Analysis
-
max time kernel
98s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
11/10/2022, 08:26
General
-
Target
09b5a6cfcf7e54e39ebd7b9711f76095c9fec9a78adf7bf79f751547444afe2b.exe
-
Size
67KB
-
MD5
7d571d620c9c4d1d596e99d322bb8ab0
-
SHA1
01e8431544cdbdeec01de8293230b9fb4c46555b
-
SHA256
09b5a6cfcf7e54e39ebd7b9711f76095c9fec9a78adf7bf79f751547444afe2b
-
SHA512
35dab4141e24ccc0293c0571c3f9601751ced5337b0649cd1070f11b73ca39c9aaa596c48f09b3136e274f7c10c9f790a633ba4b703952564cde54e26a42af71
-
SSDEEP
768:42+vWXJxdeWCt47xFxrvJSZLULVE8qt46uoatetctMz:5QWHdeWCS7xD7ILU+Kswetcw
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09b5a6cfcf7e54e39ebd7b9711f76095c9fec9a78adf7bf79f751547444afe2b.exe"C:\Users\Admin\AppData\Local\Temp\09b5a6cfcf7e54e39ebd7b9711f76095c9fec9a78adf7bf79f751547444afe2b.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 2442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 2522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1512 -ip 15121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1512 -ip 15121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
12KB
-
Filesize
64KB