Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/01/2024, 23:32
Static task
static1
Behavioral task
behavioral1
Sample
6e1f87e51a0e7711403f75f2e76eef63.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6e1f87e51a0e7711403f75f2e76eef63.exe
Resource
win10v2004-20231215-en
General
-
Target
6e1f87e51a0e7711403f75f2e76eef63.exe
-
Size
45KB
-
MD5
6e1f87e51a0e7711403f75f2e76eef63
-
SHA1
6577d07aba67beb8697716e2180813f06e23a397
-
SHA256
b8f038fd11b8dec71bc2602f86bacec23c314e52380cc89e0e21a1e772e24c3c
-
SHA512
fd1e66f7cfa4f7e652be1ff99bb08a54274c8670a9a11f9da311db67c56bc210ef1904ba9c39b551d664df238e1b56d78709faaca4834f6ec9822de8d6c2b3ba
-
SSDEEP
768:UNZeUS2mykVi2PN+1nQZtTik3MB7dLQd/+vxs6rZ:4/mPV/PNQQyeMB79yM
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6e1f87e51a0e7711403f75f2e76eef63.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe" 6e1f87e51a0e7711403f75f2e76eef63.exe -
Executes dropped EXE 2 IoCs
pid Process 2164 jodrive32.exe 2072 jodrive32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe" 6e1f87e51a0e7711403f75f2e76eef63.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1044 set thread context of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 2164 set thread context of 2072 2164 jodrive32.exe 30 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\%windir%\eilfiie32.log jodrive32.exe File created C:\Windows\jodrive32.exe 6e1f87e51a0e7711403f75f2e76eef63.exe File opened for modification C:\Windows\jodrive32.exe 6e1f87e51a0e7711403f75f2e76eef63.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2376 6e1f87e51a0e7711403f75f2e76eef63.exe 2376 6e1f87e51a0e7711403f75f2e76eef63.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 1044 wrote to memory of 2376 1044 6e1f87e51a0e7711403f75f2e76eef63.exe 29 PID 2376 wrote to memory of 2164 2376 6e1f87e51a0e7711403f75f2e76eef63.exe 28 PID 2376 wrote to memory of 2164 2376 6e1f87e51a0e7711403f75f2e76eef63.exe 28 PID 2376 wrote to memory of 2164 2376 6e1f87e51a0e7711403f75f2e76eef63.exe 28 PID 2376 wrote to memory of 2164 2376 6e1f87e51a0e7711403f75f2e76eef63.exe 28 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30 PID 2164 wrote to memory of 2072 2164 jodrive32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e1f87e51a0e7711403f75f2e76eef63.exe"C:\Users\Admin\AppData\Local\Temp\6e1f87e51a0e7711403f75f2e76eef63.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\6e1f87e51a0e7711403f75f2e76eef63.exe"C:\Users\Admin\AppData\Local\Temp\6e1f87e51a0e7711403f75f2e76eef63.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2376
-
-
C:\Windows\jodrive32.exe"C:\Windows\jodrive32.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\jodrive32.exe"C:\Windows\jodrive32.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD56e1f87e51a0e7711403f75f2e76eef63
SHA16577d07aba67beb8697716e2180813f06e23a397
SHA256b8f038fd11b8dec71bc2602f86bacec23c314e52380cc89e0e21a1e772e24c3c
SHA512fd1e66f7cfa4f7e652be1ff99bb08a54274c8670a9a11f9da311db67c56bc210ef1904ba9c39b551d664df238e1b56d78709faaca4834f6ec9822de8d6c2b3ba