Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
05/02/2024, 21:31
General
- Target 930c7086d5c26f5462622a7619e5ba00.exe
- Size 849KB
- Sample240205-1c1hcsaffn
- SHA256 6a327f3cd88bf5edc3e926c829e6ae1ff4fc87425c45e65a234b233b7058ce7a
Malware Config
Extracted
-
metasploit
-
encoder/fnstenv_mov
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 10 IoCs
- Drops file in System32 directory 22 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 11 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\930c7086d5c26f5462622a7619e5ba00.exe"C:\Users\Admin\AppData\Local\Temp\930c7086d5c26f5462622a7619e5ba00.exe"1⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 1552 "C:\Users\Admin\AppData\Local\Temp\930c7086d5c26f5462622a7619e5ba00.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 668 "C:\Windows\SysWOW64\svczhost.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 1580 "C:\Windows\SysWOW64\svczhost.exe"4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 848 "C:\Windows\SysWOW64\svczhost.exe"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 1600 "C:\Windows\SysWOW64\svczhost.exe"6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 1608 "C:\Windows\SysWOW64\svczhost.exe"7⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 676 "C:\Windows\SysWOW64\svczhost.exe"8⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 872 "C:\Windows\SysWOW64\svczhost.exe"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 876 "C:\Windows\SysWOW64\svczhost.exe"10⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svczhost.exeC:\Windows\system32\svczhost.exe 1644 "C:\Windows\SysWOW64\svczhost.exe"11⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
TEMP:449A3A66
svczhost.exe
svczhost.exe
svczhost.exe
memory/1900-195-0x0000000004770000-0x0000000004805000-memory.dmp
memory/1900-193-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/1900-153-0x0000000004770000-0x0000000004805000-memory.dmp
memory/2420-275-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/2420-276-0x0000000004740000-0x00000000047D5000-memory.dmp
memory/2420-236-0x0000000004740000-0x00000000047D5000-memory.dmp
memory/2780-10-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/2780-13-0x00000000047D0000-0x0000000004865000-memory.dmp
memory/2780-27-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/2780-2-0x00000000047D0000-0x0000000004865000-memory.dmp
memory/2780-7-0x00000000047D0000-0x0000000004865000-memory.dmp
memory/2780-8-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/2780-11-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/2780-23-0x00000000047D0000-0x0000000004865000-memory.dmp
memory/2780-9-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/2780-12-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/2780-0-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/3632-263-0x0000000004720000-0x00000000047B5000-memory.dmp
memory/3896-209-0x00000000046E0000-0x0000000004775000-memory.dmp
memory/3896-249-0x00000000046E0000-0x0000000004775000-memory.dmp
memory/3896-247-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-38-0x0000000004750000-0x00000000047E5000-memory.dmp
memory/4164-34-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-31-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-29-0x0000000004750000-0x00000000047E5000-memory.dmp
memory/4164-32-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-35-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-36-0x0000000004750000-0x00000000047E5000-memory.dmp
memory/4164-57-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-33-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-21-0x0000000004750000-0x00000000047E5000-memory.dmp
memory/4164-37-0x0000000004750000-0x00000000047E5000-memory.dmp
memory/4164-39-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4164-53-0x0000000004750000-0x00000000047E5000-memory.dmp
memory/4336-169-0x0000000004710000-0x00000000047A5000-memory.dmp
memory/4336-167-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4336-126-0x0000000004710000-0x00000000047A5000-memory.dmp
memory/4352-87-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4352-84-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4352-67-0x0000000004720000-0x00000000047B5000-memory.dmp
memory/4352-72-0x0000000004720000-0x00000000047B5000-memory.dmp
memory/4352-83-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4352-111-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4352-113-0x0000000004720000-0x00000000047B5000-memory.dmp
memory/4352-90-0x0000000004720000-0x00000000047B5000-memory.dmp
memory/4352-91-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4352-85-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4352-86-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4352-88-0x0000000004720000-0x00000000047B5000-memory.dmp
memory/4352-89-0x0000000004720000-0x00000000047B5000-memory.dmp
memory/4676-61-0x00000000046A0000-0x0000000004735000-memory.dmp
memory/4676-59-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4676-63-0x00000000046A0000-0x0000000004735000-memory.dmp
memory/4676-62-0x00000000046A0000-0x0000000004735000-memory.dmp
memory/4676-60-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4676-47-0x00000000046A0000-0x0000000004735000-memory.dmp
memory/4676-54-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4676-42-0x00000000046A0000-0x0000000004735000-memory.dmp
memory/4676-64-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4676-75-0x00000000046A0000-0x0000000004735000-memory.dmp
memory/4676-58-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4676-82-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4676-56-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/5044-224-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/5044-225-0x00000000047D0000-0x0000000004865000-memory.dmp
memory/5044-182-0x00000000047D0000-0x0000000004865000-memory.dmp
memory/5116-141-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/5116-99-0x00000000046E0000-0x0000000004775000-memory.dmp
memory/5116-94-0x00000000046E0000-0x0000000004775000-memory.dmp
memory/5116-142-0x00000000046E0000-0x0000000004775000-memory.dmp