metasploit | 61a3c2c99ab9ce479cf37921066a4fa64f638200411789e5128821b0c366b080

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe
Size

363KB
MD5

033a6d2b6ef4b2caf362017a163fa551
SHA1

29905c9c02facca403b1367dd892653dcbfcde19
SHA256

61a3c2c99ab9ce479cf37921066a4fa64f638200411789e5128821b0c366b080
SHA512

0c0843f55b0766a35b54c247eca5d7387f69b660a3fc28b6f6f88e1e0f4338a644746b0af8e8c90738a148cc8cfb80eaecfa0cd7af8f08fa87612adaeb76da9e
SSDEEP

6144:Z/L0kUoq1J19FwACAHu+UNl9/AlfEf3URNkAXehrjsNdMV26QF6L6hNfl:Z/L0kUnJ1UibUp/AlEf3sxXehrjs0RIt

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 10 IoCs

pid	Process
3288	wingate32.exe
3052	wingate32.exe
744	wingate32.exe
1420	wingate32.exe
3996	wingate32.exe
212	wingate32.exe
4492	wingate32.exe
1492	wingate32.exe
4536	wingate32.exe
4984	wingate32.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File created	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe
File opened for modification	C:\Windows\SysWOW64\wingate32.exe	wingate32.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingate32.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3288	384	033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe	82
PID 384 wrote to memory of 3288	384	033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe	82
PID 384 wrote to memory of 3288	384	033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe	82
PID 3288 wrote to memory of 3052	3288	wingate32.exe	90
PID 3288 wrote to memory of 3052	3288	wingate32.exe	90
PID 3288 wrote to memory of 3052	3288	wingate32.exe	90
PID 3052 wrote to memory of 744	3052	wingate32.exe	92
PID 3052 wrote to memory of 744	3052	wingate32.exe	92
PID 3052 wrote to memory of 744	3052	wingate32.exe	92
PID 744 wrote to memory of 1420	744	wingate32.exe	94
PID 744 wrote to memory of 1420	744	wingate32.exe	94
PID 744 wrote to memory of 1420	744	wingate32.exe	94
PID 1420 wrote to memory of 3996	1420	wingate32.exe	95
PID 1420 wrote to memory of 3996	1420	wingate32.exe	95
PID 1420 wrote to memory of 3996	1420	wingate32.exe	95
PID 3996 wrote to memory of 212	3996	wingate32.exe	96
PID 3996 wrote to memory of 212	3996	wingate32.exe	96
PID 3996 wrote to memory of 212	3996	wingate32.exe	96
PID 212 wrote to memory of 4492	212	wingate32.exe	97
PID 212 wrote to memory of 4492	212	wingate32.exe	97
PID 212 wrote to memory of 4492	212	wingate32.exe	97
PID 4492 wrote to memory of 1492	4492	wingate32.exe	98
PID 4492 wrote to memory of 1492	4492	wingate32.exe	98
PID 4492 wrote to memory of 1492	4492	wingate32.exe	98
PID 1492 wrote to memory of 4536	1492	wingate32.exe	99
PID 1492 wrote to memory of 4536	1492	wingate32.exe	99
PID 1492 wrote to memory of 4536	1492	wingate32.exe	99
PID 4536 wrote to memory of 4984	4536	wingate32.exe	100
PID 4536 wrote to memory of 4984	4536	wingate32.exe	100
PID 4536 wrote to memory of 4984	4536	wingate32.exe	100

C:\Users\Admin\AppData\Local\Temp\033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\wingate32.exe
  C:\Windows\system32\wingate32.exe 1148 "C:\Users\Admin\AppData\Local\Temp\033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\wingate32.exe
    C:\Windows\system32\wingate32.exe 1152 "C:\Windows\SysWOW64\wingate32.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\wingate32.exe
      C:\Windows\system32\wingate32.exe 1100 "C:\Windows\SysWOW64\wingate32.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:744
    - - C:\Windows\SysWOW64\wingate32.exe
        
        C:\Windows\system32\wingate32.exe 1128 "C:\Windows\SysWOW64\wingate32.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Windows\SysWOW64\wingate32.exe
        
        C:\Windows\system32\wingate32.exe 1124 "C:\Windows\SysWOW64\wingate32.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\wingate32.exe
        
        C:\Windows\system32\wingate32.exe 1132 "C:\Windows\SysWOW64\wingate32.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\wingate32.exe
        
        C:\Windows\system32\wingate32.exe 1136 "C:\Windows\SysWOW64\wingate32.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\wingate32.exe
        
        C:\Windows\system32\wingate32.exe 1140 "C:\Windows\SysWOW64\wingate32.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\wingate32.exe
        
        C:\Windows\system32\wingate32.exe 1176 "C:\Windows\SysWOW64\wingate32.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\wingate32.exe
        
        C:\Windows\system32\wingate32.exe 1156 "C:\Windows\SysWOW64\wingate32.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wingate32.exe

Filesize
363KB

MD5
033a6d2b6ef4b2caf362017a163fa551

SHA1
29905c9c02facca403b1367dd892653dcbfcde19

SHA256
61a3c2c99ab9ce479cf37921066a4fa64f638200411789e5128821b0c366b080

SHA512
0c0843f55b0766a35b54c247eca5d7387f69b660a3fc28b6f6f88e1e0f4338a644746b0af8e8c90738a148cc8cfb80eaecfa0cd7af8f08fa87612adaeb76da9e

Download Submit