metasploit | bd533800194553888d05c5a560cce3940db886df82a5f895b0b321b7c4d9e5ff

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f47ed88c7cac304d42a08cfea178b36a_JaffaCakes118.exe
Size

47KB
MD5

f47ed88c7cac304d42a08cfea178b36a
SHA1

639e638c48c914c6101e5fa36f87737db4240503
SHA256

bd533800194553888d05c5a560cce3940db886df82a5f895b0b321b7c4d9e5ff
SHA512

4a1ddc887e504cb84dc247a518fe1d214e86533caeec6a993ce97056070528425f136d56c257650e2162599c277697edea3fd9626cdbbf4cd1bcab0215e4d2de
SSDEEP

768:IucKNIJtze/3yZgWq4VesAv+ig4GpzZ3a9OMM1tEdOaeAJ95RZMB4jRPrOHcJ5PI:Iuc3tzc+re+WGp1aAj6wj85RZmwPrmWI

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

192.168.0.110:4444

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1840-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1840-2-0x0000000000400000-0x0000000000419000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f47ed88c7cac304d42a08cfea178b36a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f47ed88c7cac304d42a08cfea178b36a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f47ed88c7cac304d42a08cfea178b36a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1840-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1840-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads