Extracted

• • Target

    8f425d83c00a8657dc1166a2ff8d34db_JaffaCakes118

  • Size

    122KB

  • MD5

    8f425d83c00a8657dc1166a2ff8d34db

  • SHA1

    2131d705977f5fe7325b6fe6a32e75c9201a9f45

  • SHA256

    dd6ce76e8f6225349e107b3f8df86492db4041fba3247d2dbed8d085cb3cf621

  • SHA512

    f1831c1d138e0bce96c3f86c87557e6afa67e8fce36efe728466c2775737fffc692da5c46f611cd7633c77e798de41ade5946a1dcce0914bf9295a86d5b2faad

  • SSDEEP

    3072:LoixrduqW9Goin4lZoD9d16zVfMZ2KKNRdTaB:0W5jOA96xrRd

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Looks for VMWare Tools registry key

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2