metasploit | 11c0fd540f52098dd29fd81ade38bdee44e3f45a44485a43699d1275d253e7b6 | Triage

Sharing

General

Target

d446284002f47cbf7f565e80a16c3854_JaffaCakes118
Size

137KB
Sample

241208-absg9awqdj
MD5

d446284002f47cbf7f565e80a16c3854
SHA1

9bd0cd9833efdc7154c3d7dd99914dbb17e6fbd3
SHA256

11c0fd540f52098dd29fd81ade38bdee44e3f45a44485a43699d1275d253e7b6
SHA512

9002454217757f2d225f81d0f967141771663ee01fc8a13ee429a8a5da67760990f6e1997eebe8169a8ff2c0c8619b6b025cd388d92d6216947a2a391556b8b8
SSDEEP

3072:sjcrKunQngXHNz1i2XlCmYBsqy0f7VMzRmle4YPvjil47tJYY3:sjdu4eHL91CmYWqrxMglaWl4Z

Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  d446284002f47cbf7f565e80a16c3854_JaffaCakes118
- Size
  
  137KB
- MD5
  
  d446284002f47cbf7f565e80a16c3854
- SHA1
  
  9bd0cd9833efdc7154c3d7dd99914dbb17e6fbd3
- SHA256
  
  11c0fd540f52098dd29fd81ade38bdee44e3f45a44485a43699d1275d253e7b6
- SHA512
  
  9002454217757f2d225f81d0f967141771663ee01fc8a13ee429a8a5da67760990f6e1997eebe8169a8ff2c0c8619b6b025cd388d92d6216947a2a391556b8b8
- SSDEEP
  
  3072:sjcrKunQngXHNz1i2XlCmYBsqy0f7VMzRmle4YPvjil47tJYY3:sjdu4eHL91CmYWqrxMglaWl4Z
Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Modifies firewall policy service
  evasion
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan