metasploit | e047ffd376de7091472a9259813e9e91790fd8dd4ff5ba90a7054242f6b075e6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe
Size

832KB
MD5

b1f2d0b40827c4923df9074d535a1401
SHA1

4d483e84d6c62b7764ba4c7d657393d476ccf647
SHA256

e047ffd376de7091472a9259813e9e91790fd8dd4ff5ba90a7054242f6b075e6
SHA512

3576ee0dfecc01f1fe049e07e2f84566dfae2bbb84c06a210fea5916b02afe912c50dfdf43288de70c03bfef3a9a7c9227c239d1e875b01f479e70c80a25d433
SSDEEP

12288:7XrHTWz5AkGaOTTAPWwC3kAH4cdzG7Qd0ynYaJflJy2jhFR5Nl3s2r3eIYQ5yws:DjCV0TbL37YKSaJf221F/82r3eJQn

Score

10^/10

metasploit backdoor discovery evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\sysdrv32.sys	wmisym.exe

Deletes itself 1 IoCs

pid	Process
2640	wmisym.exe

Executes dropped EXE 1 IoCs

pid	Process
2640	wmisym.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine	b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wmisym.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2432	b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe
2640	wmisym.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\wmisym.exe	b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe
File opened for modification	C:\Windows\system\wmisym.exe	b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmisym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2124	ipconfig.exe
1600	ipconfig.exe
1264	ipconfig.exe
2012	ipconfig.exe
1300	ipconfig.exe
2168	ipconfig.exe
2632	ipconfig.exe
1528	ipconfig.exe
2156	ipconfig.exe
444	ipconfig.exe
1536	ipconfig.exe
2040	ipconfig.exe
2332	ipconfig.exe
1236	ipconfig.exe
1856	ipconfig.exe
1896	ipconfig.exe
876	ipconfig.exe
3024	ipconfig.exe
3056	ipconfig.exe
2604	ipconfig.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wmisym.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wmisym.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wmisym.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wmisym.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wmisym.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wmisym.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe
2640	wmisym.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2604	2640	wmisym.exe	32
PID 2640 wrote to memory of 2604	2640	wmisym.exe	32
PID 2640 wrote to memory of 2604	2640	wmisym.exe	32
PID 2640 wrote to memory of 2604	2640	wmisym.exe	32
PID 2640 wrote to memory of 2632	2640	wmisym.exe	34
PID 2640 wrote to memory of 2632	2640	wmisym.exe	34
PID 2640 wrote to memory of 2632	2640	wmisym.exe	34
PID 2640 wrote to memory of 2632	2640	wmisym.exe	34
PID 2640 wrote to memory of 1856	2640	wmisym.exe	36
PID 2640 wrote to memory of 1856	2640	wmisym.exe	36
PID 2640 wrote to memory of 1856	2640	wmisym.exe	36
PID 2640 wrote to memory of 1856	2640	wmisym.exe	36
PID 2640 wrote to memory of 1528	2640	wmisym.exe	38
PID 2640 wrote to memory of 1528	2640	wmisym.exe	38
PID 2640 wrote to memory of 1528	2640	wmisym.exe	38
PID 2640 wrote to memory of 1528	2640	wmisym.exe	38
PID 2640 wrote to memory of 2156	2640	wmisym.exe	40
PID 2640 wrote to memory of 2156	2640	wmisym.exe	40
PID 2640 wrote to memory of 2156	2640	wmisym.exe	40
PID 2640 wrote to memory of 2156	2640	wmisym.exe	40
PID 2640 wrote to memory of 2124	2640	wmisym.exe	42
PID 2640 wrote to memory of 2124	2640	wmisym.exe	42
PID 2640 wrote to memory of 2124	2640	wmisym.exe	42
PID 2640 wrote to memory of 2124	2640	wmisym.exe	42
PID 2640 wrote to memory of 444	2640	wmisym.exe	44
PID 2640 wrote to memory of 444	2640	wmisym.exe	44
PID 2640 wrote to memory of 444	2640	wmisym.exe	44
PID 2640 wrote to memory of 444	2640	wmisym.exe	44
PID 2640 wrote to memory of 1600	2640	wmisym.exe	46
PID 2640 wrote to memory of 1600	2640	wmisym.exe	46
PID 2640 wrote to memory of 1600	2640	wmisym.exe	46
PID 2640 wrote to memory of 1600	2640	wmisym.exe	46
PID 2640 wrote to memory of 1896	2640	wmisym.exe	48
PID 2640 wrote to memory of 1896	2640	wmisym.exe	48
PID 2640 wrote to memory of 1896	2640	wmisym.exe	48
PID 2640 wrote to memory of 1896	2640	wmisym.exe	48
PID 2640 wrote to memory of 1536	2640	wmisym.exe	50
PID 2640 wrote to memory of 1536	2640	wmisym.exe	50
PID 2640 wrote to memory of 1536	2640	wmisym.exe	50
PID 2640 wrote to memory of 1536	2640	wmisym.exe	50
PID 2640 wrote to memory of 2040	2640	wmisym.exe	52
PID 2640 wrote to memory of 2040	2640	wmisym.exe	52
PID 2640 wrote to memory of 2040	2640	wmisym.exe	52
PID 2640 wrote to memory of 2040	2640	wmisym.exe	52
PID 2640 wrote to memory of 1264	2640	wmisym.exe	55
PID 2640 wrote to memory of 1264	2640	wmisym.exe	55
PID 2640 wrote to memory of 1264	2640	wmisym.exe	55
PID 2640 wrote to memory of 1264	2640	wmisym.exe	55
PID 2640 wrote to memory of 876	2640	wmisym.exe	57
PID 2640 wrote to memory of 876	2640	wmisym.exe	57
PID 2640 wrote to memory of 876	2640	wmisym.exe	57
PID 2640 wrote to memory of 876	2640	wmisym.exe	57
PID 2640 wrote to memory of 2332	2640	wmisym.exe	59
PID 2640 wrote to memory of 2332	2640	wmisym.exe	59
PID 2640 wrote to memory of 2332	2640	wmisym.exe	59
PID 2640 wrote to memory of 2332	2640	wmisym.exe	59
PID 2640 wrote to memory of 3024	2640	wmisym.exe	61
PID 2640 wrote to memory of 3024	2640	wmisym.exe	61
PID 2640 wrote to memory of 3024	2640	wmisym.exe	61
PID 2640 wrote to memory of 3024	2640	wmisym.exe	61
PID 2640 wrote to memory of 2012	2640	wmisym.exe	63
PID 2640 wrote to memory of 2012	2640	wmisym.exe	63
PID 2640 wrote to memory of 2012	2640	wmisym.exe	63
PID 2640 wrote to memory of 2012	2640	wmisym.exe	63

C:\Users\Admin\AppData\Local\Temp\b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b1f2d0b40827c4923df9074d535a1401_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2432

C:\Windows\system\wmisym.exe
"C:\Windows\system\wmisym.exe"
1⤵
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2604
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2632
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1856
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1528
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2156
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2124
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:444
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1600
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1896
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1536
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2040
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1264
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:876
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2332
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:3024
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2012
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1300
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:2168
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:3056
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\wmisym.exe

Filesize
832KB

MD5
b1f2d0b40827c4923df9074d535a1401

SHA1
4d483e84d6c62b7764ba4c7d657393d476ccf647

SHA256
e047ffd376de7091472a9259813e9e91790fd8dd4ff5ba90a7054242f6b075e6

SHA512
3576ee0dfecc01f1fe049e07e2f84566dfae2bbb84c06a210fea5916b02afe912c50dfdf43288de70c03bfef3a9a7c9227c239d1e875b01f479e70c80a25d433

Download Submit
memory/2432-0-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2432-1-0x0000000000401000-0x0000000000409000-memory.dmp

Filesize
32KB

Download
memory/2432-2-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2432-8-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2432-7-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2432-6-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2432-3-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-23-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-28-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-12-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-14-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-16-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-17-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-19-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-20-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-21-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-22-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-10-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-24-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-25-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-26-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-27-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-13-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-29-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-30-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-31-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-32-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-33-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-34-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-35-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-36-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-37-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-38-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-39-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-40-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-41-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-42-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/2640-43-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download