metasploit | edd1fbcf42000838a7cb6bc32d4f41d8c2f894c0e749f0239b238d0432d0bf92

Analysis

Target

WannaCry/HEUR.Trojan.Win32.Generic.fc4bb3140f35cc8abd681b63096e7b81.dll
Size

5KB
MD5

fc4bb3140f35cc8abd681b63096e7b81
SHA1

0946eff5c8cb8bca76dc0702e15076a332929439
SHA256

89c3af5318ed0d9de1f320f94152a6730a6a3cbef53593e2a23765da015132d9
SHA512

8848e247ece3f51de90c35b93902b46ae4099f611a056b2cf4431f7251296939647f1b964b948a578cba2aa74b4b4123a7a2e05e696e9941eecdb3aebf11be29

Score

10^/10

Family

metasploit

Version

windows/single_exec

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Use of msiexec (install) with remote resource 1 IoCs

Processes:

msiexec.exe

pid process

4036 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3444 set thread context of 1288 3444 rundll32.exe rundll32.exe

pid	process
4036	msiexec.exe

description	pid	process	target process
PID 3444 set thread context of 1288	3444	rundll32.exe	rundll32.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4036	msiexec.exe
Token: SeSecurityPrivilege	3068	msiexec.exe
Token: SeCreateTokenPrivilege	4036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4036	msiexec.exe
Token: SeLockMemoryPrivilege	4036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4036	msiexec.exe
Token: SeMachineAccountPrivilege	4036	msiexec.exe
Token: SeTcbPrivilege	4036	msiexec.exe
Token: SeSecurityPrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeLoadDriverPrivilege	4036	msiexec.exe
Token: SeSystemProfilePrivilege	4036	msiexec.exe
Token: SeSystemtimePrivilege	4036	msiexec.exe
Token: SeProfSingleProcessPrivilege	4036	msiexec.exe
Token: SeIncBasePriorityPrivilege	4036	msiexec.exe
Token: SeCreatePagefilePrivilege	4036	msiexec.exe
Token: SeCreatePermanentPrivilege	4036	msiexec.exe
Token: SeBackupPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeShutdownPrivilege	4036	msiexec.exe
Token: SeDebugPrivilege	4036	msiexec.exe
Token: SeAuditPrivilege	4036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4036	msiexec.exe
Token: SeChangeNotifyPrivilege	4036	msiexec.exe
Token: SeRemoteShutdownPrivilege	4036	msiexec.exe
Token: SeUndockPrivilege	4036	msiexec.exe
Token: SeSyncAgentPrivilege	4036	msiexec.exe
Token: SeEnableDelegationPrivilege	4036	msiexec.exe
Token: SeManageVolumePrivilege	4036	msiexec.exe
Token: SeImpersonatePrivilege	4036	msiexec.exe
Token: SeCreateGlobalPrivilege	4036	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 3732 wrote to memory of 3444	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 3444	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 3444	3732	rundll32.exe	rundll32.exe
PID 3444 wrote to memory of 1288	3444	rundll32.exe	rundll32.exe
PID 3444 wrote to memory of 1288	3444	rundll32.exe	rundll32.exe
PID 3444 wrote to memory of 1288	3444	rundll32.exe	rundll32.exe
PID 3444 wrote to memory of 1288	3444	rundll32.exe	rundll32.exe
PID 1288 wrote to memory of 4036	1288	rundll32.exe	msiexec.exe
PID 1288 wrote to memory of 4036	1288	rundll32.exe	msiexec.exe
PID 1288 wrote to memory of 4036	1288	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WannaCry\HEUR.Trojan.Win32.Generic.fc4bb3140f35cc8abd681b63096e7b81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068

memory/1288-3-0x0000000001035FB0-mapping.dmp

Download
memory/3444-2-0x0000000000000000-mapping.dmp

Download
memory/4036-4-0x0000000000000000-mapping.dmp

Download
memory/4036-5-0x0000000004EC0000-0x0000000004EC4000-memory.dmp

Filesize
16KB

Download