metasploit | 7fc428d3d81f070ddadaa04b22268f0c48513c07a6cb8bb981c5a0b53c7a5ee3

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
Size

294KB
MD5

f7ccad9ff12aa38a3b2b9887485cad56
SHA1

78d71be9e51d25754bd148b1ac168dbcb92c6184
SHA256

7fc428d3d81f070ddadaa04b22268f0c48513c07a6cb8bb981c5a0b53c7a5ee3
SHA512

8e6c629637260e76c802c219442d2de34bb08f3dab26a77376d725eb31c888e49bae58176197e2660d0f06a1806c13e7eebebadc5ae908be963c6aabca5438f1
SSDEEP

6144:FpjkUdnUwHP0Ea+DppEBpZ+uIb1u1wyguu:FpjkUBLJa+DTYD+n6Lru

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 20 IoCs

pid	Process
4924	stmea.exe
464	stmea.exe
2328	stmea.exe
1280	stmea.exe
3156	stmea.exe
1964	stmea.exe
2148	stmea.exe
5072	stmea.exe
4704	stmea.exe
1396	stmea.exe
4616	stmea.exe
4984	stmea.exe
4344	stmea.exe
4040	stmea.exe
3296	stmea.exe
4272	stmea.exe
4516	stmea.exe
4956	stmea.exe
4836	stmea.exe
4404	stmea.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File created	C:\Windows\SysWOW64\stmea.exe	stmea.exe
File opened for modification	C:\Windows\SysWOW64\stmea.exe	stmea.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 4708	1076	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	82
PID 4924 set thread context of 464	4924	stmea.exe	84
PID 2328 set thread context of 1280	2328	stmea.exe	91
PID 3156 set thread context of 1964	3156	stmea.exe	96
PID 2148 set thread context of 5072	2148	stmea.exe	99
PID 4704 set thread context of 1396	4704	stmea.exe	101
PID 4616 set thread context of 4984	4616	stmea.exe	103
PID 4344 set thread context of 4040	4344	stmea.exe	105
PID 3296 set thread context of 4272	3296	stmea.exe	107
PID 4516 set thread context of 4956	4516	stmea.exe	109
PID 4836 set thread context of 4404	4836	stmea.exe	111

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stmea.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4708	1076	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	82
PID 1076 wrote to memory of 4708	1076	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	82
PID 1076 wrote to memory of 4708	1076	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	82
PID 1076 wrote to memory of 4708	1076	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	82
PID 1076 wrote to memory of 4708	1076	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	82
PID 4708 wrote to memory of 4924	4708	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	83
PID 4708 wrote to memory of 4924	4708	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	83
PID 4708 wrote to memory of 4924	4708	f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe	83
PID 4924 wrote to memory of 464	4924	stmea.exe	84
PID 4924 wrote to memory of 464	4924	stmea.exe	84
PID 4924 wrote to memory of 464	4924	stmea.exe	84
PID 4924 wrote to memory of 464	4924	stmea.exe	84
PID 4924 wrote to memory of 464	4924	stmea.exe	84
PID 464 wrote to memory of 2328	464	stmea.exe	90
PID 464 wrote to memory of 2328	464	stmea.exe	90
PID 464 wrote to memory of 2328	464	stmea.exe	90
PID 2328 wrote to memory of 1280	2328	stmea.exe	91
PID 2328 wrote to memory of 1280	2328	stmea.exe	91
PID 2328 wrote to memory of 1280	2328	stmea.exe	91
PID 2328 wrote to memory of 1280	2328	stmea.exe	91
PID 2328 wrote to memory of 1280	2328	stmea.exe	91
PID 1280 wrote to memory of 3156	1280	stmea.exe	95
PID 1280 wrote to memory of 3156	1280	stmea.exe	95
PID 1280 wrote to memory of 3156	1280	stmea.exe	95
PID 3156 wrote to memory of 1964	3156	stmea.exe	96
PID 3156 wrote to memory of 1964	3156	stmea.exe	96
PID 3156 wrote to memory of 1964	3156	stmea.exe	96
PID 3156 wrote to memory of 1964	3156	stmea.exe	96
PID 3156 wrote to memory of 1964	3156	stmea.exe	96
PID 1964 wrote to memory of 2148	1964	stmea.exe	98
PID 1964 wrote to memory of 2148	1964	stmea.exe	98
PID 1964 wrote to memory of 2148	1964	stmea.exe	98
PID 2148 wrote to memory of 5072	2148	stmea.exe	99
PID 2148 wrote to memory of 5072	2148	stmea.exe	99
PID 2148 wrote to memory of 5072	2148	stmea.exe	99
PID 2148 wrote to memory of 5072	2148	stmea.exe	99
PID 2148 wrote to memory of 5072	2148	stmea.exe	99
PID 5072 wrote to memory of 4704	5072	stmea.exe	100
PID 5072 wrote to memory of 4704	5072	stmea.exe	100
PID 5072 wrote to memory of 4704	5072	stmea.exe	100
PID 4704 wrote to memory of 1396	4704	stmea.exe	101
PID 4704 wrote to memory of 1396	4704	stmea.exe	101
PID 4704 wrote to memory of 1396	4704	stmea.exe	101
PID 4704 wrote to memory of 1396	4704	stmea.exe	101
PID 4704 wrote to memory of 1396	4704	stmea.exe	101
PID 1396 wrote to memory of 4616	1396	stmea.exe	102
PID 1396 wrote to memory of 4616	1396	stmea.exe	102
PID 1396 wrote to memory of 4616	1396	stmea.exe	102
PID 4616 wrote to memory of 4984	4616	stmea.exe	103
PID 4616 wrote to memory of 4984	4616	stmea.exe	103
PID 4616 wrote to memory of 4984	4616	stmea.exe	103
PID 4616 wrote to memory of 4984	4616	stmea.exe	103
PID 4616 wrote to memory of 4984	4616	stmea.exe	103
PID 4984 wrote to memory of 4344	4984	stmea.exe	104
PID 4984 wrote to memory of 4344	4984	stmea.exe	104
PID 4984 wrote to memory of 4344	4984	stmea.exe	104
PID 4344 wrote to memory of 4040	4344	stmea.exe	105
PID 4344 wrote to memory of 4040	4344	stmea.exe	105
PID 4344 wrote to memory of 4040	4344	stmea.exe	105
PID 4344 wrote to memory of 4040	4344	stmea.exe	105
PID 4344 wrote to memory of 4040	4344	stmea.exe	105
PID 4040 wrote to memory of 3296	4040	stmea.exe	106
PID 4040 wrote to memory of 3296	4040	stmea.exe	106
PID 4040 wrote to memory of 3296	4040	stmea.exe	106

C:\Users\Admin\AppData\Local\Temp\f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\stmea.exe
    C:\Windows\system32\stmea.exe 1044 "C:\Users\Admin\AppData\Local\Temp\f7ccad9ff12aa38a3b2b9887485cad56_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SysWOW64\stmea.exe
      C:\Windows\SysWOW64\stmea.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1148 "C:\Windows\SysWOW64\stmea.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2328
      - C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1120 "C:\Windows\SysWOW64\stmea.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1120 "C:\Windows\SysWOW64\stmea.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1124 "C:\Windows\SysWOW64\stmea.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1124 "C:\Windows\SysWOW64\stmea.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1124 "C:\Windows\SysWOW64\stmea.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1120 "C:\Windows\SysWOW64\stmea.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1116 "C:\Windows\SysWOW64\stmea.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\system32\stmea.exe 1120 "C:\Windows\SysWOW64\stmea.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\stmea.exe
        
        C:\Windows\SysWOW64\stmea.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\stmea.exe

Filesize
294KB

MD5
f7ccad9ff12aa38a3b2b9887485cad56

SHA1
78d71be9e51d25754bd148b1ac168dbcb92c6184

SHA256
7fc428d3d81f070ddadaa04b22268f0c48513c07a6cb8bb981c5a0b53c7a5ee3

SHA512
8e6c629637260e76c802c219442d2de34bb08f3dab26a77376d725eb31c888e49bae58176197e2660d0f06a1806c13e7eebebadc5ae908be963c6aabca5438f1

Download Submit
memory/464-18-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/464-15-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/1076-3-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/1280-26-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/1280-25-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2148-36-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/2328-24-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/3156-31-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/3296-56-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/4344-51-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/4516-61-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/4616-45-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/4704-41-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/4708-17-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4708-0-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4708-4-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4708-2-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/4836-66-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/4924-16-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download