Extracted

• • Target

    cd41210fd5842246730ea806cd312b2d_JaffaCakes118

  • Size

    172KB

  • MD5

    cd41210fd5842246730ea806cd312b2d

  • SHA1

    f6fc62d692bd43c070ec5715909a192f97f26c54

  • SHA256

    123ec919207604d2f08ad9419ce7d1ba7112009973796835c5bc86152830dc2c

  • SHA512

    8d6868c8594c44082d133c4d6f22c497db1a174f30a6818b71e6e630b9b2aa847a2d78af10017403b87fd95457119f65c6d629152832e32ee8efac8346986218

  • SSDEEP

    3072:doixrduqW9Goin4lZoD9d16zVfMZ2KKNRdTaB:mW5jOA96xrRd

  Score

  10^/10

  metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Looks for VMWare Tools registry key

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2