Analysis
-
max time kernel
151s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 00:38
Static task
static1
Behavioral task
behavioral1
Sample
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe
Resource
win10v2004-20220812-en
General
-
Target
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe
-
Size
304KB
-
MD5
835d904ac7ea20217958ddbeaa87b7c9
-
SHA1
b9af85cc71b37a3e4e32f086b566d7cc1357dd71
-
SHA256
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544
-
SHA512
8d694798062e1ca55d056dc4e8a31a25fa367330e24f2957d218f0779c3d62d0bf294f654aa9897209945f8a4043eea6da9fbcbaa8a5352e39199d1b9c28124f
-
SSDEEP
6144:dMIasDkaLPlgnMDHr96BjnLi7k2kqD5XJH8pVaQKH:tPl5gnLx2kqxF8y
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mitnick2 = "C:\\WINDOWS\\system32\\microsoftNS.exe" b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe -
Executes dropped EXE 2 IoCs
Processes:
microsoftNS.exemicrosoftNS.exepid process 2000 microsoftNS.exe 4772 microsoftNS.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\billgates = "C:\\WINDOWS\\system32\\microsoftNS.exe" b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exemicrosoftNS.exedescription ioc process File opened for modification \??\PhysicalDrive0 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe File opened for modification \??\PhysicalDrive0 microsoftNS.exe -
Drops file in System32 directory 4 IoCs
Processes:
microsoftNS.exeb708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exedescription ioc process File created C:\WINDOWS\SysWOW64\microsoftNS.exe microsoftNS.exe File created C:\WINDOWS\SysWOW64\microsoftNS.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe File opened for modification C:\WINDOWS\SysWOW64\microsoftNS.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe File opened for modification C:\WINDOWS\SysWOW64\microsoftNS.exe microsoftNS.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exemicrosoftNS.exedescription pid process target process PID 1084 set thread context of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 2000 set thread context of 4772 2000 microsoftNS.exe microsoftNS.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exemicrosoftNS.exepid process 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe 2000 microsoftNS.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exeb708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exemicrosoftNS.exedescription pid process target process PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 1084 wrote to memory of 3404 1084 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe PID 3404 wrote to memory of 2000 3404 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe microsoftNS.exe PID 3404 wrote to memory of 2000 3404 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe microsoftNS.exe PID 3404 wrote to memory of 2000 3404 b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe PID 2000 wrote to memory of 4772 2000 microsoftNS.exe microsoftNS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe"C:\Users\Admin\AppData\Local\Temp\b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe"C:\Users\Admin\AppData\Local\Temp\b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544.exe" c:\users\admin\appdata\local\temp\Program.exeO2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\SysWOW64\microsoftNS.exe"C:\WINDOWS\system32\microsoftNS.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\SysWOW64\microsoftNS.exe"C:\WINDOWS\SysWOW64\microsoftNS.exe" c:\users\admin\appdata\local\temp\Program.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\SysWOW64\microsoftNS.exeFilesize
304KB
MD5835d904ac7ea20217958ddbeaa87b7c9
SHA1b9af85cc71b37a3e4e32f086b566d7cc1357dd71
SHA256b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544
SHA5128d694798062e1ca55d056dc4e8a31a25fa367330e24f2957d218f0779c3d62d0bf294f654aa9897209945f8a4043eea6da9fbcbaa8a5352e39199d1b9c28124f
-
C:\Windows\SysWOW64\microsoftNS.exeFilesize
304KB
MD5835d904ac7ea20217958ddbeaa87b7c9
SHA1b9af85cc71b37a3e4e32f086b566d7cc1357dd71
SHA256b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544
SHA5128d694798062e1ca55d056dc4e8a31a25fa367330e24f2957d218f0779c3d62d0bf294f654aa9897209945f8a4043eea6da9fbcbaa8a5352e39199d1b9c28124f
-
C:\Windows\SysWOW64\microsoftNS.exeFilesize
304KB
MD5835d904ac7ea20217958ddbeaa87b7c9
SHA1b9af85cc71b37a3e4e32f086b566d7cc1357dd71
SHA256b708a5985eb5315a18bada34e80304fdc33f2a13640e650ee4bc651451f77544
SHA5128d694798062e1ca55d056dc4e8a31a25fa367330e24f2957d218f0779c3d62d0bf294f654aa9897209945f8a4043eea6da9fbcbaa8a5352e39199d1b9c28124f
-
memory/1084-132-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1084-139-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2000-140-0x0000000000000000-mapping.dmp
-
memory/2000-150-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/3404-138-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3404-136-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3404-135-0x0000000000000000-mapping.dmp
-
memory/3404-151-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4772-145-0x0000000000000000-mapping.dmp
-
memory/4772-152-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB