Extracted

• • Target

    a942e57ad5f91351cc03c6b77b5dd439_JaffaCakes118

  • Size

    158KB

  • MD5

    a942e57ad5f91351cc03c6b77b5dd439

  • SHA1

    89ea1c58c986f81d01f4da5a2c2917437e7f392a

  • SHA256

    05aeda20e41ca92a853806bd846b8d1703ae8b36857f2aec62c298feca0624b1

  • SHA512

    e68cd052a94c31de9bcb49353f6dfb5a250181ba4847f4f542b7f4ab96dbf134597d450527a17b8f4406116f246f511d2799fd2e3d91562b5743c24f5cbcc821

  • SSDEEP

    3072:doixrduqW9Goin4lZoD9d16zVfMZ2KKNRdTaB:mW5jOA96xrRd

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Looks for VMWare Tools registry key

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2