metasploit | 01fe98d1464dc41e6bb58188655dd4bc1f969726c6a7e5b2b1c88d52914a3742

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe
Size

380KB
MD5

203faeab73cd2cb1e4e588bc0628b8b0
SHA1

6d1692b64010b050f09ada59fb4a717aecdfce2c
SHA256

01fe98d1464dc41e6bb58188655dd4bc1f969726c6a7e5b2b1c88d52914a3742
SHA512

ddfdc090b41f419844d8e6c35c7dc411b3335ed516d9d25bd5b1c0046a3ada2fa173941ef6c360f937a4e9e825490bf6b694e177cfc593c3ce43d48763812efe
SSDEEP

6144:I9inN+UqL02g1gH2H4gCW3e0dZfFgCZTdsmnElM2/uLYwG2iIMRD51TK7HV/Smhc:0ipHgWYO1dTdxGmnO9/1Ft2SGjFW

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 10 IoCs

Processes:

wuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exe

pid process

2636 wuauclt10.exe
2472 wuauclt10.exe
2504 wuauclt10.exe
2544 wuauclt10.exe
2484 wuauclt10.exe
1652 wuauclt10.exe
1640 wuauclt10.exe
1452 wuauclt10.exe
1036 wuauclt10.exe
1896 wuauclt10.exe

pid	process
2636	wuauclt10.exe
2472	wuauclt10.exe
2504	wuauclt10.exe
2544	wuauclt10.exe
2484	wuauclt10.exe
1652	wuauclt10.exe
1640	wuauclt10.exe
1452	wuauclt10.exe
1036	wuauclt10.exe
1896	wuauclt10.exe

Loads dropped DLL 20 IoCs

Processes:

203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exe

pid	process
2360	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe
2360	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe
2636	wuauclt10.exe
2636	wuauclt10.exe
2472	wuauclt10.exe
2472	wuauclt10.exe
2504	wuauclt10.exe
2504	wuauclt10.exe
2544	wuauclt10.exe
2544	wuauclt10.exe
2484	wuauclt10.exe
2484	wuauclt10.exe
1652	wuauclt10.exe
1652	wuauclt10.exe
1640	wuauclt10.exe
1640	wuauclt10.exe
1452	wuauclt10.exe
1452	wuauclt10.exe
1036	wuauclt10.exe
1036	wuauclt10.exe

Drops file in System32 directory 22 IoCs

Processes:

wuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exe203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exe

description	ioc	process
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File created	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe
File opened for modification	C:\Windows\SysWOW64\wuauclt10.exe	wuauclt10.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exewuauclt10.exe

description	pid	process	target process
PID 2360 wrote to memory of 2636	2360	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe	wuauclt10.exe
PID 2360 wrote to memory of 2636	2360	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe	wuauclt10.exe
PID 2360 wrote to memory of 2636	2360	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe	wuauclt10.exe
PID 2360 wrote to memory of 2636	2360	203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe	wuauclt10.exe
PID 2636 wrote to memory of 2472	2636	wuauclt10.exe	wuauclt10.exe
PID 2636 wrote to memory of 2472	2636	wuauclt10.exe	wuauclt10.exe
PID 2636 wrote to memory of 2472	2636	wuauclt10.exe	wuauclt10.exe
PID 2636 wrote to memory of 2472	2636	wuauclt10.exe	wuauclt10.exe
PID 2472 wrote to memory of 2504	2472	wuauclt10.exe	wuauclt10.exe
PID 2472 wrote to memory of 2504	2472	wuauclt10.exe	wuauclt10.exe
PID 2472 wrote to memory of 2504	2472	wuauclt10.exe	wuauclt10.exe
PID 2472 wrote to memory of 2504	2472	wuauclt10.exe	wuauclt10.exe
PID 2504 wrote to memory of 2544	2504	wuauclt10.exe	wuauclt10.exe
PID 2504 wrote to memory of 2544	2504	wuauclt10.exe	wuauclt10.exe
PID 2504 wrote to memory of 2544	2504	wuauclt10.exe	wuauclt10.exe
PID 2504 wrote to memory of 2544	2504	wuauclt10.exe	wuauclt10.exe
PID 2544 wrote to memory of 2484	2544	wuauclt10.exe	wuauclt10.exe
PID 2544 wrote to memory of 2484	2544	wuauclt10.exe	wuauclt10.exe
PID 2544 wrote to memory of 2484	2544	wuauclt10.exe	wuauclt10.exe
PID 2544 wrote to memory of 2484	2544	wuauclt10.exe	wuauclt10.exe
PID 2484 wrote to memory of 1652	2484	wuauclt10.exe	wuauclt10.exe
PID 2484 wrote to memory of 1652	2484	wuauclt10.exe	wuauclt10.exe
PID 2484 wrote to memory of 1652	2484	wuauclt10.exe	wuauclt10.exe
PID 2484 wrote to memory of 1652	2484	wuauclt10.exe	wuauclt10.exe
PID 1652 wrote to memory of 1640	1652	wuauclt10.exe	wuauclt10.exe
PID 1652 wrote to memory of 1640	1652	wuauclt10.exe	wuauclt10.exe
PID 1652 wrote to memory of 1640	1652	wuauclt10.exe	wuauclt10.exe
PID 1652 wrote to memory of 1640	1652	wuauclt10.exe	wuauclt10.exe
PID 1640 wrote to memory of 1452	1640	wuauclt10.exe	wuauclt10.exe
PID 1640 wrote to memory of 1452	1640	wuauclt10.exe	wuauclt10.exe
PID 1640 wrote to memory of 1452	1640	wuauclt10.exe	wuauclt10.exe
PID 1640 wrote to memory of 1452	1640	wuauclt10.exe	wuauclt10.exe
PID 1452 wrote to memory of 1036	1452	wuauclt10.exe	wuauclt10.exe
PID 1452 wrote to memory of 1036	1452	wuauclt10.exe	wuauclt10.exe
PID 1452 wrote to memory of 1036	1452	wuauclt10.exe	wuauclt10.exe
PID 1452 wrote to memory of 1036	1452	wuauclt10.exe	wuauclt10.exe
PID 1036 wrote to memory of 1896	1036	wuauclt10.exe	wuauclt10.exe
PID 1036 wrote to memory of 1896	1036	wuauclt10.exe	wuauclt10.exe
PID 1036 wrote to memory of 1896	1036	wuauclt10.exe	wuauclt10.exe
PID 1036 wrote to memory of 1896	1036	wuauclt10.exe	wuauclt10.exe

C:\Users\Admin\AppData\Local\Temp\203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 536 "C:\Users\Admin\AppData\Local\Temp\203faeab73cd2cb1e4e588bc0628b8b0_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 520 "C:\Windows\SysWOW64\wuauclt10.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 524 "C:\Windows\SysWOW64\wuauclt10.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 528 "C:\Windows\SysWOW64\wuauclt10.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 544 "C:\Windows\SysWOW64\wuauclt10.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 532 "C:\Windows\SysWOW64\wuauclt10.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 540 "C:\Windows\SysWOW64\wuauclt10.exe"
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 548 "C:\Windows\SysWOW64\wuauclt10.exe"
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 560 "C:\Windows\SysWOW64\wuauclt10.exe"
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\wuauclt10.exe
C:\Windows\system32\wuauclt10.exe 552 "C:\Windows\SysWOW64\wuauclt10.exe"
11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wuauclt10.exe
Filesize
380KB

MD5
203faeab73cd2cb1e4e588bc0628b8b0

SHA1
6d1692b64010b050f09ada59fb4a717aecdfce2c

SHA256
01fe98d1464dc41e6bb58188655dd4bc1f969726c6a7e5b2b1c88d52914a3742

SHA512
ddfdc090b41f419844d8e6c35c7dc411b3335ed516d9d25bd5b1c0046a3ada2fa173941ef6c360f937a4e9e825490bf6b694e177cfc593c3ce43d48763812efe

Download Submit
memory/1036-94-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1452-89-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1452-87-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1640-83-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1640-81-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1652-77-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1652-75-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1896-100-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/1896-98-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-28-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2360-3-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/2360-14-0x00000000027D0000-0x00000000027DC000-memory.dmp

Filesize
48KB

Download
memory/2360-18-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/2360-17-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/2360-16-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/2360-15-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/2360-13-0x00000000027E0000-0x00000000027E5000-memory.dmp

Filesize
20KB

Download
memory/2360-12-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2360-19-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2360-22-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2360-27-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2360-32-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/2360-31-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2360-30-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2360-29-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/2360-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-26-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/2360-25-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/2360-24-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/2360-23-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2360-21-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/2360-20-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/2360-2-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2360-42-0x0000000003270000-0x0000000003396000-memory.dmp

Filesize
1.1MB

Download
memory/2360-46-0x00000000002A0000-0x00000000002EB000-memory.dmp

Filesize
300KB

Download
memory/2360-45-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2360-1-0x00000000002A0000-0x00000000002EB000-memory.dmp

Filesize
300KB

Download
memory/2360-11-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2360-10-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2360-9-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2360-8-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2360-7-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2360-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2360-5-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/2360-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2472-54-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2472-52-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2484-71-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2504-60-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2504-58-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2544-66-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2544-64-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2636-51-0x00000000031F0000-0x0000000003316000-memory.dmp

Filesize
1.1MB

Download
memory/2636-47-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads