Analysis
-
max time kernel
105s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 04:09
General
-
Target
JaffaCakes118_01f838cc74bc76cfb329913bcc62bb18.exe
-
Size
46KB
-
MD5
01f838cc74bc76cfb329913bcc62bb18
-
SHA1
6348da5188713d7132303dc2cb74578e12562a68
-
SHA256
1389f0fb0d3d054fb2254000e6e5ac0711e3a14ee41bc6282ead9cf8dc4a2d89
-
SHA512
9b3590e0d1915ae82cdcafabf618a6558fc472dc1f2a4adfd14d1d0862713f13958d6e26b7a87015842a1e7c24ecd0fe52638462b7a8be1d71b29fa78cec4015
-
SSDEEP
768:IcjKLFVrMchVY4e6H/1uT0YV1sH66lZdHRn2K8GSYDXpHOs8znO+TNT5jPSnybq3:IcjKLDYPYi0YVuH66tHNSrsoO4FM8q3
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
192.168.2.10:443
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01f838cc74bc76cfb329913bcc62bb18.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01f838cc74bc76cfb329913bcc62bb18.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
100KB