metasploit | 348ed02a9d00847bed951010c7af7cb9e0fdb41fcddb779e7e760cc251e346a2

Analysis

max time kernel
149s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe
Size

1.8MB
MD5

df12f62ba1ae1cf9a624572dc3f8f10d
SHA1

b80f622e76ba090a10c8bb7438877003acb249e0
SHA256

348ed02a9d00847bed951010c7af7cb9e0fdb41fcddb779e7e760cc251e346a2
SHA512

ff6205052c0d9a49ec361742982f6d50f22dce42549f289ec4241ee54cff80f043cd6091cd07c6ed5cff5e708f26692621eedc9c17c5fd2e607e2970e730b088
SSDEEP

49152:uUy4m9mg9uJBMODTSVBGxYWWiwHIeGg4r05iPr0kfYhlOd:u5RAwuJpTSVIYWWiwH9Gg4r05iPdmOd

Score

10^/10

metasploit backdoor discovery themida trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 12 IoCs

pid	Process
2064	F53.exe
2660	F53.exe
2244	S53.exe
2232	mncpmgr.exe
2144	mncpmgr.exe
664	mncpmgr.exe
1924	mncpmgr.exe
1816	mncpmgr.exe
1664	mncpmgr.exe
2672	mncpmgr.exe
2600	mncpmgr.exe
2436	mncpmgr.exe

Loads dropped DLL 18 IoCs

pid	Process
2244	S53.exe
2244	S53.exe
2232	mncpmgr.exe
2232	mncpmgr.exe
2144	mncpmgr.exe
2144	mncpmgr.exe
664	mncpmgr.exe
664	mncpmgr.exe
1924	mncpmgr.exe
1924	mncpmgr.exe
1816	mncpmgr.exe
1816	mncpmgr.exe
1664	mncpmgr.exe
1664	mncpmgr.exe
2672	mncpmgr.exe
2672	mncpmgr.exe
2600	mncpmgr.exe
2600	mncpmgr.exe

Themida packer 19 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000700000001754e-29.dat	themida
behavioral1/memory/2244-43-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2232-45-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2232-49-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2144-50-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2144-54-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/664-55-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/664-59-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/1924-60-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/1924-64-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/1816-65-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/1816-69-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/1664-70-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/1664-74-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2672-75-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2672-79-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2600-80-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2600-84-0x0000000000400000-0x00000000006EE000-memory.dmp	themida
behavioral1/memory/2436-85-0x0000000000400000-0x00000000006EE000-memory.dmp	themida

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File opened for modification	C:\Windows\SysWOW64\AJ.Settings	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	S53.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	S53.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\AJ.Settings	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe
File created	C:\Windows\SysWOW64\mncpmgr.exe	mncpmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mncpmgr.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2244	S53.exe
2232	mncpmgr.exe
2144	mncpmgr.exe
664	mncpmgr.exe
1924	mncpmgr.exe
1816	mncpmgr.exe
1664	mncpmgr.exe
2672	mncpmgr.exe
2600	mncpmgr.exe
2436	mncpmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	F53.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2064	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2064	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2064	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2064	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2660	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2660	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2660	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2660	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2244	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	32
PID 2876 wrote to memory of 2244	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	32
PID 2876 wrote to memory of 2244	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	32
PID 2876 wrote to memory of 2244	2876	df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe	32
PID 2244 wrote to memory of 2232	2244	S53.exe	33
PID 2244 wrote to memory of 2232	2244	S53.exe	33
PID 2244 wrote to memory of 2232	2244	S53.exe	33
PID 2244 wrote to memory of 2232	2244	S53.exe	33
PID 2232 wrote to memory of 2144	2232	mncpmgr.exe	34
PID 2232 wrote to memory of 2144	2232	mncpmgr.exe	34
PID 2232 wrote to memory of 2144	2232	mncpmgr.exe	34
PID 2232 wrote to memory of 2144	2232	mncpmgr.exe	34
PID 2144 wrote to memory of 664	2144	mncpmgr.exe	35
PID 2144 wrote to memory of 664	2144	mncpmgr.exe	35
PID 2144 wrote to memory of 664	2144	mncpmgr.exe	35
PID 2144 wrote to memory of 664	2144	mncpmgr.exe	35
PID 664 wrote to memory of 1924	664	mncpmgr.exe	36
PID 664 wrote to memory of 1924	664	mncpmgr.exe	36
PID 664 wrote to memory of 1924	664	mncpmgr.exe	36
PID 664 wrote to memory of 1924	664	mncpmgr.exe	36
PID 1924 wrote to memory of 1816	1924	mncpmgr.exe	37
PID 1924 wrote to memory of 1816	1924	mncpmgr.exe	37
PID 1924 wrote to memory of 1816	1924	mncpmgr.exe	37
PID 1924 wrote to memory of 1816	1924	mncpmgr.exe	37
PID 1816 wrote to memory of 1664	1816	mncpmgr.exe	38
PID 1816 wrote to memory of 1664	1816	mncpmgr.exe	38
PID 1816 wrote to memory of 1664	1816	mncpmgr.exe	38
PID 1816 wrote to memory of 1664	1816	mncpmgr.exe	38
PID 1664 wrote to memory of 2672	1664	mncpmgr.exe	39
PID 1664 wrote to memory of 2672	1664	mncpmgr.exe	39
PID 1664 wrote to memory of 2672	1664	mncpmgr.exe	39
PID 1664 wrote to memory of 2672	1664	mncpmgr.exe	39
PID 2672 wrote to memory of 2600	2672	mncpmgr.exe	40
PID 2672 wrote to memory of 2600	2672	mncpmgr.exe	40
PID 2672 wrote to memory of 2600	2672	mncpmgr.exe	40
PID 2672 wrote to memory of 2600	2672	mncpmgr.exe	40
PID 2600 wrote to memory of 2436	2600	mncpmgr.exe	41
PID 2600 wrote to memory of 2436	2600	mncpmgr.exe	41
PID 2600 wrote to memory of 2436	2600	mncpmgr.exe	41
PID 2600 wrote to memory of 2436	2600	mncpmgr.exe	41

C:\Users\Admin\AppData\Local\Temp\df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df12f62ba1ae1cf9a624572dc3f8f10d_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876
- C:\F53.exe
  C:\F53.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2064
- C:\F53.exe
  "C:\F53.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2660
- C:\S53.exe
  "C:\S53.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\mncpmgr.exe
    C:\Windows\system32\mncpmgr.exe 632 "C:\S53.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\SysWOW64\mncpmgr.exe
      C:\Windows\system32\mncpmgr.exe 700 "C:\Windows\SysWOW64\mncpmgr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\SysWOW64\mncpmgr.exe
        
        C:\Windows\system32\mncpmgr.exe 704 "C:\Windows\SysWOW64\mncpmgr.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:664
      - C:\Windows\SysWOW64\mncpmgr.exe
        
        C:\Windows\system32\mncpmgr.exe 724 "C:\Windows\SysWOW64\mncpmgr.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\mncpmgr.exe
        
        C:\Windows\system32\mncpmgr.exe 696 "C:\Windows\SysWOW64\mncpmgr.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\mncpmgr.exe
        
        C:\Windows\system32\mncpmgr.exe 720 "C:\Windows\SysWOW64\mncpmgr.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\mncpmgr.exe
        
        C:\Windows\system32\mncpmgr.exe 716 "C:\Windows\SysWOW64\mncpmgr.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\mncpmgr.exe
        
        C:\Windows\system32\mncpmgr.exe 712 "C:\Windows\SysWOW64\mncpmgr.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\mncpmgr.exe
        
        C:\Windows\system32\mncpmgr.exe 740 "C:\Windows\SysWOW64\mncpmgr.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\F53.exe

Filesize
444KB

MD5
9bb6826905965c13be1c84cc0ff83f42

SHA1
ae7734e7a54353ab13ecba780ed62344332fbc6f

SHA256
cfa4f56807405fd36e406688feb970a0d0d4854456ba2da72e4a33a27b01d9ae

SHA512
09b5f6be1f638948854a4e332b9c0f74c8583db23c0d3d905c1467a5daaf571a57a04b0e91867b4a8984cb43b19df7fc41dc182841db9dc637389e135cfd211f

Download Submit
C:\S53.exe

Filesize
1.3MB

MD5
e60536d53c253b4997724b8631bf6067

SHA1
de1676d289cefa000d07c4fae42f84a6073d7a68

SHA256
79ada8911ea92c0f9d0cb019f749802302daee489531f4fbeff364fa82be2112

SHA512
b58d72fbc5b4980fecc9610a16cfd56ce2ec2879ed31002aad9e7bb5ddcb245e787bd75fdf1fa3a71e665f117e5413c3504a5cb5ee18d4beef2a803cf992003c

Download Submit
C:\Windows\SysWOW64\AJ.Settings

Filesize
1.8MB

MD5
df12f62ba1ae1cf9a624572dc3f8f10d

SHA1
b80f622e76ba090a10c8bb7438877003acb249e0

SHA256
348ed02a9d00847bed951010c7af7cb9e0fdb41fcddb779e7e760cc251e346a2

SHA512
ff6205052c0d9a49ec361742982f6d50f22dce42549f289ec4241ee54cff80f043cd6091cd07c6ed5cff5e708f26692621eedc9c17c5fd2e607e2970e730b088

Download Submit
memory/664-55-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/664-59-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/1664-74-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/1664-70-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/1816-69-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/1816-65-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/1924-64-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/1924-60-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2144-54-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2144-50-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2232-45-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2232-49-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2244-43-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2436-85-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2600-80-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2600-84-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2672-75-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2672-79-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2876-31-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2876-23-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download