metasploit | f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea

Analysis

max time kernel
112s
max time network
117s
platform
windows10_x64
resource
win10-en-20211208
submitted
27-01-2022 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe
Size

568KB
MD5

8d1c06ccab35c496556b23dc602b62e3
SHA1

33d3b0ec31bfc16dcb1b1ff82550aa17fa4c07c5
SHA256

f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea
SHA512

cd023f57416334ddd537cd1edea94b7efb235fe09584c78c44283cbd57116abe3cb80a6ae2f5e8fa582d291c3f3adac0e1c62abc201ec6c5594647ac83bb51fd

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_http

http://209.239.115.91:443/6OHEJ

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4056 1672 WerFault.exe f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe

pid	pid_target	process	target process
4056	1672	WerFault.exe	f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exeWerFault.exe

description	pid	process
Token: SeRestorePrivilege	1672	f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe
Token: SeBackupPrivilege	1672	f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe
Token: SeRestorePrivilege	4056	WerFault.exe
Token: SeBackupPrivilege	4056	WerFault.exe
Token: SeDebugPrivilege	4056	WerFault.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe

C:\Users\Admin\AppData\Local\Temp\f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe
"C:\Users\Admin\AppData\Local\Temp\f9b83eff6d705c214993be9575f8990aa8150128a815e849c6faee90df14a0ea.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 2036
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-118-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/1672-119-0x0000000003890000-0x0000000003C90000-memory.dmp

Filesize
4.0MB

Download