metasploit | a8a24fedaa7e19688b28c358b48d8e4d99eede8d79cdb22b9fc4a80d6c011009

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecd44c27541b74bf877a85db0fd2812f_JaffaCakes118.exe
Size

158KB
MD5

ecd44c27541b74bf877a85db0fd2812f
SHA1

fb6ef6ae8b1df2e0fc48a471d07102a14f580424
SHA256

a8a24fedaa7e19688b28c358b48d8e4d99eede8d79cdb22b9fc4a80d6c011009
SHA512

670fa4d353a4d90500dfa71700aa4cf9829e720074f3791b547420b56b64dc536428f36178f254bb29d069e29101614faf3362d5fd5741e72ba9eece5730ea8c
SSDEEP

3072:ozqTC/VXu6w+e0Nc8QsCKeJBGFvaAkJHGx4i8vLV0d/xbgVWj8aoAX:8qGdXu6wh0Nc8QsBKQvaJEYmdmVWIaz

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3628	2788	WerFault.exe	82
1724	2788	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecd44c27541b74bf877a85db0fd2812f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ecd44c27541b74bf877a85db0fd2812f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecd44c27541b74bf877a85db0fd2812f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 260
  2⤵
  - Program crash
  PID:3628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 268
  2⤵
  - Program crash
  PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2788 -ip 2788
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2788 -ip 2788
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2788-0-0x0000000000400000-0x000000000042C548-memory.dmp

Filesize
177KB

Download
memory/2788-1-0x0000000000400000-0x000000000042C548-memory.dmp

Filesize
177KB

Download