metasploit | 7ce730884f014ab3484fde27480d354ea77f3f30d85073b166008ce97b9b6408

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
Size

172KB
MD5

17e62edbffb65db4d9c785246945834f
SHA1

c4eef4c795bcd7bb1a0ab8565b76ec7408f4b67b
SHA256

7ce730884f014ab3484fde27480d354ea77f3f30d85073b166008ce97b9b6408
SHA512

0505a4f71b61128c0046b3fc105078360d3ef7b5a96683dec9e242ef9ec58c7cbe3b4e3bfc5e61fc01655fd326362d60b81e217c29e6047d5fd9912ef8c7a8a5
SSDEEP

3072:VTc6jureGxlT93NUmmRPYfH9lUjcIimY9hGllsRSmEpZNpC:K6Me0JKi/Ccf1rlMmuk

Score

10^/10

metasploit backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

igfxdh86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxdh86.exe = "C:\\Windows\\SysWOW64\\igfxdh86.exe:*:Enabled:Intel Device Host"	igfxdh86.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	igfxdh86.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxdh86.exe = "C:\\Windows\\SysWOW64\\igfxdh86.exe:*:Enabled:Intel Device Host"	igfxdh86.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List	igfxdh86.exe

Deletes itself 1 IoCs

Processes:

igfxdh86.exe

pid process

2588 igfxdh86.exe
Executes dropped EXE 2 IoCs

Processes:

igfxdh86.exeigfxdh86.exe

pid process

2596 igfxdh86.exe
2588 igfxdh86.exe
Loads dropped DLL 3 IoCs

Processes:

17e62edbffb65db4d9c785246945834f_JaffaCakes118.exeigfxdh86.exe

pid process

3040 17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
3040 17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
2596 igfxdh86.exe

pid	process
2588	igfxdh86.exe

pid	process
2596	igfxdh86.exe
2588	igfxdh86.exe

pid	process
3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
2596	igfxdh86.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3040-3-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3040-4-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3040-2-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3040-6-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3040-9-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3040-8-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3040-7-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/3040-22-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2588-32-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2588-33-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2588-34-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2588-35-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2588-36-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2588-40-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2588-41-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

igfxdh86.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel Device Host = "C:\\Windows\\SysWOW64\\igfxdh86.exe" igfxdh86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel Device Host = "C:\\Windows\\SysWOW64\\igfxdh86.exe"	igfxdh86.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

17e62edbffb65db4d9c785246945834f_JaffaCakes118.exeigfxdh86.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdh86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdh86.exe

Drops file in System32 directory 4 IoCs

Processes:

17e62edbffb65db4d9c785246945834f_JaffaCakes118.exeigfxdh86.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\igfxdh86.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\igfxdh86.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdh86.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

17e62edbffb65db4d9c785246945834f_JaffaCakes118.exeigfxdh86.exe

description	pid	process	target process
PID 2752 set thread context of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 2596 set thread context of 2588	2596	igfxdh86.exe	igfxdh86.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

17e62edbffb65db4d9c785246945834f_JaffaCakes118.exeigfxdh86.exe

pid process

3040 17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
3040 17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
2588 igfxdh86.exe
2588 igfxdh86.exe

pid	process
3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
2588	igfxdh86.exe
2588	igfxdh86.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe17e62edbffb65db4d9c785246945834f_JaffaCakes118.exeigfxdh86.exeigfxdh86.exe

description	pid	process	target process
PID 2752 wrote to memory of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 2752 wrote to memory of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 2752 wrote to memory of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 2752 wrote to memory of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 2752 wrote to memory of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 2752 wrote to memory of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 2752 wrote to memory of 3040	2752	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
PID 3040 wrote to memory of 2596	3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	igfxdh86.exe
PID 3040 wrote to memory of 2596	3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	igfxdh86.exe
PID 3040 wrote to memory of 2596	3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	igfxdh86.exe
PID 3040 wrote to memory of 2596	3040	17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe	igfxdh86.exe
PID 2596 wrote to memory of 2588	2596	igfxdh86.exe	igfxdh86.exe
PID 2596 wrote to memory of 2588	2596	igfxdh86.exe	igfxdh86.exe
PID 2596 wrote to memory of 2588	2596	igfxdh86.exe	igfxdh86.exe
PID 2596 wrote to memory of 2588	2596	igfxdh86.exe	igfxdh86.exe
PID 2596 wrote to memory of 2588	2596	igfxdh86.exe	igfxdh86.exe
PID 2596 wrote to memory of 2588	2596	igfxdh86.exe	igfxdh86.exe
PID 2596 wrote to memory of 2588	2596	igfxdh86.exe	igfxdh86.exe
PID 2588 wrote to memory of 1172	2588	igfxdh86.exe	Explorer.EXE
PID 2588 wrote to memory of 1172	2588	igfxdh86.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1172

C:\Users\Admin\AppData\Local\Temp\17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\AppData\Local\Temp\17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17e62edbffb65db4d9c785246945834f_JaffaCakes118.exe"
3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\igfxdh86.exe
"C:\Windows\SysWOW64\igfxdh86.exe" C:\Users\Admin\AppData\Local\Temp\17E62E~1.EXE
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\igfxdh86.exe
"C:\Windows\SysWOW64\igfxdh86.exe" C:\Users\Admin\AppData\Local\Temp\17E62E~1.EXE
5⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\igfxdh86.exe
Filesize
172KB

MD5
17e62edbffb65db4d9c785246945834f

SHA1
c4eef4c795bcd7bb1a0ab8565b76ec7408f4b67b

SHA256
7ce730884f014ab3484fde27480d354ea77f3f30d85073b166008ce97b9b6408

SHA512
0505a4f71b61128c0046b3fc105078360d3ef7b5a96683dec9e242ef9ec58c7cbe3b4e3bfc5e61fc01655fd326362d60b81e217c29e6047d5fd9912ef8c7a8a5

Download Submit
memory/1172-37-0x0000000002170000-0x000000000218E000-memory.dmp

Filesize
120KB

Download
memory/1172-39-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/2588-34-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2588-35-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2588-41-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2588-40-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2588-36-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2588-33-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2588-32-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-22-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-3-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-6-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-2-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-4-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3040-9-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download