Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
29-11-2024 12:33
General
-
Target
b1446b78bded11f4e33a61c117b3e1e1_JaffaCakes118.exe
-
Size
151KB
-
MD5
b1446b78bded11f4e33a61c117b3e1e1
-
SHA1
32b3367cad8cc5a391c9770a46e7a928dc29d760
-
SHA256
b4cac92c795dc42fd310a1a2371c11525a803f6ff54902afd68294c9bd153739
-
SHA512
87b079cbcd32e3908800fd3df45d4687a6e20ac41fc95f9b8771222d4b8f93060b8035f21ec638d916c28a5b7fbfac05443aa101da3f8476b9642db0bd5d349d
-
SSDEEP
3072:DYKYEVyZBG1fEeIbmlg39hLOf7nDVF6PUp1YodLCz8:/2G1ce07NxOfzDVlvuz
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/shell_reverse_tcp
192.168.0.105:446
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1446b78bded11f4e33a61c117b3e1e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b1446b78bded11f4e33a61c117b3e1e1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
312KB