metasploit | 2877b00a91b084f505130b2bd3acffa6fb1793e25a5344603b69164b89cbb8d2

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe
Size

72KB
MD5

9705355b04bbddd4bf58861654cea033
SHA1

7ef470f76bce54fc9077458980de1b4daf46afec
SHA256

2877b00a91b084f505130b2bd3acffa6fb1793e25a5344603b69164b89cbb8d2
SHA512

91ff1dabc96b234d052d5e93e9bf965bfd4598207bec8a74f780deafc443366b6455a373ff3df2c0e82dbc808b7bde315c5ccf916c229f9c3c66cd2b3d9cb89b
SSDEEP

1536:8JDk2kAB6s0D1NVQdHUnl5LPkXdl6WKCTVeOZzsbAFREqOE:sCo6zDVEHiYdlMCTVe6oAOE

Score

10^/10

metasploit backdoor discovery persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2364	smgr.exe
2924	smgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Data Serivce = "smgr.exe"	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2364 set thread context of 2924	2364	smgr.exe	37

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\smgr.exe	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe
File opened for modification	C:\Windows\smgr.exe	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Runs net.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2336 wrote to memory of 2516	2336	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	31
PID 2516 wrote to memory of 2792	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	32
PID 2516 wrote to memory of 2792	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	32
PID 2516 wrote to memory of 2792	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	32
PID 2516 wrote to memory of 2792	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	32
PID 2516 wrote to memory of 2364	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	34
PID 2516 wrote to memory of 2364	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	34
PID 2516 wrote to memory of 2364	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	34
PID 2516 wrote to memory of 2364	2516	JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe	34
PID 2792 wrote to memory of 2896	2792	cmd.exe	35
PID 2792 wrote to memory of 2896	2792	cmd.exe	35
PID 2792 wrote to memory of 2896	2792	cmd.exe	35
PID 2792 wrote to memory of 2896	2792	cmd.exe	35
PID 2896 wrote to memory of 2916	2896	net.exe	36
PID 2896 wrote to memory of 2916	2896	net.exe	36
PID 2896 wrote to memory of 2916	2896	net.exe	36
PID 2896 wrote to memory of 2916	2896	net.exe	36
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37
PID 2364 wrote to memory of 2924	2364	smgr.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9705355b04bbddd4bf58861654cea033.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\x.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\net.exe
      net stop "Security Center"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Security Center"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
- - C:\Windows\smgr.exe
    "C:\Windows\smgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\smgr.exe
      "C:\Windows\smgr.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2924

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\smgr.exe

Filesize
72KB

MD5
9705355b04bbddd4bf58861654cea033

SHA1
7ef470f76bce54fc9077458980de1b4daf46afec

SHA256
2877b00a91b084f505130b2bd3acffa6fb1793e25a5344603b69164b89cbb8d2

SHA512
91ff1dabc96b234d052d5e93e9bf965bfd4598207bec8a74f780deafc443366b6455a373ff3df2c0e82dbc808b7bde315c5ccf916c229f9c3c66cd2b3d9cb89b

Download Submit
C:\x.bat

Filesize
53B

MD5
e6ed7be2b9572503f07663ca6e53759f

SHA1
7ad80bd38f2a27e06c111b551c76ad0a0585c194

SHA256
b1a6c027d18eb5766129a059f68201e6fb8c68d095f3932983009fe5ae2e4df9

SHA512
e0010782b4fe567290536743375112db3107f8390d4c5cbb97f1bf1a8c83825399e1fe2fe9793d351896bb704f3bdec583fa7241b853b136fa9440a927d94227

Download Submit
memory/2336-16-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2364-55-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2516-12-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2516-10-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2516-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2516-4-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2516-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2516-17-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2516-34-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2516-2-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2516-7-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2612-74-0x00000000029B0000-0x00000000029C0000-memory.dmp

Filesize
64KB

Download
memory/2924-56-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2924-58-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2924-60-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2924-63-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2924-69-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2924-72-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2924-57-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads