Analysis
-
max time kernel
105s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 12:21
General
-
Target
f600dea87bf0709ebf4162b94bed35dd_JaffaCakes118.exe
-
Size
123KB
-
MD5
f600dea87bf0709ebf4162b94bed35dd
-
SHA1
dcc05693aec3bb6b257be2422072e4149af75e24
-
SHA256
590d78ff7ab35052737adf5f94819b31cd4ef9af89112ece5e59b76d99292e14
-
SHA512
dc5f1c57ee495e05c3bee2b66eecb465ccefc454f089ffe8505af1a13df6a3a727fbc68a33b2068b8a08bf0d41bd9512857425b1ed32a738b175437a6a4b7383
-
SSDEEP
3072:9b9Sb1K9HK4CTbdcsvFWj+eDafue7o0qQk0BVkY3Poutu:95SbwRK4CTbd9W7Dan7o0TBVkEPoS
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/shell_reverse_tcp
186.87.71.200:8081
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f600dea87bf0709ebf4162b94bed35dd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f600dea87bf0709ebf4162b94bed35dd_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
356KB
-
Filesize
4KB