metasploit | 019029d03d9726f5ba3206f0e4aae9414c7d301dd9d8fbe4527e3b5e609abb0c

General

Target

f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe
Size

32KB
MD5

f3f025de4af900300b7070b63980b4ff
SHA1

39416f80cbe54d641e8533e005264f2fd1b85f25
SHA256

019029d03d9726f5ba3206f0e4aae9414c7d301dd9d8fbe4527e3b5e609abb0c
SHA512

33cd7169ac34cc7e482872c497fabb4d98452f96f1a3919aa62f1831ce9b96268fd1dddeb23b7817b33c2b58b84cd99bcca4a8220909e1180ed66d25f0b3f668
SSDEEP

768:XTlZgICDGYpAMir1e3lOfXOp5KEEK7Hg7iqaATldPi7Nd/naITaVXJKD8y06xByL:jlZgICjyk1OfXOp5XEK7Hg7i+Tbi7j/k

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4948	pic.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wxptdi.sys	pic.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 1816	4948	pic.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	1816	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pic.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	pic.exe
4948	pic.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4948	4712	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe	82
PID 4712 wrote to memory of 4948	4712	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe	82
PID 4712 wrote to memory of 4948	4712	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe	82
PID 4712 wrote to memory of 2984	4712	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe	84
PID 4712 wrote to memory of 2984	4712	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe	84
PID 4712 wrote to memory of 2984	4712	f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe	84
PID 4948 wrote to memory of 1816	4948	pic.exe	86
PID 4948 wrote to memory of 1816	4948	pic.exe	86
PID 4948 wrote to memory of 1816	4948	pic.exe	86
PID 4948 wrote to memory of 1816	4948	pic.exe	86
PID 4948 wrote to memory of 1816	4948	pic.exe	86

C:\Users\Admin\AppData\Local\Temp\f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\pic.exe
  "C:\Users\Admin\AppData\Local\Temp\pic.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\pic.exe
    3⤵
    PID:1816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 12
      4⤵
      Program crash
      PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OPE8FCD.bat" "" "C:\Users\Admin\AppData\Local\Temp" "f3f025de4af900300b7070b63980b4ff_JaffaCakes118.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1816 -ip 1816
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OPE8FCD.bat

Filesize
44B

MD5
bd72f632464c3ff2f5a20870b59aa27b

SHA1
4bbb3d50ec61ce9adebf98a3c8f7a0bbe960a684

SHA256
9ddaf09d8002847f4ab98a3e2f50730aa4a6950815aeef1ec55bae5482afb0f4

SHA512
12295684b9c54f7a3a55c60be888941124072c864f1b52f438bfc04a929ba1e6add8a088f06d3812591a2441ec3409584a72d96f2dd8ebd47c7a7fce51443676

Download Submit
C:\Users\Admin\AppData\Local\Temp\pic.exe

Filesize
30KB

MD5
702d3be877923dc28fdce8931775b7ae

SHA1
8223a86a9feb77aded9834f4959b020f0ee43823

SHA256
86317e3059cfe0c1252d9d7ddfa6999ccba1aebab0a6c3e81d28fe7edd9986f7

SHA512
92ec7bd649d7609c8aa671697cbd467e108a0db84cbf2730b1094cf9e307fd53e304a3e8d849f48b176f426991455eef144946cf803ccfee170ed46fe698f68d

Download Submit
memory/1816-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4712-0-0x0000000000400000-0x0000000000409BE0-memory.dmp

Filesize
38KB

Download
memory/4712-12-0x0000000000400000-0x0000000000409BE0-memory.dmp

Filesize
38KB

Download

Analysis

Sharing