metasploit | efe8d10184f741f9d26315f7914c0b3920a008ba89b0b1308f5e1e291ba54c91

Analysis

max time kernel
1s
max time network
4s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a6f6227d4407dd10f4ca1bbc771357d_JaffaCakes118.exe
Size

231KB
MD5

1a6f6227d4407dd10f4ca1bbc771357d
SHA1

a833b40efc4821e9ebf18cb82382596bdaa6d33e
SHA256

efe8d10184f741f9d26315f7914c0b3920a008ba89b0b1308f5e1e291ba54c91
SHA512

0c9ac3337c9338823b3a68fe8578bc12bbe8bdd08168b4c89334240da4429146c92eca1aedd8882bff7bbede1a01e4dd769a092ac2791a03abd8df24328c69c6
SSDEEP

3072:NtezRfHWyHsZ6PJcuBsZ2qAP7o7UUy47WoZ5iN9uQyOi4RoJGHxtQoBJhBGF9Pb:nixHwZUqf7JWo3wFRoJGHxfBLBg9z

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

C:\Users\Admin\AppData\Local\Temp\1a6f6227d4407dd10f4ca1bbc771357d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a6f6227d4407dd10f4ca1bbc771357d_JaffaCakes118.exe"
1⤵
PID:2216

C:\Users\Admin\AppData\Local\Temp\1a6f6227d4407dd10f4ca1bbc771357d_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\1a6f6227d4407dd10f4ca1bbc771357d_JaffaCakes118.exe
2⤵
PID:2244

C:\Windows\ntservice.exe
C:\Windows\ntservice.exe 520 "C:\Users\Admin\AppData\Local\Temp\1a6f6227d4407dd10f4ca1bbc771357d_JaffaCakes118.exe"
3⤵
PID:2888

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ntservice.exe
Filesize
231KB

MD5
1a6f6227d4407dd10f4ca1bbc771357d

SHA1
a833b40efc4821e9ebf18cb82382596bdaa6d33e

SHA256
efe8d10184f741f9d26315f7914c0b3920a008ba89b0b1308f5e1e291ba54c91

SHA512
0c9ac3337c9338823b3a68fe8578bc12bbe8bdd08168b4c89334240da4429146c92eca1aedd8882bff7bbede1a01e4dd769a092ac2791a03abd8df24328c69c6

Download Submit
C:\Windows\ntservice.exe
Filesize
136KB

MD5
3a4e50ab46edf329e61c743aa4115775

SHA1
98718e786bb3b8da2203a3c89f9def6d0929ee8a

SHA256
1ba2eb3155d78c283ca2a9970db16c11ba1e7f36cb7d082f2ea4e1e4da489263

SHA512
648d527deaa848bd185aaff66c5460f66bb0a931fbf5b4bdb3e438c7a266e67cd50deb907fb119ba924576155454e2453942484efcdb24620d6b51e287aaadef

Download Submit
C:\Windows\ntservice.exe
Filesize
128KB

MD5
cb5490d1c48fc2404a4d67152b9263b2

SHA1
d2c07dceb7aaef51a66c8e49f9c088ed1c8848c7

SHA256
c35d50187f4a8028906659bd8bd4b708126c36f00e8937f4421f2f4a08074a58

SHA512
f7bd9d45b155dcfdb98ea0a67e4a81fce530475c7b7dcd6e34723c410c947666068f14a7a3638b26e7f1200554284f1c6365afab974f39b88f7d02ff1d81782a

Download Submit
memory/2216-10-0x0000000011000000-0x0000000011040000-memory.dmp

Filesize
256KB

Download
memory/2216-0-0x0000000011000000-0x0000000011040000-memory.dmp

Filesize
256KB

Download
memory/2244-11-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2244-12-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2244-3-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2244-17-0x0000000002450000-0x0000000002490000-memory.dmp

Filesize
256KB

Download
memory/2244-6-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2244-22-0x0000000002450000-0x0000000002490000-memory.dmp

Filesize
256KB

Download
memory/2244-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2244-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2296-38-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2296-40-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2888-36-0x0000000011000000-0x0000000011040000-memory.dmp

Filesize
256KB

Download
memory/2888-24-0x0000000011000000-0x0000000011040000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads