metasploit | 1ecff0dc3ec6e1ee5ebce8dada9895892c7c7eb0e677d2b1537c3b12620c4780

Analysis

max time kernel
96s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbbc061ad724f94d63d40f390dac6266_JaffaCakes118.exe
Size

9KB
MD5

cbbc061ad724f94d63d40f390dac6266
SHA1

aaa098036646759da922e13a18f34a4603d7109b
SHA256

1ecff0dc3ec6e1ee5ebce8dada9895892c7c7eb0e677d2b1537c3b12620c4780
SHA512

e1de3dba5ae83cc2eb79b5b600c2cb7545a3bd517ea734b4ff17b0eaab0019a3e9030b832845f3d5d9990b3692b019a9f4f41361243112419609cd649e8f8a05
SSDEEP

24:etGSiJxa/4zA1UXypjn+vwxd8oKu86KysyZrCxG8a035Bu:6iXa/oA16ypjnfxKuzv8BJB

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4480	512	WerFault.exe	82
2772	512	WerFault.exe	82
984	512	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbbc061ad724f94d63d40f390dac6266_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cbbc061ad724f94d63d40f390dac6266_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cbbc061ad724f94d63d40f390dac6266_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 272
  2⤵
  - Program crash
  PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 280
  2⤵
  - Program crash
  PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 312
  2⤵
  - Program crash
  PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 512 -ip 512
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 512 -ip 512
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 512 -ip 512
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-0-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/512-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/512-3-0x0000000000BB0000-0x0000000000CB0000-memory.dmp

Filesize
1024KB

Download