metasploit | e0bac03f4bf0f79e71fd185fee80fb310d35c6a73e0c19243d532df1767e9af6 | Triage

Sharing

General

Target

f0466f63db57f3a629cb37a54de3e202_JaffaCakes118
Size

171KB
Sample

241214-xxhaqs1nhw
MD5

f0466f63db57f3a629cb37a54de3e202
SHA1

d9d5be3efec8964b53c054e65c14e586b6196222
SHA256

e0bac03f4bf0f79e71fd185fee80fb310d35c6a73e0c19243d532df1767e9af6
SHA512

a7976767d282294c560348ea4d3be81b5d1025ee7b3c5b1740a2dfe2f01c4a07747fa8b01d85bbb640be79c813910154e7c85a9b06ed66df31926e6299f07b96
SSDEEP

3072:SX52abdMtQMSd1w9nRJYlgVxIN9h1PN84mOyWxe7T:q5nb3i9nRJ+gVE/88xen

Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  f0466f63db57f3a629cb37a54de3e202_JaffaCakes118
- Size
  
  171KB
- MD5
  
  f0466f63db57f3a629cb37a54de3e202
- SHA1
  
  d9d5be3efec8964b53c054e65c14e586b6196222
- SHA256
  
  e0bac03f4bf0f79e71fd185fee80fb310d35c6a73e0c19243d532df1767e9af6
- SHA512
  
  a7976767d282294c560348ea4d3be81b5d1025ee7b3c5b1740a2dfe2f01c4a07747fa8b01d85bbb640be79c813910154e7c85a9b06ed66df31926e6299f07b96
- SSDEEP
  
  3072:SX52abdMtQMSd1w9nRJYlgVxIN9h1PN84mOyWxe7T:q5nb3i9nRJ+gVE/88xen
Score

10^/10

metasploit backdoor discovery evasion persistence privilege_escalation trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Modifies firewall policy service
  evasion
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

metasploitbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan