Overview

overview

10

Static

static

10

Windows 7 VM

windows7_x64

10

Windows 10 VM

windows10_x64

10

Analysis

  • max time kernel
    1433s
  • max time network
    1792s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09-05-2021 11:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Avast-Setup-v8.56.msi

  • Size

    156KB

  • MD5

    6d0aece3c6c497e5c95f5211391eeb5a

  • SHA1

    27fe022501362ce3d8aad3d8d0ecf0b869580ba0

  • SHA256

    9dc9fec6cfd0f7e565d2bcc58cc487f720d1b25bb650cb34431372d89c515fb5

  • SHA512

    59e6e29a37d37e54ac1c75820f35fa5a4c0fccbe6a7962addd6e929bcd75e8e8465a5c6b59f28b22d14e54a76bc619440bbc5374265072b2bf9145cf100eb7f0

Score
10/10
cobaltstrikemetasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

3.22.53.161:10939

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Avast-Setup-v8.56.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3892
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3756
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2B9CD8AB8210BEDBCDDC7FFA8588C239
      2⤵
        PID:4004
      • C:\Windows\Installer\MSI59B1.tmp
        "C:\Windows\Installer\MSI59B1.tmp"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:500
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe
          3⤵
            PID:2808
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4032
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
        1⤵
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:1812

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      2
      T1012

      Peripheral Device Discovery

      2
      T1120

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\Installer\MSI59B1.tmp
        MD5

        8445acade2bf19b86c80f5c757c854e3

        SHA1

        b919247aef9c63c2746778f112d99da3640336f3

        SHA256

        1da82af2407ee52355bf097d086eaff78732fe5f647be6650d52e579eef96984

        SHA512

        aae2d7b513c0e12085e3f45e15d9240f07002660151ab90c5bc4292a27ee47e6f94b50a07a5c6ff2eaafc074a1cf4d4d8a07355cc52643163486e2171997580d

        Download Submit
      • C:\Windows\Installer\MSI59B1.tmp
        MD5

        8445acade2bf19b86c80f5c757c854e3

        SHA1

        b919247aef9c63c2746778f112d99da3640336f3

        SHA256

        1da82af2407ee52355bf097d086eaff78732fe5f647be6650d52e579eef96984

        SHA512

        aae2d7b513c0e12085e3f45e15d9240f07002660151ab90c5bc4292a27ee47e6f94b50a07a5c6ff2eaafc074a1cf4d4d8a07355cc52643163486e2171997580d

        Download Submit
      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        MD5

        9161c3f1b5f1f4993a48db5d46ac2721

        SHA1

        1d98c342ec86cd124126fd60eba92cb71e478c4a

        SHA256

        98c466d1244f62ec98f8b61ff17d1a7def63c1df2f795a7a1e32b393a62845a7

        SHA512

        147928307b7ef96678959f05f8bdc4fa6563f3db4ea3d375b844c715c0fda4e661648dffe50f4cded0e91a98af9a517a47f57df532ec818b1211fe758ec123a0

        Download Submit
      • \??\Volume{266d1ca4-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{2a1f81d7-f5fc-49f0-a7a4-dba71b963074}_OnDiskSnapshotProp
        MD5

        e066f2f5452a67a16e457e94b4af5570

        SHA1

        a7ae54944134ed27e58988ce4053932a4fd98670

        SHA256

        cfd3df1191bc8b91606356e8dd24a8da00b5868eb64e593df27308c2c60da491

        SHA512

        004a2fb7ec1586b6f07406534536830c875a0d93ea709b3b8392c0f001ab1aa410f6175893be9596bc70166a63277b50822c33405a26a6a0b7e42e6d6e3ddae5

        Download Submit
      • memory/500-129-0x00000000008C0000-0x00000000008F1000-memory.dmp
        Filesize

        196KB

        Download
      • memory/500-126-0x0000000000030000-0x0000000000031000-memory.dmp
        Filesize

        4KB

        Download
      • memory/500-120-0x0000000000000000-mapping.dmp
        Download
      • memory/500-128-0x0000000000890000-0x00000000008BB000-memory.dmp
        Filesize

        172KB

        Download
      • memory/500-130-0x0000000002630000-0x000000000268F000-memory.dmp
        Filesize

        380KB

        Download
      • memory/500-131-0x0000000000420000-0x00000000004CE000-memory.dmp
        Filesize

        696KB

        Download
      • memory/2808-132-0x0000000000000000-mapping.dmp
        Download
      • memory/3756-118-0x0000000000000000-mapping.dmp
        Download
      • memory/4004-119-0x0000000000000000-mapping.dmp
        Download