metasploit | dc6e2fe4208ef45c9131412de032c2b752425b5c0fc37dfecdbb2d0a0ea6263d

General

Target
dc6e2fe4208ef45c9131412de032c2b752425b5c0fc37dfecdbb2d0a0ea6263d.exe
Size 17KB
Sample200903-zkmjer165e
SHA256 dc6e2fe4208ef45c9131412de032c2b752425b5c0fc37dfecdbb2d0a0ea6263d
MD5 b0c511c01ab7bcb4d53c4df33a7a22c8
SHA1 ea6b1ab9776e704eadf0f4f42a5088eb64ac7441
SHA512 7b356ffecda424eee4fb7a8e00feb8456a9a661f42b961c662b7e8a38a9cba1231d1038866d00096fdbb4575765fd8f908c1b45b5f1e5f02daaad94642aab37f
MD5 SHA1 SHA512

Score

10^/10

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 68 created 808	68	WerFault.exe	65

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
68	808	WerFault.exe	65

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = f3e7523fd781d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 7fce0849d781d601	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1276	svchost.exe
Token: SeCreatePagefilePrivilege	1276	svchost.exe
Token: SeDebugPrivilege	68	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dc6e2fe4208ef45c9131412de032c2b752425b5c0fc37dfecdbb2d0a0ea6263d.exe
"C:\Users\Admin\AppData\Local\Temp\dc6e2fe4208ef45c9131412de032c2b752425b5c0fc37dfecdbb2d0a0ea6263d.exe"
1⤵
PID:808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 808 -s 1004
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:68

memory/68-1-0x000001CB05890000-0x000001CB05891000-memory.dmp

Download

memory/68-2-0x000001CB06200000-0x000001CB06201000-memory.dmp

Download

memory/68-3-0x000001CB06200000-0x000001CB06201000-memory.dmp

Download

memory/68-4-0x000001CB06200000-0x000001CB06201000-memory.dmp

Download

memory/808-0-0x0000000000070000-0x0000000000071000-memory.dmp

Download