Overview

overview

10

Static

static

10

Windows 7 VM

windows7_x64

10

Windows 10 VM

windows10_x64

10

Analysis

  • max time kernel
    1672s
  • max time network
    1674s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-05-2021 11:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Avast-Setup-v8.56.msi

  • Size

    156KB

  • MD5

    a31c17a0a4a0d3caf0472c747c890d1a

  • SHA1

    2022484abc139e3643dcf2e1f29a0e52564e738f

  • SHA256

    0685a699fb13d6bc99b6aee35381acf77b00155d56e7448a300aa308fd07598c

  • SHA512

    b551814e1056a96298fab0de7bdc3d746ff7db07cdb0d3b5dc39ee8fc260e03de8b7b329226ce8dbc50bcd809bb8d335fd0de7f2eddf5748d1ed990b5ff0af14

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

3.141.210.37:18573

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Avast-Setup-v8.56.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:636
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3760
    • C:\Windows\Installer\MSIBD6C.tmp
      "C:\Windows\Installer\MSIBD6C.tmp"
      2⤵
      • Executes dropped EXE
      PID:2244
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 033486469724B0FE38F0AAAF90125E0C
      2⤵
        PID:2184
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3028
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3176

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Installer\MSIBD6C.tmp
      MD5

      abf8e8992450606a9a105db417c7026e

      SHA1

      ef39ed2f67328ab085dd3546fc8417bee70386cb

      SHA256

      b6d726d795245a163215ed261f2b6c030d0abead967077bf1bac3170d1a79e7c

      SHA512

      8eeaf6fef20ba24299ad5e1c4cea3f373a69a5d105d8753dc21cda21ea9f9c92e14a40f31f9dac4a7b0506d985794c5fb19d79f34c8ec98527e59ddecbfa72af

      Download Submit
    • C:\Windows\Installer\MSIBD6C.tmp
      MD5

      abf8e8992450606a9a105db417c7026e

      SHA1

      ef39ed2f67328ab085dd3546fc8417bee70386cb

      SHA256

      b6d726d795245a163215ed261f2b6c030d0abead967077bf1bac3170d1a79e7c

      SHA512

      8eeaf6fef20ba24299ad5e1c4cea3f373a69a5d105d8753dc21cda21ea9f9c92e14a40f31f9dac4a7b0506d985794c5fb19d79f34c8ec98527e59ddecbfa72af

      Download Submit
    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      MD5

      78504f30880524ffeeb78d989db57545

      SHA1

      5b8c8849cb9dab79c032215e1457faf8880d12d9

      SHA256

      151a1ac90e05851f5c98fa11f1682b72f06435ff148a9cef1b80e5bdbdfb6dbb

      SHA512

      0c49d20296274a20cb75a5059211105440a0c6a0a34439fa884f02ca1953507f6fa873f3947085f3d1e11e855ea802ae6114dd2ffe3c8c98ee64f8cb600fa00a

      Download Submit
    • \??\Volume{d05cfc4a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{d53e6cda-e018-4e1f-9e18-9c83681edcf1}_OnDiskSnapshotProp
      MD5

      6e4a69a85517fab06f37fcf0d205829b

      SHA1

      af52e203d989079bce7867bcbebcd6674ec2a53d

      SHA256

      ef673af099e1b35be52e33e88681c3a8cb93393b02c28c96e8ba1f988e7fcf94

      SHA512

      8ddcc598faaaefc479d9c6cced7e0f2bb302e979f94528369ddc60924a19710098e43edc6867440556cf35ac0b2fe401321a63bd968bc33c4c525c0876dae9aa

      Download Submit
    • memory/2184-120-0x0000000000000000-mapping.dmp
      Download
    • memory/2244-119-0x0000000000000000-mapping.dmp
      Download
    • memory/2244-125-0x0000000000030000-0x0000000000031000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3760-118-0x0000000000000000-mapping.dmp
      Download