metasploit | fc4acad299014093f342eb4c49a2ae667a2886b0cc4d0f1b8c21bfbba5ec272c

General

Target

b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe
Size

70KB
MD5

b502f608de7d1a366003ff151cf73bcb
SHA1

49281de4817a1e0a691aac891ddff4bfe118639d
SHA256

fc4acad299014093f342eb4c49a2ae667a2886b0cc4d0f1b8c21bfbba5ec272c
SHA512

c26a55318827fe936824855a8f6fb676fe1a29adc7b2ccbe6826b4045a72218da0b11b0c3412d6a6abf8540094a557ecf50778684db42e57473ecd63c6867b2d
SSDEEP

1536:bOhplcsHv1X6n0III8oKq3xiiF2MrPrSdpJYQBe4Yc0vGnouy8xOj:bOXpHv1O0II3oH3zcNjJYa9outG

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

192.168.187.156:8080

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3360	sc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3940-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/3940-18-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3360	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1608	EXCEL.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1608	EXCEL.EXE
1608	EXCEL.EXE
1608	EXCEL.EXE
1608	EXCEL.EXE
1608	EXCEL.EXE
1608	EXCEL.EXE
1608	EXCEL.EXE
1608	EXCEL.EXE
1608	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4052	3940	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe	83
PID 3940 wrote to memory of 4052	3940	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe	83
PID 3940 wrote to memory of 4052	3940	b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe	83
PID 4052 wrote to memory of 1608	4052	cmd.exe	86
PID 4052 wrote to memory of 1608	4052	cmd.exe	86
PID 4052 wrote to memory of 1608	4052	cmd.exe	86
PID 4052 wrote to memory of 3360	4052	cmd.exe	87
PID 4052 wrote to memory of 3360	4052	cmd.exe	87
PID 4052 wrote to memory of 3360	4052	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b502f608de7d1a366003ff151cf73bcb_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\96A2.tmp\test.bat" "
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\96A2.tmp\temp.xlsx"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\96A2.tmp\sc.exe
    sc.exe
    3⤵
    - Executes dropped EXE
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\96A2.tmp\sc.exe

Filesize
72KB

MD5
b98207b39575544c8aeff91113d26c71

SHA1
26c41d58e8a79127b80619a7a6fc4b5458a5fe64

SHA256
13dd32661d365285d8a55b69423ab8782d5cd5ead5c53e46cb33ea32032127c4

SHA512
5719dafff7078eea7d76328e2b3691584fcffbfc2aaa75eb74bb1dd93f878236d65308bb6fdaf726f6ea36c210a30349b9a0d3419feebf9acd765f70cbc83e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\96A2.tmp\temp.xlsx

Filesize
11KB

MD5
d322837ecf828b72213d1215d7df8452

SHA1
4465d3b4ed7cd6c48cd0228f4e1f47c39e1f2984

SHA256
4fd2375b67dd3da309cc6b514be94263221613a460beabc6cfe5da46dd924711

SHA512
705ec382b4a26b4725a113687e3431d702f20a375241654b579aa938fccdf9938a3fabb16e00b83e4b45b8e942cb7494068b1b44f19764232899419d9f1f207a

Download Submit
C:\Users\Admin\AppData\Local\Temp\96A2.tmp\test.bat

Filesize
93B

MD5
774214535d40ee5a70aac11ac6575c6c

SHA1
15c536161c0c60d8790bc4dd66e7e0b5edaf9ace

SHA256
f78a7d3fa6b98b2f38a0136cb49bf9a15312a5f25ad32030c2057bf514214ace

SHA512
8e840db22f44e4a5fd84c2414300d9a753447b8294599742eb08227ddd9ef63243e1be26a01276163277f69e2f1d5d788f6ec745b7075898b377d7da59366cdb

Download Submit
memory/1608-29-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-24-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-16-0x00007FFC6954D000-0x00007FFC6954E000-memory.dmp

Filesize
4KB

Download
memory/1608-43-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-15-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/1608-20-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/1608-19-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/1608-21-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-23-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/1608-26-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-25-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/1608-42-0x00007FFC6954D000-0x00007FFC6954E000-memory.dmp

Filesize
4KB

Download
memory/1608-22-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-27-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-28-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-41-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/1608-30-0x00007FFC27230000-0x00007FFC27240000-memory.dmp

Filesize
64KB

Download
memory/1608-31-0x00007FFC27230000-0x00007FFC27240000-memory.dmp

Filesize
64KB

Download
memory/3360-14-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/3940-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3940-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads