metasploit | fc4acad299014093f342eb4c49a2ae667a2886b0cc4d0f1b8c21bfbba5ec272c

General

Target

b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe
Size

70KB
MD5

b502f608de7d1a366003ff151cf73bcb
SHA1

49281de4817a1e0a691aac891ddff4bfe118639d
SHA256

fc4acad299014093f342eb4c49a2ae667a2886b0cc4d0f1b8c21bfbba5ec272c
SHA512

c26a55318827fe936824855a8f6fb676fe1a29adc7b2ccbe6826b4045a72218da0b11b0c3412d6a6abf8540094a557ecf50778684db42e57473ecd63c6867b2d
SSDEEP

1536:bOhplcsHv1X6n0III8oKq3xiiF2MrPrSdpJYQBe4Yc0vGnouy8xOj:bOXpHv1O0II3oH3zcNjJYa9outG

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.187.156:8080

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 1 IoCs

pid	Process
2620	sc.exe

Loads dropped DLL 2 IoCs

pid	Process
2492	cmd.exe
2492	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1736-53-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2620	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2836	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2836	EXCEL.EXE
2836	EXCEL.EXE
2836	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2492	1736	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2492	1736	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2492	1736	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe	30
PID 1736 wrote to memory of 2492	1736	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2836	2492	cmd.exe	32
PID 2492 wrote to memory of 2620	2492	cmd.exe	33
PID 2492 wrote to memory of 2620	2492	cmd.exe	33
PID 2492 wrote to memory of 2620	2492	cmd.exe	33
PID 2492 wrote to memory of 2620	2492	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\9BE2.tmp\test.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\9BE2.tmp\sc.exe
    sc.exe
    3⤵
    - Executes dropped EXE
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9BE2.tmp\temp.xlsx

Filesize
11KB

MD5
d322837ecf828b72213d1215d7df8452

SHA1
4465d3b4ed7cd6c48cd0228f4e1f47c39e1f2984

SHA256
4fd2375b67dd3da309cc6b514be94263221613a460beabc6cfe5da46dd924711

SHA512
705ec382b4a26b4725a113687e3431d702f20a375241654b579aa938fccdf9938a3fabb16e00b83e4b45b8e942cb7494068b1b44f19764232899419d9f1f207a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp\test.bat

Filesize
93B

MD5
774214535d40ee5a70aac11ac6575c6c

SHA1
15c536161c0c60d8790bc4dd66e7e0b5edaf9ace

SHA256
f78a7d3fa6b98b2f38a0136cb49bf9a15312a5f25ad32030c2057bf514214ace

SHA512
8e840db22f44e4a5fd84c2414300d9a753447b8294599742eb08227ddd9ef63243e1be26a01276163277f69e2f1d5d788f6ec745b7075898b377d7da59366cdb

Download Submit
\Users\Admin\AppData\Local\Temp\9BE2.tmp\sc.exe

Filesize
72KB

MD5
b98207b39575544c8aeff91113d26c71

SHA1
26c41d58e8a79127b80619a7a6fc4b5458a5fe64

SHA256
13dd32661d365285d8a55b69423ab8782d5cd5ead5c53e46cb33ea32032127c4

SHA512
5719dafff7078eea7d76328e2b3691584fcffbfc2aaa75eb74bb1dd93f878236d65308bb6fdaf726f6ea36c210a30349b9a0d3419feebf9acd765f70cbc83e54

Download Submit
memory/1736-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1736-53-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2836-42-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2836-43-0x00000000720CD000-0x00000000720D8000-memory.dmp

Filesize
44KB

Download
memory/2836-54-0x00000000720CD000-0x00000000720D8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing