Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2024, 17:31
Behavioral task
behavioral1
Sample
607575be3135d1b617a5b2dddb884b19.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
607575be3135d1b617a5b2dddb884b19.exe
Resource
win10v2004-20231215-en
General
-
Target
607575be3135d1b617a5b2dddb884b19.exe
-
Size
80KB
-
MD5
607575be3135d1b617a5b2dddb884b19
-
SHA1
ac5ba76759290781374b7cb3007abec289ff12a0
-
SHA256
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
-
SHA512
deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046
-
SSDEEP
1536:JytDtEjlehtyjEX44E9yBeZ4v6xosmSr/mNINOQft:ADtERenXaSeZf3mSreuNOw
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 607575be3135d1b617a5b2dddb884b19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 607575be3135d1b617a5b2dddb884b19.exe -
Executes dropped EXE 2 IoCs
pid Process 2108 shmt.exe 4180 shmt.exe -
resource yara_rule behavioral2/memory/4432-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4432-6-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0003000000022e6a-13.dat upx behavioral2/memory/2108-14-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0003000000022e6a-12.dat upx behavioral2/memory/2108-24-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 607575be3135d1b617a5b2dddb884b19.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\shmt.exe shmt.exe File created C:\Windows\SysWOW64\shmt.exe 607575be3135d1b617a5b2dddb884b19.exe File opened for modification C:\Windows\SysWOW64\shmt.exe 607575be3135d1b617a5b2dddb884b19.exe File opened for modification C:\Windows\SysWOW64\shmt.exe shmt.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4432 set thread context of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 2108 set thread context of 4180 2108 shmt.exe 89 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\logfile32.txt shmt.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3988 607575be3135d1b617a5b2dddb884b19.exe 3988 607575be3135d1b617a5b2dddb884b19.exe 3988 607575be3135d1b617a5b2dddb884b19.exe 3988 607575be3135d1b617a5b2dddb884b19.exe 3988 607575be3135d1b617a5b2dddb884b19.exe 3988 607575be3135d1b617a5b2dddb884b19.exe 4180 shmt.exe 4180 shmt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3988 607575be3135d1b617a5b2dddb884b19.exe Token: SeDebugPrivilege 4180 shmt.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4432 607575be3135d1b617a5b2dddb884b19.exe 2108 shmt.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 4432 wrote to memory of 3988 4432 607575be3135d1b617a5b2dddb884b19.exe 87 PID 3988 wrote to memory of 2108 3988 607575be3135d1b617a5b2dddb884b19.exe 88 PID 3988 wrote to memory of 2108 3988 607575be3135d1b617a5b2dddb884b19.exe 88 PID 3988 wrote to memory of 2108 3988 607575be3135d1b617a5b2dddb884b19.exe 88 PID 2108 wrote to memory of 4180 2108 shmt.exe 89 PID 2108 wrote to memory of 4180 2108 shmt.exe 89 PID 2108 wrote to memory of 4180 2108 shmt.exe 89 PID 2108 wrote to memory of 4180 2108 shmt.exe 89 PID 2108 wrote to memory of 4180 2108 shmt.exe 89 PID 2108 wrote to memory of 4180 2108 shmt.exe 89 PID 2108 wrote to memory of 4180 2108 shmt.exe 89 PID 2108 wrote to memory of 4180 2108 shmt.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"C:\Users\Admin\AppData\Local\Temp\607575be3135d1b617a5b2dddb884b19.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\shmt.exe"C:\Windows\system32\shmt.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\shmt.exe"C:\Windows\SysWOW64\shmt.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5f5a5826271a0e220e20e1758aa2681a5
SHA17329cfc539264ded6f3ad822cd97ad51275c6db2
SHA25639af59a54debdc75b367432e3fd032df5c868d5930750f625b57bf69911001db
SHA51278fe477174143ba199bd7ea994e2b2811f675af81e0612a13e88d08bc957cc73a12e6b4476aa4e09c7b1c8f42434fc170c35e9ee104d99284728df152e930527
-
Filesize
80KB
MD5607575be3135d1b617a5b2dddb884b19
SHA1ac5ba76759290781374b7cb3007abec289ff12a0
SHA2562fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
SHA512deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046