metasploit | aeeb040c522ccec4141c3df6e6b878cbb2a22005fbaedae4d5b16affdc40232f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55333b77bfda14fa7d66b27458b7f1be_JaffaCakes118.exe
Size

88KB
MD5

55333b77bfda14fa7d66b27458b7f1be
SHA1

32ecdee24bd5a95f0b7f48b64e0156a74e39a9ec
SHA256

aeeb040c522ccec4141c3df6e6b878cbb2a22005fbaedae4d5b16affdc40232f
SHA512

04d507040af78ac515ccf99b1c68a0bd3e0661cd50660117c63b58acd53fc884572b39373b5fe04edb92f2f05594bc735c936476403e5bc25108b39ae724b279
SSDEEP

1536:IJk+p/TcVYAH9/D0gco5a1qWJ0YY35/6PkiEmMbcKR0Nc8QsJq3:Mk6/TM/D1cu6YpskiEmo0Nc8QsC

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

70.122.201.49:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55333b77bfda14fa7d66b27458b7f1be_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\55333b77bfda14fa7d66b27458b7f1be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\55333b77bfda14fa7d66b27458b7f1be_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download