General

  • Target

    e8410244689e36647b27b892a55f66ef_JaffaCakes118

  • Size

    110KB

  • Sample

    241212-ztgk5sxlew

  • MD5

    e8410244689e36647b27b892a55f66ef

  • SHA1

    4d5cc05d075eb9d6744956c610a3d311c9fb7dee

  • SHA256

    0a0d2843578d60cf49e4a4976f893875cf601ab95254b680a518f74278c0f2b9

  • SHA512

    668a1500829888b11c054893e8ae715254cca04a0133929690a7d986280591b31f5030783f53e8bc03ec9c0f568685d13877d6db3ed1d5fe1c887f5ac4edd4fe

  • SSDEEP

    3072:EeQl+BkEjTJ0c4+S2Ra3KS2pNyZHo5p6a:5Ql+KeTJzs2Ra3h8p6a

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      e8410244689e36647b27b892a55f66ef_JaffaCakes118

    • Size

      110KB

    • MD5

      e8410244689e36647b27b892a55f66ef

    • SHA1

      4d5cc05d075eb9d6744956c610a3d311c9fb7dee

    • SHA256

      0a0d2843578d60cf49e4a4976f893875cf601ab95254b680a518f74278c0f2b9

    • SHA512

      668a1500829888b11c054893e8ae715254cca04a0133929690a7d986280591b31f5030783f53e8bc03ec9c0f568685d13877d6db3ed1d5fe1c887f5ac4edd4fe

    • SSDEEP

      3072:EeQl+BkEjTJ0c4+S2Ra3KS2pNyZHo5p6a:5Ql+KeTJzs2Ra3h8p6a

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Modifies security service

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks