Overview

overview

10

Static

static

3

142a323521...18.exe

windows7-x64

10

142a323521...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    142a3235219c3eb059aeff433375db8e_JaffaCakes118

  • Size

    92KB

  • Sample

    240627-bn7clsvdkb

  • MD5

    142a3235219c3eb059aeff433375db8e

  • SHA1

    60bfb0e3b64967cb51cd5a34402fbacbfd9a15dc

  • SHA256

    6421fb46fc3f46c79cb95e2e78530dee35a7d10d85177bade93d69bab705a36e

  • SHA512

    f2a826581f250d67a64e9a781d1325d56acee59057d8adc4aa0d0bb697647788b71db59931b8820d2365df4e86631fa68ce0f1bb53e85c600a3d5a1cea8e0674

  • SSDEEP

    1536:eSquE20GQrSmGb1BMojS8Qnf6pgU3kOpzfVr0HvhxcVaH22IyPjlJxsLUw:xBmGr4mbUORfVr0PHEWJw

Score
10/10
metasploitbackdoorpersistencetrojanupx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      142a3235219c3eb059aeff433375db8e_JaffaCakes118

    • Size

      92KB

    • MD5

      142a3235219c3eb059aeff433375db8e

    • SHA1

      60bfb0e3b64967cb51cd5a34402fbacbfd9a15dc

    • SHA256

      6421fb46fc3f46c79cb95e2e78530dee35a7d10d85177bade93d69bab705a36e

    • SHA512

      f2a826581f250d67a64e9a781d1325d56acee59057d8adc4aa0d0bb697647788b71db59931b8820d2365df4e86631fa68ce0f1bb53e85c600a3d5a1cea8e0674

    • SSDEEP

      1536:eSquE20GQrSmGb1BMojS8Qnf6pgU3kOpzfVr0HvhxcVaH22IyPjlJxsLUw:xBmGr4mbUORfVr0PHEWJw

    Score
    10/10
    metasploitbackdoorpersistencetrojanupx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks