metasploit | d6ad7fadcb2167a24e36bb0f9e668c95183c3c224bef5775bc06c5bc71b02616

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10
submitted
10/09/2020, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6ad7fadcb2167a24e36bb0f9e668c95183c3c224bef5775bc06c5bc71b02616.exe
Size 13KB
Sample200910-ebp594smj2
SHA256 d6ad7fadcb2167a24e36bb0f9e668c95183c3c224bef5775bc06c5bc71b02616
MD5 f8df37d5ddd905847510d479316a6708
SHA1 c2e7d0c70cf92c856fd3bcdbd582d321f2a8dc33
SHA512 40bd0b8f3d1dac02da0909d02e86f0beae60b42287156e165fc541e49be99b7d2e5c0f4eb5bf7e6128ab6b1a5e53a4b637855228aba9f86dda44544a953af21e
MD5 SHA1 SHA512

Score

10^/10

trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://129.204.227.27:44521/4vJh

Attributes

headers User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = dfae58b45187d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3308	svchost.exe
Token: SeCreatePagefilePrivilege	3308	svchost.exe

C:\Users\Admin\AppData\Local\Temp\d6ad7fadcb2167a24e36bb0f9e668c95183c3c224bef5775bc06c5bc71b02616.exe
"C:\Users\Admin\AppData\Local\Temp\d6ad7fadcb2167a24e36bb0f9e668c95183c3c224bef5775bc06c5bc71b02616.exe"
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x00000000738F0000-0x0000000073FDE000-memory.dmp

Download

memory/2964-1-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/2964-3-0x0000000000E58000-0x0000000000E5B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads