Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
30-04-2024 00:06
General
-
Target
shell.exe
-
Size
7KB
-
MD5
792638f04fab15fdfdd40d90de3f543a
-
SHA1
cf452a13f7b29ba2b6649540571cd3372817f4f4
-
SHA256
2ca47f7ab7e0b4da1fa3fe7ea4b4cedf431c212df06e68a85d0de372fb20e867
-
SHA512
5b9b28e5a3764af754e97a4fb6836bd3062121b5edee10900687fb5d069dde1798caf36920d179092e9731b193a097a30f6459da32507a49bf4d90a21997b8cf
-
SSDEEP
24:eFGStrJ9u0/6gSnZdkBQAVK86WYiKZqM2eNDMSCvOXpmB:is0tqkBQv8iiu2SD9C2kB
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
192.168.88.128:8080
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\shell.exe"C:\Users\Admin\AppData\Local\Temp\shell.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3740-0-0x0000000140000000-0x0000000140004278-memory.dmpFilesize
16KB
-
memory/3740-8-0x0000000140000000-0x0000000140004278-memory.dmpFilesize
16KB