metasploit | 85a950b494d98f133d88b8e2e2d1527ddc421c08b8b9e4c07a5393faddb77d5c

General

Target

81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
Size

252KB
MD5

81c2b560fe7e50858a9facb0be1b4287
SHA1

0c6b23eb776cad75f5794812a6f8684b09cdebe6
SHA256

85a950b494d98f133d88b8e2e2d1527ddc421c08b8b9e4c07a5393faddb77d5c
SHA512

7976c33e6bb6c2d55582c99d3224acd10f46e737c5ebee544ef8b44b6200bd9c7a2ec4a7433f27ee59c7e5c5b30299149db738bf119c39722163bb5fab06b472
SSDEEP

6144:FmCwBmAxKwNATSLjT0QPPPPPPPPPPPPPPPPPPNPPPPPJPPPPPPPPPPPPPPPPPPP3:anzATSLjTBV4tVaA3Pmg

Score

10^/10

metasploit backdoor defense_evasion discovery persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 2 IoCs

pid	Process
864	rpcs.exe
2084	rpcs.exe

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\rpcx32sf = "C:\\Windows\\system32\\rpcs.exe"	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe

Loads dropped DLL 3 IoCs

pid	Process
2004	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
2004	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
864	rpcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rpcx32sf = "C:\\Windows\\system32\\rpcs.exe"	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rpcs.exe	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rpcs.exe	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rpcs.exe	rpcs.exe
File created	C:\Windows\SysWOW64\rpcs.exe	rpcs.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 864 set thread context of 2084	864	rpcs.exe	31

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
864	rpcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2004	2320	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	29
PID 2004 wrote to memory of 864	2004	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	30
PID 2004 wrote to memory of 864	2004	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	30
PID 2004 wrote to memory of 864	2004	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	30
PID 2004 wrote to memory of 864	2004	81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe	30
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31
PID 864 wrote to memory of 2084	864	rpcs.exe	31

C:\Users\Admin\AppData\Local\Temp\81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\81c2b560fe7e50858a9facb0be1b4287_JaffaCakes118.exe"
  2⤵
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\rpcs.exe
    "C:\Windows\system32\rpcs.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\SysWOW64\rpcs.exe
      "C:\Windows\SysWOW64\rpcs.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\rpcs.exe

Filesize
252KB

MD5
81c2b560fe7e50858a9facb0be1b4287

SHA1
0c6b23eb776cad75f5794812a6f8684b09cdebe6

SHA256
85a950b494d98f133d88b8e2e2d1527ddc421c08b8b9e4c07a5393faddb77d5c

SHA512
7976c33e6bb6c2d55582c99d3224acd10f46e737c5ebee544ef8b44b6200bd9c7a2ec4a7433f27ee59c7e5c5b30299149db738bf119c39722163bb5fab06b472

Download Submit
memory/2004-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2004-4-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2004-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2004-19-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-30-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-34-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-27-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-28-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-29-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-25-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-31-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-32-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-33-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-26-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-35-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-36-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-37-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-38-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-39-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-40-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-41-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2084-42-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads