metasploit | 0584b8ff348cc612c74eadecac608ee8fe92d63c7eca1a34b2f45bb19de2332d | Triage

Sharing

General

Target

JaffaCakes118_03bc60683f785e6c8a42966f24fe8424
Size

264KB
Sample

250121-lyp67aykfp
MD5

03bc60683f785e6c8a42966f24fe8424
SHA1

2decd5334b7434b2f04ef75c12e273d6c60ec1d8
SHA256

0584b8ff348cc612c74eadecac608ee8fe92d63c7eca1a34b2f45bb19de2332d
SHA512

b2281e9d4544e4c154620bf7b3b59d41371c50d81929de85c4ca80b8a75bff752d0900f7dc08b83fb3e12ec5ae5bdbf40292f298f9e4970101af5b12b7211dd5
SSDEEP

3072:Tq6zDsoY9iUeCRvRpR5RhD/HzkfVtLrNFSDg6w3x5VdO3huCFOnYit8aQ:TqKC9X/L/cVtLxthdGhvOf

Score

10^/10

metasploit backdoor defense_evasion discovery persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

- Target
  
  JaffaCakes118_03bc60683f785e6c8a42966f24fe8424
- Size
  
  264KB
- MD5
  
  03bc60683f785e6c8a42966f24fe8424
- SHA1
  
  2decd5334b7434b2f04ef75c12e273d6c60ec1d8
- SHA256
  
  0584b8ff348cc612c74eadecac608ee8fe92d63c7eca1a34b2f45bb19de2332d
- SHA512
  
  b2281e9d4544e4c154620bf7b3b59d41371c50d81929de85c4ca80b8a75bff752d0900f7dc08b83fb3e12ec5ae5bdbf40292f298f9e4970101af5b12b7211dd5
- SSDEEP
  
  3072:Tq6zDsoY9iUeCRvRpR5RhD/HzkfVtLrNFSDg6w3x5VdO3huCFOnYit8aQ:TqKC9X/L/cVtLxthdGhvOf
Score

10^/10

metasploit backdoor defense_evasion discovery persistence trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Modifies firewall policy service
  defense_evasion
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

metasploitbackdoordefense_evasiondiscoverypersistencetrojan

behavioral2

metasploitbackdoordefense_evasiondiscoverypersistencetrojan