metasploit | 02468c056a80b650117d022bf8cec92e8e5ab1d54bffc2be57c69ba75900939f

Analysis

max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe
Size

237KB
MD5

af159f69da69a1347f4aec364d8d516a
SHA1

43cc8809c0b7047dba560bd2ed5a1b5f51413956
SHA256

02468c056a80b650117d022bf8cec92e8e5ab1d54bffc2be57c69ba75900939f
SHA512

8a619ebea6abd76e7be47eb6f8c1a315f19c5f7f8cf65388493f2069e4bd2d92e8efd477d13a98b577736ee02131e1ad58a8fd23f941a35f95ff259eaa9b3257
SSDEEP

6144:Sv2B6BePGPOud+nCHB0zaHy3bN0/Dhyi5laWM03ex:+leed+nC8l35QDUalaWMLx

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 9 IoCs

pid	Process
4864	taskmgr2.exe
2948	taskmgr2.exe
2312	taskmgr2.exe
1504	taskmgr2.exe
2396	taskmgr2.exe
3796	taskmgr2.exe
1728	taskmgr2.exe
3864	taskmgr2.exe
4384	taskmgr2.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe
File created	C:\Windows\SysWOW64\taskmgr2.exe	taskmgr2.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
5012	3088	WerFault.exe	82
2352	4864	WerFault.exe	90
440	2948	WerFault.exe	104
2504	2312	WerFault.exe	111
1944	1504	WerFault.exe	115
3228	2396	WerFault.exe	119
2352	3796	WerFault.exe	123
376	1728	WerFault.exe	127
1824	3864	WerFault.exe	131
3364	4384	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr2.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4864	3088	af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe	90
PID 3088 wrote to memory of 4864	3088	af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe	90
PID 3088 wrote to memory of 4864	3088	af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe	90
PID 4864 wrote to memory of 2948	4864	taskmgr2.exe	104
PID 4864 wrote to memory of 2948	4864	taskmgr2.exe	104
PID 4864 wrote to memory of 2948	4864	taskmgr2.exe	104
PID 2948 wrote to memory of 2312	2948	taskmgr2.exe	111
PID 2948 wrote to memory of 2312	2948	taskmgr2.exe	111
PID 2948 wrote to memory of 2312	2948	taskmgr2.exe	111
PID 2312 wrote to memory of 1504	2312	taskmgr2.exe	115
PID 2312 wrote to memory of 1504	2312	taskmgr2.exe	115
PID 2312 wrote to memory of 1504	2312	taskmgr2.exe	115
PID 1504 wrote to memory of 2396	1504	taskmgr2.exe	119
PID 1504 wrote to memory of 2396	1504	taskmgr2.exe	119
PID 1504 wrote to memory of 2396	1504	taskmgr2.exe	119
PID 2396 wrote to memory of 3796	2396	taskmgr2.exe	123
PID 2396 wrote to memory of 3796	2396	taskmgr2.exe	123
PID 2396 wrote to memory of 3796	2396	taskmgr2.exe	123
PID 3796 wrote to memory of 1728	3796	taskmgr2.exe	127
PID 3796 wrote to memory of 1728	3796	taskmgr2.exe	127
PID 3796 wrote to memory of 1728	3796	taskmgr2.exe	127
PID 1728 wrote to memory of 3864	1728	taskmgr2.exe	131
PID 1728 wrote to memory of 3864	1728	taskmgr2.exe	131
PID 1728 wrote to memory of 3864	1728	taskmgr2.exe	131
PID 3864 wrote to memory of 4384	3864	taskmgr2.exe	135
PID 3864 wrote to memory of 4384	3864	taskmgr2.exe	135
PID 3864 wrote to memory of 4384	3864	taskmgr2.exe	135

C:\Users\Admin\AppData\Local\Temp\af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 388
  2⤵
  - Program crash
  PID:5012
- C:\Windows\SysWOW64\taskmgr2.exe
  C:\Windows\system32\taskmgr2.exe 1344 "C:\Users\Admin\AppData\Local\Temp\af159f69da69a1347f4aec364d8d516a_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 392
    3⤵
    - Program crash
    PID:2352
- - C:\Windows\SysWOW64\taskmgr2.exe
    C:\Windows\system32\taskmgr2.exe 1288 "C:\Windows\SysWOW64\taskmgr2.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 356
      4⤵
      Program crash
      PID:440
  - - C:\Windows\SysWOW64\taskmgr2.exe
      C:\Windows\system32\taskmgr2.exe 1360 "C:\Windows\SysWOW64\taskmgr2.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 356
        5⤵
        Program crash
        
        PID:2504
    - - C:\Windows\SysWOW64\taskmgr2.exe
        
        C:\Windows\system32\taskmgr2.exe 1368 "C:\Windows\SysWOW64\taskmgr2.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 356
        6⤵
        Program crash
        
        PID:1944
      - C:\Windows\SysWOW64\taskmgr2.exe
        
        C:\Windows\system32\taskmgr2.exe 1376 "C:\Windows\SysWOW64\taskmgr2.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 356
        7⤵
        Program crash
        
        PID:3228
        
        C:\Windows\SysWOW64\taskmgr2.exe
        
        C:\Windows\system32\taskmgr2.exe 1384 "C:\Windows\SysWOW64\taskmgr2.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 356
        8⤵
        Program crash
        
        PID:2352
        
        C:\Windows\SysWOW64\taskmgr2.exe
        
        C:\Windows\system32\taskmgr2.exe 1388 "C:\Windows\SysWOW64\taskmgr2.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 356
        9⤵
        Program crash
        
        PID:376
        
        C:\Windows\SysWOW64\taskmgr2.exe
        
        C:\Windows\system32\taskmgr2.exe 1304 "C:\Windows\SysWOW64\taskmgr2.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 356
        10⤵
        Program crash
        
        PID:1824
        
        C:\Windows\SysWOW64\taskmgr2.exe
        
        C:\Windows\system32\taskmgr2.exe 1408 "C:\Windows\SysWOW64\taskmgr2.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 356
        11⤵
        Program crash
        
        PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3088 -ip 3088
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4864 -ip 4864
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2948 -ip 2948
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2312 -ip 2312
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1504 -ip 1504
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2396 -ip 2396
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3796 -ip 3796
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1728 -ip 1728
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3864 -ip 3864
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4384 -ip 4384
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\taskmgr2.exe

Filesize
237KB

MD5
af159f69da69a1347f4aec364d8d516a

SHA1
43cc8809c0b7047dba560bd2ed5a1b5f51413956

SHA256
02468c056a80b650117d022bf8cec92e8e5ab1d54bffc2be57c69ba75900939f

SHA512
8a619ebea6abd76e7be47eb6f8c1a315f19c5f7f8cf65388493f2069e4bd2d92e8efd477d13a98b577736ee02131e1ad58a8fd23f941a35f95ff259eaa9b3257

Download Submit
memory/1504-42-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1504-39-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1728-55-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1728-52-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2312-35-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2312-38-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2396-47-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2396-43-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2948-27-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2948-31-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2948-34-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2948-30-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/2948-28-0x00000000021B0000-0x00000000021B5000-memory.dmp

Filesize
20KB

Download
memory/2948-29-0x0000000002770000-0x000000000279B000-memory.dmp

Filesize
172KB

Download
memory/2948-24-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2948-25-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/3088-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3088-2-0x0000000000540000-0x0000000000580000-memory.dmp

Filesize
256KB

Download
memory/3088-3-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3088-17-0x0000000000540000-0x0000000000580000-memory.dmp

Filesize
256KB

Download
memory/3088-16-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3088-5-0x0000000002BE0000-0x0000000002C0B000-memory.dmp

Filesize
172KB

Download
memory/3088-4-0x00000000022F0000-0x00000000022F5000-memory.dmp

Filesize
20KB

Download
memory/3796-45-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3796-51-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3796-48-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3864-59-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/3864-56-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/4864-18-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/4864-12-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/4864-14-0x0000000000610000-0x0000000000650000-memory.dmp

Filesize
256KB

Download
memory/4864-20-0x0000000002A90000-0x0000000002ABB000-memory.dmp

Filesize
172KB

Download
memory/4864-26-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/4864-19-0x0000000002230000-0x0000000002235000-memory.dmp

Filesize
20KB

Download
memory/4864-21-0x0000000000610000-0x0000000000650000-memory.dmp

Filesize
256KB

Download
memory/4864-22-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download