Overview
overview
10Static
static
10data/andro...er.apk
android_x86
data/andro...er.apk
android_x64
data/andro...er.apk
android_x64
data/andro...ge.apk
android_x86
data/andro...ge.apk
android_x64
data/andro...ge.apk
android_x64
data/andro...ll.apk
android_x86
data/andro...ll.apk
android_x64
data/andro...ll.apk
android_x64
data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3data/java/....class
windows10-2004_x64
3data/java/....class
windows7_x64
3Analysis
-
max time kernel
134s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 17:34
Static task
static1
Behavioral task
behavioral1
Sample
data/android/meterpreter.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral2
Sample
data/android/meterpreter.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral3
Sample
data/android/meterpreter.apk
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral4
Sample
data/android/metstage.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral5
Sample
data/android/metstage.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
data/android/metstage.apk
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
data/android/shell.apk
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
data/android/shell.apk
Resource
android-x64-20220621-en
Behavioral task
behavioral9
Sample
data/android/shell.apk
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral10
Sample
data/java/com/metasploit/meterpreter/MemoryBufferURLConnection.class
Resource
win7-20220414-en
Behavioral task
behavioral11
Sample
data/java/com/metasploit/meterpreter/MemoryBufferURLConnection.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral12
Sample
data/java/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.class
Resource
win7-20220414-en
Behavioral task
behavioral13
Sample
data/java/com/metasploit/meterpreter/MemoryBufferURLStreamHandler.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral14
Sample
data/java/javapayload/stage/Meterpreter.class
Resource
win7-20220414-en
Behavioral task
behavioral15
Sample
data/java/javapayload/stage/Meterpreter.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral16
Sample
data/java/javapayload/stage/Shell.class
Resource
win7-20220414-en
Behavioral task
behavioral17
Sample
data/java/javapayload/stage/Shell.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral18
Sample
data/java/javapayload/stage/Stage.class
Resource
win7-20220414-en
Behavioral task
behavioral19
Sample
data/java/javapayload/stage/Stage.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral20
Sample
data/java/javapayload/stage/StreamForwarder.class
Resource
win7-20220414-en
Behavioral task
behavioral21
Sample
data/java/javapayload/stage/StreamForwarder.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral22
Sample
data/java/metasploit/AESEncryption.class
Resource
win7-20220414-en
Behavioral task
behavioral23
Sample
data/java/metasploit/AESEncryption.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral24
Sample
data/java/metasploit/JMXPayload.class
Resource
win7-20220414-en
Behavioral task
behavioral25
Sample
data/java/metasploit/JMXPayload.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral26
Sample
data/java/metasploit/JMXPayloadMBean.class
Resource
win7-20220414-en
Behavioral task
behavioral27
Sample
data/java/metasploit/JMXPayloadMBean.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral28
Sample
data/java/metasploit/Payload.class
Resource
win7-20220414-en
Behavioral task
behavioral29
Sample
data/java/metasploit/Payload.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral30
Sample
data/java/metasploit/PayloadServlet.class
Resource
win7-20220414-en
Behavioral task
behavioral31
Sample
data/java/metasploit/PayloadServlet.class
Resource
win10v2004-20220414-en
Behavioral task
behavioral32
Sample
data/java/metasploit/PayloadTrustManager.class
Resource
win7-20220414-en
General
-
Target
data/java/metasploit/AESEncryption.class
-
Size
1KB
-
MD5
1dca849762761218305efd77218ce62b
-
SHA1
d93205ac29f4e8b2564e0b91eb5ab72b221f9a65
-
SHA256
0998a55a7d786dd0db2720734521505e1168dc7ec0d75451a6732983894c084f
-
SHA512
c37b83f4131f253b39aab838f444ae79d5713c4330a38e55e75cc02e6c540b38d0155c0c154a1ab27f07e049fecaadd8f7c61f36d15d7e208f130a51b7b7893e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2872 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\data\java\metasploit\AESEncryption.class1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx