metasploit | 156325cabc8969ca4e517949ad5aac39520879ffb136d793ce9f8972813d7a8c | Triage

Sharing

General

Target

b45a910ac7f965d9f95dce93ca78c61d_JaffaCakes118
Size

53KB
Sample

241130-carwfa1lcm
MD5

b45a910ac7f965d9f95dce93ca78c61d
SHA1

0bc171f0013550d9a4b0bc2583b43f38e27f424b
SHA256

156325cabc8969ca4e517949ad5aac39520879ffb136d793ce9f8972813d7a8c
SHA512

6fd9c26042bf0845e911e266257448fa710403319c1c3fea677331b62ca971219f379b4ed653474da8c3aca00c6d1c88a8b3e30e4f543739b12b0525a2625029
SSDEEP

768:N7Bmi7TZITxaPE4YwEIpHrQ4NJ+tkXbMVeT5hBoDb9qCKpvzwYsw2M:Noi7TKdaPpEIuCXbM0hB+8UYsw2M

Score

10^/10

metasploit backdoor discovery evasion persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  b45a910ac7f965d9f95dce93ca78c61d_JaffaCakes118
- Size
  
  53KB
- MD5
  
  b45a910ac7f965d9f95dce93ca78c61d
- SHA1
  
  0bc171f0013550d9a4b0bc2583b43f38e27f424b
- SHA256
  
  156325cabc8969ca4e517949ad5aac39520879ffb136d793ce9f8972813d7a8c
- SHA512
  
  6fd9c26042bf0845e911e266257448fa710403319c1c3fea677331b62ca971219f379b4ed653474da8c3aca00c6d1c88a8b3e30e4f543739b12b0525a2625029
- SSDEEP
  
  768:N7Bmi7TZITxaPE4YwEIpHrQ4NJ+tkXbMVeT5hBoDb9qCKpvzwYsw2M:Noi7TKdaPpEIuCXbM0hB+8UYsw2M
Score

10^/10

metasploit backdoor discovery evasion persistence trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoveryevasionpersistencetrojan

behavioral2

metasploitbackdoordiscoveryevasionpersistencetrojan