metasploit | 3669db0928f84f3370a27135efd64bdb8fc5f255713c787b008bc35a6bc53fed

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 08:46

Target

c5739c24d8cefd23c921e9edfb6ddc47.exe
Size

10KB
MD5

c5739c24d8cefd23c921e9edfb6ddc47
SHA1

057182357d2443e1bba28b3dd2c2fd27eeae89b5
SHA256

3669db0928f84f3370a27135efd64bdb8fc5f255713c787b008bc35a6bc53fed
SHA512

8d38019b4beb15e6ee88f12c290cb5ed06b924140bbe09185cae394766ef84651426c5d0a9594ae5f21366fd153a69f19e60308b193ba3e4eaefeca1964924d6
SSDEEP

192:3vgU3MtZjVp24ff6j1QDjOcQH3J0LxdN7E5pz6rJoZZPDB:B8Zfij16jvQXsxdN7mzPD

Score

10^/10

Family

metasploit

Version

windows/single_exec

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2140	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3040	2208	c5739c24d8cefd23c921e9edfb6ddc47.exe	88
PID 2208 wrote to memory of 3040	2208	c5739c24d8cefd23c921e9edfb6ddc47.exe	88
PID 2208 wrote to memory of 3040	2208	c5739c24d8cefd23c921e9edfb6ddc47.exe	88

C:\Users\Admin\AppData\Local\Temp\c5739c24d8cefd23c921e9edfb6ddc47.exe
"C:\Users\Admin\AppData\Local\Temp\c5739c24d8cefd23c921e9edfb6ddc47.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  PID:3040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2140

memory/2208-1-0x00000000007C0000-0x00000000008C0000-memory.dmp

Filesize
1024KB

Download
memory/2208-2-0x00000000007C0000-0x00000000008C0000-memory.dmp

Filesize
1024KB

Download