metasploit | 2f64c0bb42e364108eb4a8f7134f5dd59aa64862fe8b1fed62aad9b2757fe4a3

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe
Size

189KB
MD5

8aa0896372c84465ec2c153ae0e52cea
SHA1

02e86601cd1dc584ee59cd7f45607ea3cc4d79f4
SHA256

2f64c0bb42e364108eb4a8f7134f5dd59aa64862fe8b1fed62aad9b2757fe4a3
SHA512

706a25651a10a16833a2ecf96f88442b9920ccd160b140bfccd716fd86547a17824aa34ac220ee331977dd110c488a4e84580f322066a541e88dbe45b02ccadc
SSDEEP

3072:VX1T/7/i+aCYjYT9IbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7bm026qes:rTj/i+aCOG9GwvP6bQ7yMP+DE827y0x6

Score

10^/10

metasploit backdoor bootkit defense_evasion discovery persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	AGPdivX.exe

Windows security bypass 2 TTPs 5 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	AGPdivX.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	AGPdivX.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe

Deletes itself 1 IoCs

pid	Process
2852	AGPdivX.exe

Executes dropped EXE 1 IoCs

pid	Process
2852	AGPdivX.exe

Windows security modification 2 TTPs 5 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	AGPdivX.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	AGPdivX.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe
File opened for modification	\??\PhysicalDrive0	AGPdivX.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	AGPdivX.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AGPdivX.exe	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe
File opened for modification	C:\Windows\AGPdivX.exe	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AGPdivX.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AGPdivX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AGPdivX.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AGPdivX.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AGPdivX.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	AGPdivX.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AGPdivX.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	AGPdivX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	AGPdivX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	AGPdivX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aa0896372c84465ec2c153ae0e52cea.exe"
1⤵
- Looks for VMWare Tools registry key
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:308

C:\Windows\AGPdivX.exe
"C:\Windows\AGPdivX.exe"
1⤵
- Modifies security service
- Windows security bypass
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AGPdivX.exe

Filesize
189KB

MD5
8aa0896372c84465ec2c153ae0e52cea

SHA1
02e86601cd1dc584ee59cd7f45607ea3cc4d79f4

SHA256
2f64c0bb42e364108eb4a8f7134f5dd59aa64862fe8b1fed62aad9b2757fe4a3

SHA512
706a25651a10a16833a2ecf96f88442b9920ccd160b140bfccd716fd86547a17824aa34ac220ee331977dd110c488a4e84580f322066a541e88dbe45b02ccadc

Download Submit
memory/308-12-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/308-11-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/308-5-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/308-4-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/308-2-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/308-19-0x0000000000280000-0x00000000002B0000-memory.dmp

Filesize
192KB

Download
memory/308-13-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/308-3-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/308-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/308-7-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/308-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/308-1-0x0000000000280000-0x00000000002B0000-memory.dmp

Filesize
192KB

Download
memory/308-0-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/308-16-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-25-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2852-31-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-17-0x00000000004D0000-0x0000000000500000-memory.dmp

Filesize
192KB

Download
memory/2852-21-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2852-20-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2852-15-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-24-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2852-23-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2852-22-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2852-27-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-28-0x00000000004D0000-0x0000000000500000-memory.dmp

Filesize
192KB

Download
memory/2852-29-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-30-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-18-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/2852-32-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-33-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-35-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-36-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-37-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-38-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-39-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-40-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-41-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-42-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2852-43-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads