Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-06-2022 21:51
Static task
static1
Behavioral task
behavioral1
Sample
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe
Resource
win10v2004-20220414-en
General
-
Target
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe
-
Size
80KB
-
MD5
b19f93535507e9a4c81b5c24a36fe61e
-
SHA1
d3c70e2c4ee810c22ef228afcd854d897304093c
-
SHA256
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1
-
SHA512
134f0c7beb8d954f106b81b58dcb6cbb01dcfb959ad213bc406cb6df25a136725b52b59e7dfe54d20254899cfaccdaecd8d888069f063b449567db83b9072425
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe" 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe -
Executes dropped EXE 2 IoCs
Processes:
jodrive32.exejodrive32.exepid process 1120 jodrive32.exe 1336 jodrive32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe" 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exejodrive32.exedescription pid process target process PID 2208 set thread context of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 1120 set thread context of 1336 1120 jodrive32.exe jodrive32.exe -
Drops file in Windows directory 3 IoCs
Processes:
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exejodrive32.exedescription ioc process File created C:\Windows\jodrive32.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe File opened for modification C:\Windows\jodrive32.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe File created C:\Windows\%windir%\eilfiie32.log jodrive32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exepid process 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exejodrive32.exedescription pid process target process PID 2208 wrote to memory of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 2208 wrote to memory of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 2208 wrote to memory of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 2208 wrote to memory of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 2208 wrote to memory of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 2208 wrote to memory of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 2208 wrote to memory of 2984 2208 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe PID 2984 wrote to memory of 1120 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe jodrive32.exe PID 2984 wrote to memory of 1120 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe jodrive32.exe PID 2984 wrote to memory of 1120 2984 249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe jodrive32.exe PID 1120 wrote to memory of 1336 1120 jodrive32.exe jodrive32.exe PID 1120 wrote to memory of 1336 1120 jodrive32.exe jodrive32.exe PID 1120 wrote to memory of 1336 1120 jodrive32.exe jodrive32.exe PID 1120 wrote to memory of 1336 1120 jodrive32.exe jodrive32.exe PID 1120 wrote to memory of 1336 1120 jodrive32.exe jodrive32.exe PID 1120 wrote to memory of 1336 1120 jodrive32.exe jodrive32.exe PID 1120 wrote to memory of 1336 1120 jodrive32.exe jodrive32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe"C:\Users\Admin\AppData\Local\Temp\249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exeC:\Users\Admin\AppData\Local\Temp\249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\jodrive32.exe"C:\Windows\jodrive32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\jodrive32.exeC:\Windows\jodrive32.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\jodrive32.exeFilesize
80KB
MD5b19f93535507e9a4c81b5c24a36fe61e
SHA1d3c70e2c4ee810c22ef228afcd854d897304093c
SHA256249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1
SHA512134f0c7beb8d954f106b81b58dcb6cbb01dcfb959ad213bc406cb6df25a136725b52b59e7dfe54d20254899cfaccdaecd8d888069f063b449567db83b9072425
-
C:\Windows\jodrive32.exeFilesize
80KB
MD5b19f93535507e9a4c81b5c24a36fe61e
SHA1d3c70e2c4ee810c22ef228afcd854d897304093c
SHA256249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1
SHA512134f0c7beb8d954f106b81b58dcb6cbb01dcfb959ad213bc406cb6df25a136725b52b59e7dfe54d20254899cfaccdaecd8d888069f063b449567db83b9072425
-
C:\Windows\jodrive32.exeFilesize
80KB
MD5b19f93535507e9a4c81b5c24a36fe61e
SHA1d3c70e2c4ee810c22ef228afcd854d897304093c
SHA256249547e5e8753cb4514c6cc7528769c222c950779e7e347ea030fd9806b19cd1
SHA512134f0c7beb8d954f106b81b58dcb6cbb01dcfb959ad213bc406cb6df25a136725b52b59e7dfe54d20254899cfaccdaecd8d888069f063b449567db83b9072425
-
memory/1120-151-0x0000000000000000-mapping.dmp
-
memory/1336-171-0x0000000000000000-mapping.dmp
-
memory/1336-176-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1336-177-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2984-146-0x0000000000000000-mapping.dmp
-
memory/2984-147-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2984-149-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2984-150-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2984-170-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB