Overview

overview

10

Static

static

3

Picture12....ck.exe

windows7-x64

10

Picture12....ck.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14a58ad6c5528126774a8699ae6a4174_JaffaCakes118

  • Size

    155KB

  • Sample

    240627-evqvzsvbrk

  • MD5

    14a58ad6c5528126774a8699ae6a4174

  • SHA1

    9550bddc112730f79544e7e4aaec5d4c6663b261

  • SHA256

    9540dc41c346f5815986e1c33916657fa20898ed49400174fba9deea24ac9d79

  • SHA512

    440f3dc72d2beded41c63ddfb5048c9df01b6547d9c1a84e40e8f8d55911044d80fc1aa2b7fecff3135c36f4e5fd6204fbd56d8c7ac1d7aa21a63003e7055f68

  • SSDEEP

    3072:ZnM+E22qyP/JWN51odA77vsHUUbjTcis6JoldaLGdWHPSnzmnvt8:ZnnzyPxWidqYpHT/s+opQPnl8

Score
10/10
metasploitbackdoortrojanupx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      Picture12.JPG_www.imageshack.com

    • Size

      198KB

    • MD5

      dc9eb54ed1c3e7b99c207128a76f8ebc

    • SHA1

      a76f058783b6918e802d492af5adc50d05b251d7

    • SHA256

      23306f0640e23f2487febf1c35be79487c5453fffe38c30ed40d3ad879b6132f

    • SHA512

      66c3b0790823c4614c17cc554287ec0d434338f5156f18f7a2edaee33e43a3b1cf983b8b1dbaccf8dc0a7ed7682e9150722e4e98c0e6127b548619892394b662

    • SSDEEP

      3072:8boQs34PiJiFX/Zb5L1odA77vsDUUbjTcisIJoldaLGdWHPSn98gDDcuO:8S34HedqY1HT/sMopQw8gDDcuO

    Score
    10/10
    metasploitbackdoortrojanupx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks