Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/01/2024, 17:31
Behavioral task
behavioral1
Sample
607575be3135d1b617a5b2dddb884b19.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
607575be3135d1b617a5b2dddb884b19.exe
Resource
win10v2004-20231215-en
General
-
Target
607575be3135d1b617a5b2dddb884b19.exe
-
Size
80KB
-
MD5
607575be3135d1b617a5b2dddb884b19
-
SHA1
ac5ba76759290781374b7cb3007abec289ff12a0
-
SHA256
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
-
SHA512
deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046
-
SSDEEP
1536:JytDtEjlehtyjEX44E9yBeZ4v6xosmSr/mNINOQft:ADtERenXaSeZf3mSreuNOw
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 607575be3135d1b617a5b2dddb884b19.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 607575be3135d1b617a5b2dddb884b19.exe -
Executes dropped EXE 2 IoCs
pid Process 2268 shmt.exe 2584 shmt.exe -
Loads dropped DLL 3 IoCs
pid Process 1444 607575be3135d1b617a5b2dddb884b19.exe 1444 607575be3135d1b617a5b2dddb884b19.exe 2268 shmt.exe -
resource yara_rule behavioral1/memory/2940-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2940-9-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000a0000000126af-14.dat upx behavioral1/memory/1444-16-0x00000000024B0000-0x00000000024EA000-memory.dmp upx behavioral1/memory/2268-35-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 607575be3135d1b617a5b2dddb884b19.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\shmt.exe 607575be3135d1b617a5b2dddb884b19.exe File opened for modification C:\Windows\SysWOW64\shmt.exe 607575be3135d1b617a5b2dddb884b19.exe File opened for modification C:\Windows\SysWOW64\shmt.exe shmt.exe File created C:\Windows\SysWOW64\shmt.exe shmt.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2940 set thread context of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2268 set thread context of 2584 2268 shmt.exe 30 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\logfile32.txt shmt.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1444 607575be3135d1b617a5b2dddb884b19.exe 1444 607575be3135d1b617a5b2dddb884b19.exe 1444 607575be3135d1b617a5b2dddb884b19.exe 2584 shmt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1444 607575be3135d1b617a5b2dddb884b19.exe Token: SeDebugPrivilege 2584 shmt.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2940 607575be3135d1b617a5b2dddb884b19.exe 2268 shmt.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 2940 wrote to memory of 1444 2940 607575be3135d1b617a5b2dddb884b19.exe 28 PID 1444 wrote to memory of 2268 1444 607575be3135d1b617a5b2dddb884b19.exe 29 PID 1444 wrote to memory of 2268 1444 607575be3135d1b617a5b2dddb884b19.exe 29 PID 1444 wrote to memory of 2268 1444 607575be3135d1b617a5b2dddb884b19.exe 29 PID 1444 wrote to memory of 2268 1444 607575be3135d1b617a5b2dddb884b19.exe 29 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30 PID 2268 wrote to memory of 2584 2268 shmt.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\shmt.exe"C:\Windows\system32\shmt.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\shmt.exe"C:\Windows\SysWOW64\shmt.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5607575be3135d1b617a5b2dddb884b19
SHA1ac5ba76759290781374b7cb3007abec289ff12a0
SHA2562fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
SHA512deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046