metasploit | e1d5093241a6a7fb2e7492e31f4935fd7b62246660a4ae634940c5ea5f71d049

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
Size

70KB
MD5

1fca046507f600012747e06aa56f6107
SHA1

fa2f8c5aba192bb872dc7a46676fc71e47fe9b8c
SHA256

e1d5093241a6a7fb2e7492e31f4935fd7b62246660a4ae634940c5ea5f71d049
SHA512

d4c57dca82bbdb1d78cb5aefcb00c8a624426d6dc5d3c62d9c20053168ec86635a1b237da4ebdf9d3df1c89f5bc8b180faa8600aca8eaf8a2fbf093fe0bbdcc6
SSDEEP

1536:tq+wO8I7VY1dZzwD2CDjyH7iG1Q9Ubay75gSK:to+7VY5q28OH7i3Uf+t

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\WindowsUpdate.exe"	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

WindowsUpdate.exeWindowsUpdate.exe

pid process

1620 WindowsUpdate.exe
2132 WindowsUpdate.exe

pid	process
1620	WindowsUpdate.exe
2132	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\WindowsUpdate.exe"	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1fca046507f600012747e06aa56f6107_JaffaCakes118.exeWindowsUpdate.exe

description	pid	process	target process
PID 1876 set thread context of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1620 set thread context of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe

Drops file in Windows directory 3 IoCs

Processes:

1fca046507f600012747e06aa56f6107_JaffaCakes118.exeWindowsUpdate.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
File created	C:\Windows\log32.txt	WindowsUpdate.exe
File created	C:\Windows\WindowsUpdate.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

pid process

1812 1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
1812 1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

pid	process
1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

1fca046507f600012747e06aa56f6107_JaffaCakes118.exe1fca046507f600012747e06aa56f6107_JaffaCakes118.exeWindowsUpdate.exe

description	pid	process	target process
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1876 wrote to memory of 1812	1876	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
PID 1812 wrote to memory of 1620	1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	WindowsUpdate.exe
PID 1812 wrote to memory of 1620	1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	WindowsUpdate.exe
PID 1812 wrote to memory of 1620	1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	WindowsUpdate.exe
PID 1812 wrote to memory of 1620	1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	WindowsUpdate.exe
PID 1812 wrote to memory of 1620	1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	WindowsUpdate.exe
PID 1812 wrote to memory of 1620	1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	WindowsUpdate.exe
PID 1812 wrote to memory of 1620	1812	1fca046507f600012747e06aa56f6107_JaffaCakes118.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe
PID 1620 wrote to memory of 2132	1620	WindowsUpdate.exe	WindowsUpdate.exe

C:\Users\Admin\AppData\Local\Temp\1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fca046507f600012747e06aa56f6107_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\1fca046507f600012747e06aa56f6107_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fca046507f600012747e06aa56f6107_JaffaCakes118.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\WindowsUpdate.exe
"C:\Windows\WindowsUpdate.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\WindowsUpdate.exe
"C:\Windows\WindowsUpdate.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WindowsUpdate.exe
Filesize
70KB

MD5
1fca046507f600012747e06aa56f6107

SHA1
fa2f8c5aba192bb872dc7a46676fc71e47fe9b8c

SHA256
e1d5093241a6a7fb2e7492e31f4935fd7b62246660a4ae634940c5ea5f71d049

SHA512
d4c57dca82bbdb1d78cb5aefcb00c8a624426d6dc5d3c62d9c20053168ec86635a1b237da4ebdf9d3df1c89f5bc8b180faa8600aca8eaf8a2fbf093fe0bbdcc6

Download Submit
memory/1620-1076-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1620-541-0x0000000000850000-0x00000000008A7000-memory.dmp

Filesize
348KB

Download
memory/1620-542-0x0000000000850000-0x00000000008A7000-memory.dmp

Filesize
348KB

Download
memory/1620-539-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1812-517-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-544-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-513-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-516-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-530-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-532-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-524-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1812-531-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-538-0x0000000002AB0000-0x0000000002B07000-memory.dmp

Filesize
348KB

Download
memory/1812-523-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1812-520-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1876-529-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1876-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2132-1084-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1069-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2132-1080-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1083-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1079-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1085-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1086-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1087-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1090-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1091-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2132-1092-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download