metasploit | 34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa

General

Target

0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe
Size

120KB
MD5

0d0320878946a73749111e6c94bf1525
SHA1

1e9b5c685640df11659aea7748d9bf3df70aadcf
SHA256

34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa
SHA512

fc695dd905213d7b623d33d2fa9302399897970f3b8705182fa50e771dad13dac5d5d302a508cdc4f3fdb37122999f2d492188667b92050fe49a29abff53a8b1
SSDEEP

3072:UXRbYXL8o0Quhon01KRTjKB4phUQbAnL0e2gF7wUg4GR:UXl6LcheTW+bZbwphOr

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Deletes itself 1 IoCs

Processes:

thinprobe.exe

pid process

848 thinprobe.exe
Executes dropped EXE 3 IoCs

Processes:

thinprobe.exethinprobe.exethinprobe.exe

pid process

848 thinprobe.exe
2808 thinprobe.exe
2092 thinprobe.exe
Loads dropped DLL 2 IoCs

Processes:

0d0320878946a73749111e6c94bf1525_JaffaCakes118.exethinprobe.exe

pid process

2356 0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe
848 thinprobe.exe
Drops file in Windows directory 1 IoCs

Processes:

thinprobe.exe

description ioc process

File opened for modification C:\Windows\pcawhere\config.ini thinprobe.exe

pid	process
848	thinprobe.exe

pid	process
848	thinprobe.exe
2808	thinprobe.exe
2092	thinprobe.exe

pid	process
2356	0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe
848	thinprobe.exe

description	ioc	process
File opened for modification	C:\Windows\pcawhere\config.ini	thinprobe.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

svchost.exe

pid	process
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe
2616	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

thinprobe.exethinprobe.exe

description pid process

Token: SeDebugPrivilege 848 thinprobe.exe
Token: SeDebugPrivilege 2092 thinprobe.exe

description	pid	process
Token: SeDebugPrivilege	848	thinprobe.exe
Token: SeDebugPrivilege	2092	thinprobe.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

0d0320878946a73749111e6c94bf1525_JaffaCakes118.exethinprobe.exethinprobe.exe

description	pid	process	target process
PID 2356 wrote to memory of 848	2356	0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe	thinprobe.exe
PID 2356 wrote to memory of 848	2356	0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe	thinprobe.exe
PID 2356 wrote to memory of 848	2356	0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe	thinprobe.exe
PID 2356 wrote to memory of 848	2356	0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe	thinprobe.exe
PID 848 wrote to memory of 2808	848	thinprobe.exe	thinprobe.exe
PID 848 wrote to memory of 2808	848	thinprobe.exe	thinprobe.exe
PID 848 wrote to memory of 2808	848	thinprobe.exe	thinprobe.exe
PID 848 wrote to memory of 2808	848	thinprobe.exe	thinprobe.exe
PID 2092 wrote to memory of 2616	2092	thinprobe.exe	svchost.exe
PID 2092 wrote to memory of 2616	2092	thinprobe.exe	svchost.exe
PID 2092 wrote to memory of 2616	2092	thinprobe.exe	svchost.exe
PID 2092 wrote to memory of 2616	2092	thinprobe.exe	svchost.exe
PID 2092 wrote to memory of 2616	2092	thinprobe.exe	svchost.exe
PID 2092 wrote to memory of 2616	2092	thinprobe.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d0320878946a73749111e6c94bf1525_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\7z62032934\thinprobe.exe
C:\Users\Admin\AppData\Local\Temp\7z62032934\thinprobe.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\pcawhere\thinprobe.exe
"C:\Windows\pcawhere\thinprobe.exe"
3⤵
- Executes dropped EXE
PID:2808

C:\Windows\pcawhere\thinprobe.exe
C:\Windows\pcawhere\thinprobe.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\svchost.exe
-daemon
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z62032934\ThinHostProbedll.dll
Filesize
42KB

MD5
bfb71e0efe5d9208aa9cbdfd4a85a52d

SHA1
ea487fbad911df1f51aa9332336847e2d5dd68bf

SHA256
c195afb7048664ea2a68fa11b5ebeca502ee5454b2364216d0002a3bfda7057d

SHA512
de7490b47939de9e634bea75400c0d820e4e62ee083020e18a48b66fff8ad307926778424fe315ca616878361babe6e6642272ce1eb9036b661c37cd5960bdf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z62032934\thumb.db
Filesize
51KB

MD5
fe185cb4315658e561fd789181dfd1f3

SHA1
dc6468dd9ab1c73210990c55cca82111ed21e00d

SHA256
eb9f6f3fb6b70d1f49c1c92442a0f96e7583e757b035cb4343767cf9382eb354

SHA512
88347235e77553c976d5d45278d8d51d15815523fc57be73d21b6676ea9f296d16d6c96b6f81f1e3900c373717c589fa3c510ef8f6e33df72ea32ef036687382

Download Submit
C:\Windows\pcawhere\config.ini
Filesize
49B

MD5
26cdbe4d56bd111a15204380f93353fb

SHA1
32054b4174ad806e1daab37bcf23ec00497e7a32

SHA256
06a83063129195a64a915ee742109e44680df89bfb8cdf63f3441b59615be48d

SHA512
eb787b0eb0c1fc10337002dc79e28546fd6d9f33e22e253d645ea56436f4e519e82cbdc739531ee688fa7f5da20bb9681c84a11e56713f2f97231d7b74629e98

Download Submit
\Users\Admin\AppData\Local\Temp\7z62032934\thinprobe.exe
Filesize
69KB

MD5
65e6e6fffa769830d76ac4fae2433121

SHA1
ced1d78304c4b4dfeb357739859587744e7530da

SHA256
76d2e897ca235beab44ee7eaab9ede7bc7868bbaeb7d6cb10b4323c07eb216af

SHA512
8303a755fc5e4f7a3de9f6efde12243a75f90532384c002b5168ec88cd60b34b6024accdf916a91d625ca07bfdb07364c971b482c2ebb9c9a84c10409526808a

Download Submit
memory/848-12-0x0000000075180000-0x000000007518D000-memory.dmp

Filesize
52KB

Download
memory/848-14-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/848-19-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/848-18-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/848-26-0x0000000075180000-0x000000007518D000-memory.dmp

Filesize
52KB

Download
memory/2092-42-0x0000000075140000-0x000000007514D000-memory.dmp

Filesize
52KB

Download
memory/2092-36-0x0000000075140000-0x000000007514D000-memory.dmp

Filesize
52KB

Download
memory/2092-49-0x0000000075140000-0x000000007514D000-memory.dmp

Filesize
52KB

Download
memory/2356-21-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2616-43-0x0000000000080000-0x000000000008D000-memory.dmp

Filesize
52KB

Download
memory/2616-48-0x0000000000080000-0x000000000008D000-memory.dmp

Filesize
52KB

Download
memory/2808-28-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2808-32-0x0000000075140000-0x000000007514D000-memory.dmp

Filesize
52KB

Download
memory/2808-33-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2808-27-0x0000000075140000-0x000000007514D000-memory.dmp

Filesize
52KB

Download
memory/2808-50-0x0000000075140000-0x000000007514D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing