metasploit | 444737fe64ba9cd2af155fc6fd85d16fea2df003b75149cf658777bd2a047325

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe
Size

67KB
MD5

de973deed1361a058987f0d0d24c571e
SHA1

0494c4b056432ec1cd7d27c5e284ab67f02c8594
SHA256

444737fe64ba9cd2af155fc6fd85d16fea2df003b75149cf658777bd2a047325
SHA512

9536762594e3c16a4063101f92666bb440dfce2aecc41a40de81f5907159ddddb53738a4e9676b67d8e8e96740436bc2bd5e0e8805792e4e693ccb753a6ffc3b
SSDEEP

1536:b3TMb1FpPtYZdqgmkLbxtmMaf2vmibksnouy8UO:zeLpPtckUGf7idout

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

192.168.1.6:51348

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 1 IoCs

pid	Process
2792	avg_free_stf_eu_10_12842.exe

Loads dropped DLL 2 IoCs

pid	Process
2536	cmd.exe
2536	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2548-34-0x0000000000400000-0x0000000000425000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_free_stf_eu_10_12842.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2536	2548	de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe	31
PID 2548 wrote to memory of 2536	2548	de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe	31
PID 2548 wrote to memory of 2536	2548	de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe	31
PID 2548 wrote to memory of 2536	2548	de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2792	2536	cmd.exe	32
PID 2536 wrote to memory of 2792	2536	cmd.exe	32
PID 2536 wrote to memory of 2792	2536	cmd.exe	32
PID 2536 wrote to memory of 2792	2536	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de973deed1361a058987f0d0d24c571e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\9AF8.tmp\autorun.bat""
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\avg_free_stf_eu_10_12842.exe
    avg_free_stf_eu_10_12842.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9AF8.tmp\autorun.bat

Filesize
86B

MD5
8ccf2d71872d7ab6c14eecc12dafcd76

SHA1
115414806701e27ae6a5c6ace0dfa69853c9944e

SHA256
6f875803af518e1b458cafd8da71520bc50b909a339d7e91ef9777736161fcef

SHA512
f4ef8d8bbafc0902288ac306c96c3d912cf16aa11bfc707d5da20abba4ed8d9215120adb3997b0d127f41ba2d5343926ce8dd7948965fa23aeefbb91e47ecc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\avg_free_stf_eu_10_12842.exe

Filesize
72KB

MD5
38eb643b57f988865330e239e37bc62c

SHA1
7455cd46c8efd400fd0c81f4f2826dec3b96070b

SHA256
f998ffcd301c9109849b903007cf8fa92d303d710ecfbd925f87ac8f66cf6754

SHA512
0baa329c0c273e7c27165726f8b24aadc412bf4531de6386af2287c18696958e6d7c7a96357f2d3b3657f69b0299d6e12a5b7c2d2ca6ba60dcb8641a07294f9f

Download Submit
memory/2536-26-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/2548-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2548-34-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2792-20-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads