metasploit | 761f051cd575407a40807b5ad0db20ab76c8d65d7be002fc1cf6a5a78a91aa1e

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe
Size

475KB
MD5

8db6672a29b554495af1d24c7eda844d
SHA1

8ba5ce1e77622665b726df922660a28961d66f34
SHA256

761f051cd575407a40807b5ad0db20ab76c8d65d7be002fc1cf6a5a78a91aa1e
SHA512

302eeb07e0da383a8fd5d7f492e837c1beb9d70e2a0ea5333d99c828334e02769f1dea2b2bf39f5f9bd8ee40359df63d977dcc5df2befe4f75cc81661a9978d3
SSDEEP

6144:oRDq+wpswbLTjEY6YjH9NoQdIjVMrtM063NOIgtLti+A21xS9:uq+fwP36YHxdIiM0CNObtLtAd

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

188.2.226.6:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3092	HaHaHa.exe
2380	putty.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HaHaHa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	putty.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3092	1664	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe	84
PID 1664 wrote to memory of 3092	1664	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe	84
PID 1664 wrote to memory of 3092	1664	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe	84
PID 1664 wrote to memory of 2380	1664	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe	85
PID 1664 wrote to memory of 2380	1664	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe	85
PID 1664 wrote to memory of 2380	1664	8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8db6672a29b554495af1d24c7eda844d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\HaHaHa.exe
  "C:\Users\Admin\AppData\Local\Temp\HaHaHa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3092
- C:\Users\Admin\AppData\Local\Temp\putty.exe
  "C:\Users\Admin\AppData\Local\Temp\putty.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HaHaHa.exe

Filesize
72KB

MD5
5cbc3551b842acd3bb3ddb1fa5cf55b7

SHA1
7bb01ee24cd974781f97ff89868f0a52bff788d2

SHA256
f5e4677a6f3b16e7f650336cf9c41711f985198fc02cc133c8c98de1a728c8b5

SHA512
ce6743babc0596afe86b600a897735822aaa9c1593f271f352ff1ad300453445ddc961f030f6907fa93211800050647fc24ee4bf78fa58990a27452fa394562f

Download Submit
C:\Users\Admin\AppData\Local\Temp\putty.exe

Filesize
444KB

MD5
9bb6826905965c13be1c84cc0ff83f42

SHA1
ae7734e7a54353ab13ecba780ed62344332fbc6f

SHA256
cfa4f56807405fd36e406688feb970a0d0d4854456ba2da72e4a33a27b01d9ae

SHA512
09b5f6be1f638948854a4e332b9c0f74c8583db23c0d3d905c1467a5daaf571a57a04b0e91867b4a8984cb43b19df7fc41dc182841db9dc637389e135cfd211f

Download Submit
memory/3092-19-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download