metasploit | 39e0f2785b343114fd825b93dded086eb8d0b9e8e1a4a27b549314cacd8868c6

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
099623146aa871a0b3a813621895cc67_JaffaCakes118.exe
Size 92KB
Sample240624-tycj4avemn
SHA256 39e0f2785b343114fd825b93dded086eb8d0b9e8e1a4a27b549314cacd8868c6
MD5 099623146aa871a0b3a813621895cc67
SHA1 f018e14cd76101106c2f1d97803bc297ad851a46
SHA512 b4b547d1cfc1cffd175fca3b42989362650a3d7d5bd3557c95532de5f64a409c5b55a6516fc000d7b8176238590ec1f494d1fb913a6e7042422c65fdf26ee3da
SSDEEP 1536:WSquE20GQCaNMYVbc3hb5S3WmOoSInRk1377wfYunYxOUfttit5tgS2:psNxQPWBRkRPwf+ftsfGS2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor persistence trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 2 IoCs

pid	Process
4740	AdobeARMS.exe
2208	AdobeARMS.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2020-0-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2020-3-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2020-5-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2020-6-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2020-4-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2020-14-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2208-18-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2208-19-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2208-20-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2208-22-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral2/memory/2208-23-0x0000000000400000-0x000000000048C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\patches = "1"	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe"	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "\\AdobeARMS.exe"	AdobeARMS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARMS = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeARMS.exe"	AdobeARMS.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1268 set thread context of 2020	1268	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	91
PID 4740 set thread context of 2208	4740	AdobeARMS.exe	95

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2312	1268	WerFault.exe	87
2828	4740	WerFault.exe	92

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2020	1268	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	91
PID 1268 wrote to memory of 2020	1268	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	91
PID 1268 wrote to memory of 2020	1268	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	91
PID 1268 wrote to memory of 2020	1268	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	91
PID 1268 wrote to memory of 2020	1268	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	91
PID 2020 wrote to memory of 4740	2020	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	92
PID 2020 wrote to memory of 4740	2020	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	92
PID 2020 wrote to memory of 4740	2020	099623146aa871a0b3a813621895cc67_JaffaCakes118.exe	92
PID 4740 wrote to memory of 2208	4740	AdobeARMS.exe	95
PID 4740 wrote to memory of 2208	4740	AdobeARMS.exe	95
PID 4740 wrote to memory of 2208	4740	AdobeARMS.exe	95
PID 4740 wrote to memory of 2208	4740	AdobeARMS.exe	95
PID 4740 wrote to memory of 2208	4740	AdobeARMS.exe	95

C:\Users\Admin\AppData\Local\Temp\099623146aa871a0b3a813621895cc67_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\099623146aa871a0b3a813621895cc67_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 284
  2⤵
  - Program crash
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\099623146aa871a0b3a813621895cc67_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\099623146aa871a0b3a813621895cc67_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
    C:\Users\Admin\AppData\Roaming\AdobeARMS.exe 908 "C:\Users\Admin\AppData\Local\Temp\099623146aa871a0b3a813621895cc67_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 280
      4⤵
      Program crash
      PID:2828
  - - C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
      "C:\Users\Admin\AppData\Roaming\AdobeARMS.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1268 -ip 1268
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4740 -ip 4740
1⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARMS.exe

Path C:\Users\Admin\AppData\Roaming\AdobeARMS.exe
Size 92KB
SHA256 39e0f2785b343114fd825b93dded086eb8d0b9e8e1a4a27b549314cacd8868c6
MD5 099623146aa871a0b3a813621895cc67
SHA1 f018e14cd76101106c2f1d97803bc297ad851a46
SHA512 b4b547d1cfc1cffd175fca3b42989362650a3d7d5bd3557c95532de5f64a409c5b55a6516fc000d7b8176238590ec1f494d1fb913a6e7042422c65fdf26ee3da
SSDEEP 1536:WSquE20GQCaNMYVbc3hb5S3WmOoSInRk1377wfYunYxOUfttit5tgS2:psNxQPWBRkRPwf+ftsfGS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1268-1-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2020-5-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2020-0-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2020-6-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2020-4-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2020-3-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2020-14-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2208-18-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2208-19-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2208-20-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2208-22-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2208-23-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/4740-21-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads