General

  • Target

    9e37111bb4c2dd9440d2eaca87b5cd65_JaffaCakes118

  • Size

    46KB

  • Sample

    241125-18mldawmdp

  • MD5

    9e37111bb4c2dd9440d2eaca87b5cd65

  • SHA1

    8f4e3aa93e86d989165a987fe62e15a4d42d1ac9

  • SHA256

    dc835aafd9193888aabd764f99b86b1da28341292e4dccc0ec9d84b0a5a72122

  • SHA512

    458f9d09ad10df19f06336703a660bca98299353369a4e23dfa55960d68374b42963c08491249c920128f33ecfa7d708efbe925027706ab5843db48402912082

  • SSDEEP

    768:BJ1RnSYMGCj5qRexIKwONZ9jPiOyX8gSdof1mvMpQc0rCSjpVeoYk4tBQVcM:BJVGjIiIKwONZ9j6OYMdfkic0uSjT4/w

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      9e37111bb4c2dd9440d2eaca87b5cd65_JaffaCakes118

    • Size

      46KB

    • MD5

      9e37111bb4c2dd9440d2eaca87b5cd65

    • SHA1

      8f4e3aa93e86d989165a987fe62e15a4d42d1ac9

    • SHA256

      dc835aafd9193888aabd764f99b86b1da28341292e4dccc0ec9d84b0a5a72122

    • SHA512

      458f9d09ad10df19f06336703a660bca98299353369a4e23dfa55960d68374b42963c08491249c920128f33ecfa7d708efbe925027706ab5843db48402912082

    • SSDEEP

      768:BJ1RnSYMGCj5qRexIKwONZ9jPiOyX8gSdof1mvMpQc0rCSjpVeoYk4tBQVcM:BJVGjIiIKwONZ9j6OYMdfkic0uSjT4/w

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks