metasploit | e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c

Analysis

max time kernel
150s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
Size

45KB
MD5

c4580e02273f478c145a970755b1f7ea
SHA1

22239390d608e4bffb75aff91b0635d5663d043d
SHA256

e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c
SHA512

857ea0665c028d179c639a5d2f6f2e4d9c86ba7ed6475ddb4927055173039d7d6634a1551769a96e229cb567503c772d3eaa11e5dab8bd4a9b022785bb4ecb16
SSDEEP

768:Aw5AROhbicRCh06JLAyb8LjxqL2P9ltyXweTCACUNBMoGfXcwghgLoq9S5wT+8le:ZxRicp6xAybaD1lK5CACUHMoGfMXkosq

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe"	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe

Executes dropped EXE 1 IoCs

pid	Process
1528	aadrive32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe"	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\aadrive32.exe	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
File opened for modification	C:\Windows\aadrive32.exe	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
File created	C:\Windows\%windir%\lfffile32.log	aadrive32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
1528	aadrive32.exe
1528	aadrive32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1528	1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe	27
PID 1532 wrote to memory of 1528	1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe	27
PID 1532 wrote to memory of 1528	1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe	27
PID 1532 wrote to memory of 1528	1532	e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe	27

C:\Users\Admin\AppData\Local\Temp\e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe
"C:\Users\Admin\AppData\Local\Temp\e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\aadrive32.exe
  "C:\Windows\aadrive32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\aadrive32.exe

Filesize
45KB

MD5
c4580e02273f478c145a970755b1f7ea

SHA1
22239390d608e4bffb75aff91b0635d5663d043d

SHA256
e9230a510605da7de0b985507c3bc096d605b136ce2cc3d453b3c43b64b12f8c

SHA512
857ea0665c028d179c639a5d2f6f2e4d9c86ba7ed6475ddb4927055173039d7d6634a1551769a96e229cb567503c772d3eaa11e5dab8bd4a9b022785bb4ecb16

Download Submit
memory/1528-60-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1528-61-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1532-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1532-58-0x0000000000340000-0x000000000039D000-memory.dmp

Filesize
372KB

Download
memory/1532-59-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download