Analysis
-
max time kernel
105s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03/11/2024, 07:01
General
-
Target
8a2ed4388a1256315096dc8d91a47d19_JaffaCakes118.exe
-
Size
171KB
-
MD5
8a2ed4388a1256315096dc8d91a47d19
-
SHA1
e8b1cce1d3a86a0cb909f3cc8160d89a56c9ba53
-
SHA256
a315964ee934089813d146fe23050c3e3605625fc54d482b854aba68ba0affbf
-
SHA512
ff3524ad899479cba09d1ac8f123d6b8533f7b5b744ea51858473e0626becec36e05b5221a08b4937db22c843e617a1a6e5e142e7f527379c405094d8adcaf1d
-
SSDEEP
3072:R49KfNiNVv12lqyQe9Fk4fTBQNzLwPCv1MDPpsfd9ok:K9IsNVvI4pik4rBsilDParT
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
192.168.123.18:443
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a2ed4388a1256315096dc8d91a47d19_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a2ed4388a1256315096dc8d91a47d19_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
-
Filesize
4KB
-
Filesize
252KB