General

  • Target

    b0c53ac0bf5c41dc788d248a280bf769_JaffaCakes118

  • Size

    123KB

  • Sample

    241129-myjvvawneq

  • MD5

    b0c53ac0bf5c41dc788d248a280bf769

  • SHA1

    7990b713953d43f2108dcb1dd30b9958e814ad62

  • SHA256

    b604eecbb89136b0a1ee0853357995e85a144475a211069baf60bd8a439b1929

  • SHA512

    5d9f26e912686ddfd781ac3014f9ba1df817500fbde32cc4f4cce84621ea1138729d4b98b56b5e6df2dfecd5faf2c6b92da51cb5e2fad13b27ace0f97e4640f3

  • SSDEEP

    1536:i5sc375Ab4EBanICQFuIiyd6gWHpkeaPRAER:ip5wfCQF92HpkeWp

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      b0c53ac0bf5c41dc788d248a280bf769_JaffaCakes118

    • Size

      123KB

    • MD5

      b0c53ac0bf5c41dc788d248a280bf769

    • SHA1

      7990b713953d43f2108dcb1dd30b9958e814ad62

    • SHA256

      b604eecbb89136b0a1ee0853357995e85a144475a211069baf60bd8a439b1929

    • SHA512

      5d9f26e912686ddfd781ac3014f9ba1df817500fbde32cc4f4cce84621ea1138729d4b98b56b5e6df2dfecd5faf2c6b92da51cb5e2fad13b27ace0f97e4640f3

    • SSDEEP

      1536:i5sc375Ab4EBanICQFuIiyd6gWHpkeaPRAER:ip5wfCQF92HpkeWp

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Modifies firewall policy service

    • Modifies security service

    • Network Share Discovery

      Attempt to gather information on host network.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks