metasploit | 1e72ee5c21a74034982a7786815d8219738eb41a2f6d2fb662992aea0e1931e0

Analysis

max time kernel
139s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
Size

151KB
MD5

f201a2c044026e948f92ff625bc83e1f
SHA1

cf4923de7a15f1d91090e2049d0caa343b8b7b63
SHA256

1e72ee5c21a74034982a7786815d8219738eb41a2f6d2fb662992aea0e1931e0
SHA512

1802865f2811a728b1db08c3dec7281a36e824062d6f03a1d9465abe4959d5534b628118e7e9087d0793a293295962825904ce987b112bdd488869a483613694
SSDEEP

3072:HhLKpkFJqH8LCSCuXr+jvxEFvon+k10vpKOvxGhkEi5cxKh3tJtKNG5l4Ff5YA:HhLocWSCuXr+jGF4BhkEOt2NvdiA

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 20 IoCs

pid	Process
1600	msq23.exe
4444	msq23.exe
1656	msq23.exe
512	msq23.exe
3128	msq23.exe
4772	msq23.exe
3428	msq23.exe
3596	msq23.exe
1464	msq23.exe
4220	msq23.exe
1156	msq23.exe
4052	msq23.exe
4104	msq23.exe
1572	msq23.exe
1092	msq23.exe
2424	msq23.exe
60	msq23.exe
4720	msq23.exe
1564	msq23.exe
4892	msq23.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 4420 set thread context of 3444	4420	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	82
PID 1600 set thread context of 4444	1600	msq23.exe	84
PID 1656 set thread context of 512	1656	msq23.exe	93
PID 3128 set thread context of 4772	3128	msq23.exe	96
PID 3428 set thread context of 3596	3428	msq23.exe	99
PID 1464 set thread context of 4220	1464	msq23.exe	101
PID 1156 set thread context of 4052	1156	msq23.exe	103
PID 4104 set thread context of 1572	4104	msq23.exe	105
PID 1092 set thread context of 2424	1092	msq23.exe	107
PID 60 set thread context of 4720	60	msq23.exe	109
PID 1564 set thread context of 4892	1564	msq23.exe	111

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq23.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3444	4420	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	82
PID 4420 wrote to memory of 3444	4420	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	82
PID 4420 wrote to memory of 3444	4420	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	82
PID 4420 wrote to memory of 3444	4420	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	82
PID 4420 wrote to memory of 3444	4420	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	82
PID 3444 wrote to memory of 1600	3444	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	83
PID 3444 wrote to memory of 1600	3444	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	83
PID 3444 wrote to memory of 1600	3444	f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe	83
PID 1600 wrote to memory of 4444	1600	msq23.exe	84
PID 1600 wrote to memory of 4444	1600	msq23.exe	84
PID 1600 wrote to memory of 4444	1600	msq23.exe	84
PID 1600 wrote to memory of 4444	1600	msq23.exe	84
PID 1600 wrote to memory of 4444	1600	msq23.exe	84
PID 4444 wrote to memory of 1656	4444	msq23.exe	92
PID 4444 wrote to memory of 1656	4444	msq23.exe	92
PID 4444 wrote to memory of 1656	4444	msq23.exe	92
PID 1656 wrote to memory of 512	1656	msq23.exe	93
PID 1656 wrote to memory of 512	1656	msq23.exe	93
PID 1656 wrote to memory of 512	1656	msq23.exe	93
PID 1656 wrote to memory of 512	1656	msq23.exe	93
PID 1656 wrote to memory of 512	1656	msq23.exe	93
PID 512 wrote to memory of 3128	512	msq23.exe	95
PID 512 wrote to memory of 3128	512	msq23.exe	95
PID 512 wrote to memory of 3128	512	msq23.exe	95
PID 3128 wrote to memory of 4772	3128	msq23.exe	96
PID 3128 wrote to memory of 4772	3128	msq23.exe	96
PID 3128 wrote to memory of 4772	3128	msq23.exe	96
PID 3128 wrote to memory of 4772	3128	msq23.exe	96
PID 3128 wrote to memory of 4772	3128	msq23.exe	96
PID 4772 wrote to memory of 3428	4772	msq23.exe	98
PID 4772 wrote to memory of 3428	4772	msq23.exe	98
PID 4772 wrote to memory of 3428	4772	msq23.exe	98
PID 3428 wrote to memory of 3596	3428	msq23.exe	99
PID 3428 wrote to memory of 3596	3428	msq23.exe	99
PID 3428 wrote to memory of 3596	3428	msq23.exe	99
PID 3428 wrote to memory of 3596	3428	msq23.exe	99
PID 3428 wrote to memory of 3596	3428	msq23.exe	99
PID 3596 wrote to memory of 1464	3596	msq23.exe	100
PID 3596 wrote to memory of 1464	3596	msq23.exe	100
PID 3596 wrote to memory of 1464	3596	msq23.exe	100
PID 1464 wrote to memory of 4220	1464	msq23.exe	101
PID 1464 wrote to memory of 4220	1464	msq23.exe	101
PID 1464 wrote to memory of 4220	1464	msq23.exe	101
PID 1464 wrote to memory of 4220	1464	msq23.exe	101
PID 1464 wrote to memory of 4220	1464	msq23.exe	101
PID 4220 wrote to memory of 1156	4220	msq23.exe	102
PID 4220 wrote to memory of 1156	4220	msq23.exe	102
PID 4220 wrote to memory of 1156	4220	msq23.exe	102
PID 1156 wrote to memory of 4052	1156	msq23.exe	103
PID 1156 wrote to memory of 4052	1156	msq23.exe	103
PID 1156 wrote to memory of 4052	1156	msq23.exe	103
PID 1156 wrote to memory of 4052	1156	msq23.exe	103
PID 1156 wrote to memory of 4052	1156	msq23.exe	103
PID 4052 wrote to memory of 4104	4052	msq23.exe	104
PID 4052 wrote to memory of 4104	4052	msq23.exe	104
PID 4052 wrote to memory of 4104	4052	msq23.exe	104
PID 4104 wrote to memory of 1572	4104	msq23.exe	105
PID 4104 wrote to memory of 1572	4104	msq23.exe	105
PID 4104 wrote to memory of 1572	4104	msq23.exe	105
PID 4104 wrote to memory of 1572	4104	msq23.exe	105
PID 4104 wrote to memory of 1572	4104	msq23.exe	105
PID 1572 wrote to memory of 1092	1572	msq23.exe	106
PID 1572 wrote to memory of 1092	1572	msq23.exe	106
PID 1572 wrote to memory of 1092	1572	msq23.exe	106

C:\Users\Admin\AppData\Local\Temp\f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\msq23.exe
    C:\Windows\system32\msq23.exe 1120 "C:\Users\Admin\AppData\Local\Temp\f201a2c044026e948f92ff625bc83e1f_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\msq23.exe
      C:\Windows\SysWOW64\msq23.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1148 "C:\Windows\SysWOW64\msq23.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1656
      - C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1124 "C:\Windows\SysWOW64\msq23.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1128 "C:\Windows\SysWOW64\msq23.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1128 "C:\Windows\SysWOW64\msq23.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:60
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msq23.exe

Filesize
151KB

MD5
f201a2c044026e948f92ff625bc83e1f

SHA1
cf4923de7a15f1d91090e2049d0caa343b8b7b63

SHA256
1e72ee5c21a74034982a7786815d8219738eb41a2f6d2fb662992aea0e1931e0

SHA512
1802865f2811a728b1db08c3dec7281a36e824062d6f03a1d9465abe4959d5534b628118e7e9087d0793a293295962825904ce987b112bdd488869a483613694

Download Submit
memory/512-22-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/512-23-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3444-0-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3444-2-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3444-3-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3444-10-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4444-14-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4444-15-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/4444-16-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download