Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2024, 12:29

General

  • Target

    5fe378690b8d80290f81dd5bfc5c8c18.exe

  • Size

    80KB

  • MD5

    5fe378690b8d80290f81dd5bfc5c8c18

  • SHA1

    b81315ebdc5a40cb96999e7eb8566b17165ef3af

  • SHA256

    74120250d0dbace2df52e10b8fe9ce2c7ebd8d64416ce39a1f7dcec998b6164e

  • SHA512

    b8519a197cfb975bc0c9effcc4c14d878f3aaa53147b203b6122c51548446808accc2a1bc7d14ddfdc55016812f0a67bb77430eef1ae72702d669defb1e87bfa

  • SSDEEP

    1536:yQ/vZZtAaijmx4SAmOZ8lGsZyoSq/SgnVMTbG:HvHtHijbSAmOylRT/SgnqTi

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fe378690b8d80290f81dd5bfc5c8c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5fe378690b8d80290f81dd5bfc5c8c18.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Users\Admin\AppData\Local\Temp\5fe378690b8d80290f81dd5bfc5c8c18.exe
      C:\Users\Admin\AppData\Local\Temp\5fe378690b8d80290f81dd5bfc5c8c18.exe
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\jodrive32.exe
        "C:\Windows\jodrive32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\jodrive32.exe
          C:\Windows\jodrive32.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2568

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\jodrive32.exe

          Filesize

          80KB

          MD5

          5fe378690b8d80290f81dd5bfc5c8c18

          SHA1

          b81315ebdc5a40cb96999e7eb8566b17165ef3af

          SHA256

          74120250d0dbace2df52e10b8fe9ce2c7ebd8d64416ce39a1f7dcec998b6164e

          SHA512

          b8519a197cfb975bc0c9effcc4c14d878f3aaa53147b203b6122c51548446808accc2a1bc7d14ddfdc55016812f0a67bb77430eef1ae72702d669defb1e87bfa

        • memory/2008-8-0x0000000001C60000-0x0000000001D60000-memory.dmp

          Filesize

          1024KB

        • memory/2008-0-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

        • memory/2008-18-0x0000000001C60000-0x0000000001D60000-memory.dmp

          Filesize

          1024KB

        • memory/2008-20-0x0000000000270000-0x0000000000297000-memory.dmp

          Filesize

          156KB

        • memory/2008-29-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

        • memory/2560-75-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

        • memory/2560-66-0x0000000000430000-0x0000000000457000-memory.dmp

          Filesize

          156KB

        • memory/2560-65-0x0000000001C60000-0x0000000001D60000-memory.dmp

          Filesize

          1024KB

        • memory/2560-50-0x0000000001C60000-0x0000000001D60000-memory.dmp

          Filesize

          1024KB

        • memory/2560-42-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

        • memory/2568-84-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-87-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-93-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-92-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-91-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-90-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-89-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-88-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-86-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-85-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-78-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-79-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-80-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-81-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-82-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2568-83-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-19-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-22-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-24-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-32-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-28-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-51-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-26-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB

        • memory/2796-44-0x00000000004E0000-0x0000000000507000-memory.dmp

          Filesize

          156KB

        • memory/2796-36-0x00000000004E0000-0x0000000000507000-memory.dmp

          Filesize

          156KB

        • memory/2796-31-0x0000000000400000-0x0000000000453000-memory.dmp

          Filesize

          332KB