metasploit | d987eec8666a2084b1756d24ae3a1dda57f65cdcee7cf528042c6188f63f4619

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__248c897beeb5032c96520e9446e5c93d.exe
Size 388KB
Sample260920-y3ebps11cv
SHA256 d987eec8666a2084b1756d24ae3a1dda57f65cdcee7cf528042c6188f63f4619
MD5 248c897beeb5032c96520e9446e5c93d
SHA1 224257e1fdf482d2ee641d6fd52098f091e1c16b
SHA512 0eedc4d0c1f2e85731f21f21fb76f4613d9dafd0868b758d2590dbd07c3231a1b981efdbcf4aab98d45827e0ef6c0b49f7c4372c1d2acf8f7a10e84542fe31e1
SSDEEP 6144:8qk+NJ9f2yFN+Wv0XM6UOWCCoAKQ2+zyd1KOEN/La3DuJAT9zX8i:g+Bf3QHLzf1KOEFa3DuyTv
TLSH
T1D3840152B20544E2E39D0A3018E77FB5DA7A7D81261186CBEF6CFB4DDE732809525E13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 2 IoCs

pid	Process
4188	ngja.exe
1952	wovfa.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wovfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__248c897beeb5032c96520e9446e5c93d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	wovfa.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 4188	5640	jaffacakes118__248c897beeb5032c96520e9446e5c93d.exe	90
PID 5640 wrote to memory of 1952	5640	jaffacakes118__248c897beeb5032c96520e9446e5c93d.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__248c897beeb5032c96520e9446e5c93d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__248c897beeb5032c96520e9446e5c93d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Users\Admin\AppData\Local\Temp\ngja.exe
  C:\Users\Admin\AppData\Local\Temp\ngja.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\wovfa.exe
  C:\Users\Admin\AppData\Local\Temp\wovfa.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ngja.exe

Path C:\Users\Admin\AppData\Local\Temp\ngja.exe
Size 332KB
SHA256 662dc1e61cc51e7f54c15259882b642658b3d800513eb1bd9fb4b7ee5df2a865
MD5 b24c4d151995ee825fe9a7f3f64c8be8
SHA1 8cd1fcf934f555b78f29e0960651fcb1d237f35e
SHA512 e1e6caaf2c4da169d7b2cae3524191e7eae0aa5d6a2a1edd144aadbb63bad2ecd8f86e9911b37baea85d7206e6109cb27ebd12dfea0eefee4f8d296b0239c900
SSDEEP 6144:oqk+NJ9f2yFN+Wv0XM6UOWCCoAKQ2+zyd1KOEN/La3D:k+Bf3QHLzf1KOEFa3D
TLSH
T1A5740201B60550F0E2DC0A306CE76EB6D6767DC115254A93FF6CFB8DCBB32819A26A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wovfa.exe

Path C:\Users\Admin\AppData\Local\Temp\wovfa.exe
Size 53KB
SHA256 43bbd86a1d9f5c3f951b65429f192c2d4757eefa47d4d6c2422c051dd222ec30
MD5 9e3a7796496c32615c74e248c9460d49
SHA1 dda1d9a7df633f93bc83208beb7a9de1c4046be7
SHA512 934f8acfef122cbe81078f84097bfd31f2e26bfa1dbdc638240d37a6ee648de1ccc288d69c8640f50f82646ae13f00355a96d60618f2bc9d493b48663ef4d782
SSDEEP 768:sQZL5TVdiTo8XHckP79hcZazvkzw3vq9L+gNH4+mTJ+9vA/79cOS5KIYxNWax2i:jV5TVATJHPqQzcK8DB2JsA/7pUKIYHi
TLSH
T18133ADFB519B4D47F323993015E6B7C5AC6EBE473612E3CFCA60040DAC6A560E4B4E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-12-0x00000000020B0000-0x00000000020F1000-memory.dmp

Download

memory/1952-19-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1952-23-0x00000000020B0000-0x00000000020F1000-memory.dmp

Download

memory/4188-9-0x0000000000760000-0x000000000076B000-memory.dmp

Download

memory/4188-13-0x0000000000401000-0x00000000005F0000-memory.dmp

Download

memory/4188-11-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/4188-14-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/4188-16-0x0000000000760000-0x000000000076B000-memory.dmp

Download

memory/4188-17-0x0000000000401000-0x00000000005F0000-memory.dmp

Download

memory/4188-18-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads