metasploit | 6c7386b07716fccd51108a9182a71c6855d6c0504e4fb62004ef004de1bb3bb1

Analysis

max time kernel
60s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
20/03/2021, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe
Size 65KB
Sample210320-gf5llhmt4e
SHA256 6c7386b07716fccd51108a9182a71c6855d6c0504e4fb62004ef004de1bb3bb1
MD5 4e228802bcb649751855c0bd9a35ab0d
SHA1 de468099bc857674f44318c63ed96c7d9d026a3f
SHA512 8c81b3e24ba10e9966ef736d63e1323109bd1c5b25e6e8439d41bec54776998540922a9d3a14f729816ada3943dfff23856f561a1e29d5550dc8bb0e6528dbde
MD5 SHA1 SHA512

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://onealaskasport.com:443/jquery-3.3.1.slim.min.js

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1328 created 556	1328	WerFault.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	556	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3976	SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe
3976	SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3976	SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3976	SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2312	3976	SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe	10
PID 3976 wrote to memory of 2312	3976	SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe	10

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2312
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36541943.23652.21867.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3976
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  PID:556
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 556 -s 112
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-3-0x0000000140000000-0x0000000140005000-memory.dmp

Download

memory/1328-4-0x000001464A730000-0x000001464A731000-memory.dmp

Download

memory/2312-5-0x0000000000890000-0x0000000000895000-memory.dmp

Download

memory/3976-2-0x00007FF777E90000-0x00007FF777EA2000-memory.dmp

Download