7e9ed02c8d2321c1ba65d2c639aaab0fa9da4ceb5a020d6eadb1c449f4060c

    • SSDEEP

      6144:WRjfpbvNzGn6+MT1k6CW3e0dZfFgCZTdsmnElX9mzHsmaEJFLaXupTR5QWfd:WRjfHza6+M5ko1dTdxGmnOX9uhL+KT42

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks