Overview

overview

10

Static

static

8

trojan/1.exe

windows7_x64

10

trojan/1.exe

windows10-2004_x64

10

trojan/10.exe

windows7_x64

10

trojan/10.exe

windows10-2004_x64

8

trojan/2.exe

windows7_x64

3

trojan/2.exe

windows10-2004_x64

5

trojan/3.exe

windows7_x64

10

trojan/3.exe

windows10-2004_x64

10

trojan/4.exe

windows7_x64

8

trojan/4.exe

windows10-2004_x64

8

trojan/5.exe

windows7_x64

8

trojan/5.exe

windows10-2004_x64

8

trojan/6.exe

windows7_x64

10

trojan/6.exe

windows10-2004_x64

10

trojan/7.exe

windows7_x64

10

trojan/7.exe

windows10-2004_x64

10

trojan/8.exe

windows7_x64

trojan/8.exe

windows10-2004_x64

10

trojan/9.exe

windows7_x64

8

trojan/9.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    150s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    07-07-2022 09:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    trojan/1.exe

  • Size

    145KB

  • MD5

    6e67678fc82cc9c1215a7625b5c27513

  • SHA1

    1b27d0a1b3078fdf0b51439d86f8b093733bfac5

  • SHA256

    b5fe0cbc7569e8adb249658ba9942cafd423c057849623d5e6e5ccf279b22782

  • SHA512

    550383b64d1f458ef32a66b008dfca3d1d83257e857c1c14b3988a231176b496dfd283863b2d1f43d00942960e5eac6244ded555cdb0a03191f5b6081d4ee8f0

Score
10/10
metasploitbackdoorevasiontrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies firewall policy service 2 TTPs 8 IoCs
    evasion
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 7 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Windows security modification 2 TTPs 4 IoCs
    evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trojan\1.exe
    "C:\Users\Admin\AppData\Local\Temp\trojan\1.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1256
  • C:\Windows\Fonts\unwise_.exe
    "C:\Windows\Fonts\unwise_.exe"
    1⤵
    • Modifies firewall policy service
    • Windows security bypass
    • Executes dropped EXE
    • Deletes itself
    • Windows security modification
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall set portopening TCP 445 NB
      2⤵
      • Modifies Windows Firewall
      • Modifies data under HKEY_USERS
      PID:1400
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall set portopening TCP 139 NB
      2⤵
      • Modifies Windows Firewall
      • Modifies data under HKEY_USERS
      PID:1124
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall set portopening TCP 1013 BS
      2⤵
      • Modifies Windows Firewall
      • Modifies data under HKEY_USERS
      PID:1932
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall set portopening TCP 9999 PORT1
      2⤵
      • Modifies Windows Firewall
      • Modifies data under HKEY_USERS
      PID:1880
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall set portopening TCP 9991 PORT2
      2⤵
      • Modifies Windows Firewall
      • Modifies data under HKEY_USERS
      PID:1464
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Windows\Fonts\unwise_.exe" workstation ENABLE ALL
      2⤵
      • Modifies Windows Firewall
      • Modifies data under HKEY_USERS
      PID:1084
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall set allowedprogram "C:\Windows\Fonts\unwise_.exe" workstation ENABLE ALL
      2⤵
      • Modifies Windows Firewall
      • Modifies data under HKEY_USERS
      PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Fonts\unwise_.exe
    Filesize

    145KB

    MD5

    6e67678fc82cc9c1215a7625b5c27513

    SHA1

    1b27d0a1b3078fdf0b51439d86f8b093733bfac5

    SHA256

    b5fe0cbc7569e8adb249658ba9942cafd423c057849623d5e6e5ccf279b22782

    SHA512

    550383b64d1f458ef32a66b008dfca3d1d83257e857c1c14b3988a231176b496dfd283863b2d1f43d00942960e5eac6244ded555cdb0a03191f5b6081d4ee8f0

    Download Submit
  • memory/1084-65-0x0000000000000000-mapping.dmp
    Download
  • memory/1100-74-0x0000000000400000-0x00000000008D9FFF-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1100-59-0x0000000000400000-0x00000000008D9FFF-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1124-61-0x0000000000000000-mapping.dmp
    Download
  • memory/1256-58-0x0000000000400000-0x00000000008D9FFF-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1256-54-0x0000000075951000-0x0000000075953000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1256-55-0x0000000000400000-0x00000000008D9FFF-memory.dmp
    Filesize

    4.9MB

    Download
  • memory/1400-60-0x0000000000000000-mapping.dmp
    Download
  • memory/1464-64-0x0000000000000000-mapping.dmp
    Download
  • memory/1716-66-0x0000000000000000-mapping.dmp
    Download
  • memory/1880-63-0x0000000000000000-mapping.dmp
    Download
  • memory/1932-62-0x0000000000000000-mapping.dmp
    Download