Extracted

• • Target
    00e6f056c93844000da657f883763b37_JaffaCakes118
  • Size 445KB
  • SHA256 3f76f12fbefcf128ee20c97f156acb276e203c681c7172949824256f35824187
  • MD5 00e6f056c93844000da657f883763b37
  • SHA1 138f1df9b9b5c19f7701fad125ec236e58730ac1
  • SHA512 94643d5971d9e8261451aaaa0622f3befc106cd109fc7fc7429d86ddeef942e9ae33eca75b9a1388dbee03879711a7f809e71f9b37c10dff31547eb0d519199b
  • SSDEEP 12288:U4C7lGik2XbR68ri58LYN3aBOVuFYy3qviH:OlHTbQ8GGLYNq9H
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  metasploitbackdoorevasionpersistenceprivilege_escalationtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Looks for VMWare Tools registry key

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2