Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
01-10-2024 03:11
General
-
Target
042925a1afb978f1f52224c75f03fd76_JaffaCakes118.exe
-
Size
197KB
-
MD5
042925a1afb978f1f52224c75f03fd76
-
SHA1
f631a63572b0628d7108ea16712f373c5d3f25c1
-
SHA256
27459dcf8b5f8db53dc1d6c3ae39503a70f80c744107f5f5444223bc11c36d3c
-
SHA512
fb099619c1951d8153ef546abcf22745c050518f544501febba4bd0d50df219a3ac5edcc34f0d9a20cdd2112c4b0aa9009aad8f2a886634f20062f92f27d42c2
-
SSDEEP
3072:t6LOKpt/qmUndzx+mQ1hpPvcsuqifJNg0kcq8xi6UiRh57Nz:ybqmUndx+11hpPvMxNg0kcpwiN
Malware Config
Extracted
metasploit
windows/download_exec
http://121.4.41.2:80/Isl4
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\042925a1afb978f1f52224c75f03fd76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\042925a1afb978f1f52224c75f03fd76_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB