metasploit | f53dd25a2e1f6b08b550e204cac40a8a3564c5e61635292873fcc51907a3f7dd

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 13:22

Target
5d320d23cc37e888455ca8f06d72c2f9.exe
Size 100KB
Sample240115-qml3lsgeeq
SHA256 f53dd25a2e1f6b08b550e204cac40a8a3564c5e61635292873fcc51907a3f7dd
MD5 5d320d23cc37e888455ca8f06d72c2f9
SHA1 8297e4b70704861bbb3677f6f340bd7385d06be4
SHA512 f0595732b5d5d81982f292f224b6e47771427127577f1c128edde61c1ab8e8fc6144e4e08a5349b50b901a659794213560263f8d12ab10438497c36d29ee174b
SSDEEP 384:nJmmvni6zSjaoCdB7CTzF+At4yjlXN5zvcCpbTUtCvF6/r0G:pniiB7GzF+iv7yO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4248	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2488	1880	5d320d23cc37e888455ca8f06d72c2f9.exe	86
PID 1880 wrote to memory of 2488	1880	5d320d23cc37e888455ca8f06d72c2f9.exe	86
PID 1880 wrote to memory of 2488	1880	5d320d23cc37e888455ca8f06d72c2f9.exe	86

C:\Users\Admin\AppData\Local\Temp\5d320d23cc37e888455ca8f06d72c2f9.exe
"C:\Users\Admin\AppData\Local\Temp\5d320d23cc37e888455ca8f06d72c2f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  PID:2488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4248

memory/1880-1-0x0000000001320000-0x0000000001420000-memory.dmp

Download