Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2024 07:00

General

  • Target

    d12e0f793229d0750fcc6e583c88b97a_JaffaCakes118.exe

  • Size

    99KB

  • MD5

    d12e0f793229d0750fcc6e583c88b97a

  • SHA1

    c67f59e02ee7ad71abc42b630fd0ded8c9d315bf

  • SHA256

    e1e8a7e7079dddb7607788de5416d2cb7f4d39e54c4432e231070770951f5fe2

  • SHA512

    dc4855aff4975dca636ae32ece59aaa4fab39689cb50bd57255ba2e424589b733531fbb46edc5fee0990fea865c865eba62dd28527a0f420c9d03a6477fa2ff4

  • SSDEEP

    1536:hrKv01fdG91bG1hQiUFsP5ND0N04dAZzu3q2OWbp1wIRU40vQpyQ:hrKv01fdG99oWa5404+IRUS

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

10.19.93.200:4444

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family

Processes

  • C:\Users\Admin\AppData\Local\Temp\d12e0f793229d0750fcc6e583c88b97a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d12e0f793229d0750fcc6e583c88b97a_JaffaCakes118.exe"
    1⤵
      PID:2964

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2964-0-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/2964-10-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB