metasploit | d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603

General

Target

d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe
Size

138KB
MD5

0d02eac01292ac73c342ad70defca1b6
SHA1

c1d13cc087647dce843aa6b31f20042480ee26ba
SHA256

d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603
SHA512

eb96baf0c383b5d72ec00632c1650f06b49d256cb3086efe328fe6a1defdb643a1455da2973a1afe13fa2ceb40471e03b1ec491d8285ec202e543e126face93e
SSDEEP

3072:5R2K6PFDICAgPDkqabSoC5s8b3HH0TfFGc842FCl:+K69DbDj88rIFj842O

Score

10^/10

metasploit backdoor evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

unwise_.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	unwise_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	unwise_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	unwise_.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

unwise_.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	unwise_.exe

Executes dropped EXE 1 IoCs

Processes:

unwise_.exe

pid process

4072 unwise_.exe
Modifies Windows Firewall 1 TTPs 7 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

4792 netsh.exe
620 netsh.exe
1204 netsh.exe
5048 netsh.exe
1560 netsh.exe
4544 netsh.exe
4844 netsh.exe

pid	process
4072	unwise_.exe

pid	process
4792	netsh.exe
620	netsh.exe
1204	netsh.exe
5048	netsh.exe
1560	netsh.exe
4544	netsh.exe
4844	netsh.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

unwise_.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	unwise_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	unwise_.exe

Drops file in Windows directory 2 IoCs

Processes:

d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe

description	ioc	process
File created	C:\Windows\Fonts\unwise_.exe	d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe
File opened for modification	C:\Windows\Fonts\unwise_.exe	d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

Processes:

unwise_.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	unwise_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	unwise_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	unwise_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	unwise_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server = "65534"	unwise_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	unwise_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	unwise_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	unwise_.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exeunwise_.exe

description	pid	process
Token: 33	736	d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe
Token: SeIncBasePriorityPrivilege	736	d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe
Token: 33	4072	unwise_.exe
Token: SeIncBasePriorityPrivilege	4072	unwise_.exe
Token: SeBackupPrivilege	4072	unwise_.exe
Token: SeSecurityPrivilege	4072	unwise_.exe
Token: SeSecurityPrivilege	4072	unwise_.exe
Token: SeBackupPrivilege	4072	unwise_.exe
Token: SeSecurityPrivilege	4072	unwise_.exe
Token: SeBackupPrivilege	4072	unwise_.exe
Token: SeSecurityPrivilege	4072	unwise_.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

unwise_.exe

description	pid	process	target process
PID 4072 wrote to memory of 4544	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4544	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4544	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4844	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4844	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4844	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4792	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4792	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 4792	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 620	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 620	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 620	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 1204	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 1204	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 1204	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 5048	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 5048	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 5048	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 1560	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 1560	4072	unwise_.exe	netsh.exe
PID 4072 wrote to memory of 1560	4072	unwise_.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe
"C:\Users\Admin\AppData\Local\Temp\d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\Fonts\unwise_.exe
"C:\Windows\Fonts\unwise_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" firewall set portopening TCP 445 NB
2⤵
- Modifies Windows Firewall
PID:4544

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" firewall set portopening TCP 139 NB
2⤵
- Modifies Windows Firewall
PID:4844

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" firewall set portopening TCP 1013 BS
2⤵
- Modifies Windows Firewall
PID:4792

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" firewall set portopening TCP 9999 PORT1
2⤵
- Modifies Windows Firewall
PID:620

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" firewall set portopening TCP 9991 PORT2
2⤵
- Modifies Windows Firewall
PID:1204

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Windows\Fonts\unwise_.exe" workstation ENABLE ALL
2⤵
- Modifies Windows Firewall
PID:5048

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" firewall set allowedprogram "C:\Windows\Fonts\unwise_.exe" workstation ENABLE ALL
2⤵
- Modifies Windows Firewall
PID:1560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\unwise_.exe
Filesize
138KB

MD5
0d02eac01292ac73c342ad70defca1b6

SHA1
c1d13cc087647dce843aa6b31f20042480ee26ba

SHA256
d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603

SHA512
eb96baf0c383b5d72ec00632c1650f06b49d256cb3086efe328fe6a1defdb643a1455da2973a1afe13fa2ceb40471e03b1ec491d8285ec202e543e126face93e

Download Submit
C:\Windows\Fonts\unwise_.exe
Filesize
138KB

MD5
0d02eac01292ac73c342ad70defca1b6

SHA1
c1d13cc087647dce843aa6b31f20042480ee26ba

SHA256
d603c3c02aa3f97e185f86b99a9eb66f802d61e1c231365f460db0f18cb19603

SHA512
eb96baf0c383b5d72ec00632c1650f06b49d256cb3086efe328fe6a1defdb643a1455da2973a1afe13fa2ceb40471e03b1ec491d8285ec202e543e126face93e

Download Submit
memory/620-140-0x0000000000000000-mapping.dmp

Download
memory/736-135-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/736-132-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/1204-141-0x0000000000000000-mapping.dmp

Download
memory/1560-143-0x0000000000000000-mapping.dmp

Download
memory/4072-136-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/4072-144-0x0000000000400000-0x000000000067C000-memory.dmp

Filesize
2.5MB

Download
memory/4544-137-0x0000000000000000-mapping.dmp

Download
memory/4792-139-0x0000000000000000-mapping.dmp

Download
memory/4844-138-0x0000000000000000-mapping.dmp

Download
memory/5048-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads