metasploit | 93650c39360cee9ca009a9cff5db55b30a8af56edaa96f5a89405ff0ab08c55f

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe
Size

340KB
MD5

167d3ea012510c658f5b975e1af1a603
SHA1

226b991ed3f492cff9ae6cdd95ee8d635839bce0
SHA256

93650c39360cee9ca009a9cff5db55b30a8af56edaa96f5a89405ff0ab08c55f
SHA512

2d54f6e9d96e9d2224dea374106e7256f7e3ecea02044138a5882031f417a095563cae6168237974954ca9d6e54d7490f1a21b1f7a9818be098a33b895fa85ee
SSDEEP

6144:iXhaVAhAD4U5lbVwRhauOLIXV+w5BhfMPccDOqh7zYHhYH9052:ixaVAh64U5lCPOLIXV+w5WjHa52

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

shell_final.exe

pid process

3004 shell_final.exe

pid	process
3004	shell_final.exe

Loads dropped DLL 8 IoCs

Processes:

167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exeWerFault.exe

pid	process
2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe
2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe
2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe
2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2648 3004 WerFault.exe shell_final.exe

pid	pid_target	process	target process
2648	3004	WerFault.exe	shell_final.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exeshell_final.exe

description	pid	process	target process
PID 2132 wrote to memory of 3004	2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe	shell_final.exe
PID 2132 wrote to memory of 3004	2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe	shell_final.exe
PID 2132 wrote to memory of 3004	2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe	shell_final.exe
PID 2132 wrote to memory of 3004	2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe	shell_final.exe
PID 2132 wrote to memory of 3004	2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe	shell_final.exe
PID 2132 wrote to memory of 3004	2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe	shell_final.exe
PID 2132 wrote to memory of 3004	2132	167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe	shell_final.exe
PID 3004 wrote to memory of 2648	3004	shell_final.exe	WerFault.exe
PID 3004 wrote to memory of 2648	3004	shell_final.exe	WerFault.exe
PID 3004 wrote to memory of 2648	3004	shell_final.exe	WerFault.exe
PID 3004 wrote to memory of 2648	3004	shell_final.exe	WerFault.exe
PID 3004 wrote to memory of 2648	3004	shell_final.exe	WerFault.exe
PID 3004 wrote to memory of 2648	3004	shell_final.exe	WerFault.exe
PID 3004 wrote to memory of 2648	3004	shell_final.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\167d3ea012510c658f5b975e1af1a603_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132

C:\Users\Admin\AppData\Local\Temp\shell_final.exe
"C:\Users\Admin\AppData\Local\Temp\shell_final.exe" -1
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 196
3⤵
- Loads dropped DLL
- Program crash
PID:2648

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\shell_final.exe
Filesize
15KB

MD5
970dea7dd373b0b80eeea3a616118d14

SHA1
c228eeb9046c3fb7ce96d847ee16096d6000e335

SHA256
feff04ba8833c8fdd903834c169dc986332c1cc950ddaa32bd0b3007b0d3f346

SHA512
79bed8d6536278653c82d788a6b95f410cf7eb4d3fe10b5b8e397382648a8860916490f1ffcf516998db5d79e92ecae99f377c657d7536610718bc0ee5d2bacf

Download Submit
memory/3004-20-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download