metasploit | 32a5c218542909452e8899b603b2973717c6a5b8c414a0d6549b7fc1cae8d05d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

84c36a70a98533921cacd836ef30ebfe_JaffaCakes118
Size

1.7MB
Sample

240810-ets9qazamf
MD5

84c36a70a98533921cacd836ef30ebfe
SHA1

d3ba7c4e8c1e8c1d577b938dba3cd3f119ef46be
SHA256

32a5c218542909452e8899b603b2973717c6a5b8c414a0d6549b7fc1cae8d05d
SHA512

6701efca6cc85b3d43ffe07fbcaeff9b6871b923f6e78502f0c0c8478d64b8023128f08af4877273de01760895b7f1f5152f07ab24b68fc3d3508398f1eedbc1
SSDEEP

49152:4GnEGnEGnEGnEGnEGnEGnEGnEGnEGnEGnEGnEGnz:THHHHHHHHHHHHz

Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  84c36a70a98533921cacd836ef30ebfe_JaffaCakes118
- Size
  
  1.7MB
- MD5
  
  84c36a70a98533921cacd836ef30ebfe
- SHA1
  
  d3ba7c4e8c1e8c1d577b938dba3cd3f119ef46be
- SHA256
  
  32a5c218542909452e8899b603b2973717c6a5b8c414a0d6549b7fc1cae8d05d
- SHA512
  
  6701efca6cc85b3d43ffe07fbcaeff9b6871b923f6e78502f0c0c8478d64b8023128f08af4877273de01760895b7f1f5152f07ab24b68fc3d3508398f1eedbc1
- SSDEEP
  
  49152:4GnEGnEGnEGnEGnEGnEGnEGnEGnEGnEGnEGnEGnz:THHHHHHHHHHHHz
Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Modifies firewall policy service
  evasion
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan