metasploit | 664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf

General

Target

664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
Size

301KB
MD5

7c05aff1631f596df28435ac84c8c412
SHA1

b36220c51890e56346b99d1def2917c9695923c0
SHA256

664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf
SHA512

01d68877ee1cff35daa2f2bd7eb6227418c7e5184e49473b2d707277fc11e1a9c5dd4599a9ac6a2658e8f4fc066c8985a345d1f8c12444cd588c67cb4230eb07
SSDEEP

6144:C6MOq6tWgVQmz4V4oe5v0rURy0ld/z5ld/zUld/zM:C6MOq68NrURdlvlClM

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://192.168.43.103:80/jquery-3.3.1.slim.min.js

Attributes

headers Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.106 Safari/537.36

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1008	1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe	28
PID 1076 wrote to memory of 1008	1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe	28
PID 1076 wrote to memory of 1008	1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe	28
PID 1076 wrote to memory of 1008	1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe	28
PID 1076 wrote to memory of 1008	1076	664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe	28

C:\Users\Admin\AppData\Local\Temp\664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe
"C:\Users\Admin\AppData\Local\Temp\664f074885b11a0cab73d6e7e08ebd5154267a44f29a8e414c295fe86f7d2ccf.exe"
1⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076
- \??\c:\windows\SysWOW64\notepad.exe
  c:\windows\system32\notepad.exe
  2⤵
  PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads