metasploit | 56246e742010b711745e48e61c2a34ada7bcd19c80224ce03d0b398dbe08ca26 | Triage

Sharing

General

Target

987479d24b50689b283c4098c4db39d5_JaffaCakes118
Size

140KB
Sample

241125-b3nttaxkcj
MD5

987479d24b50689b283c4098c4db39d5
SHA1

d43d93d73cdc569787d7f306a170d181b88534a0
SHA256

56246e742010b711745e48e61c2a34ada7bcd19c80224ce03d0b398dbe08ca26
SHA512

c06eb09d62f2af207f3f6bd818b8bb47303c6cc54135fa263ba0ac2a401f74e420699a3376872f11e7926ca0c5769cb38ba3fee87a7020955ebde5eb3f4a8b92
SSDEEP

3072:R3OVNXgWYmutXzUO8oD6mvwc/+HC4UNJjEenSDAr48Lp:FOojXAnDXixjda8Lp

Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  987479d24b50689b283c4098c4db39d5_JaffaCakes118
- Size
  
  140KB
- MD5
  
  987479d24b50689b283c4098c4db39d5
- SHA1
  
  d43d93d73cdc569787d7f306a170d181b88534a0
- SHA256
  
  56246e742010b711745e48e61c2a34ada7bcd19c80224ce03d0b398dbe08ca26
- SHA512
  
  c06eb09d62f2af207f3f6bd818b8bb47303c6cc54135fa263ba0ac2a401f74e420699a3376872f11e7926ca0c5769cb38ba3fee87a7020955ebde5eb3f4a8b92
- SSDEEP
  
  3072:R3OVNXgWYmutXzUO8oD6mvwc/+HC4UNJjEenSDAr48Lp:FOojXAnDXixjda8Lp
Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Modifies firewall policy service
  evasion
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan