Overview

overview

10

Static

static

1

2024-04-30...er.exe

windows7-x64

10

2024-04-30...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-04-2024 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-30_7feb5b96fba211ec445788fbac87dcab_avoslocker.exe

  • Size

    9.7MB

  • MD5

    7feb5b96fba211ec445788fbac87dcab

  • SHA1

    97bc8df03ba99714a50179ba9cb7e54e972af886

  • SHA256

    1b92b8e3c2cd63b788c6689b62dc6f91f3abce211821e8169fd20aa96fc614a0

  • SHA512

    f6cad309981087b8549b7d69dbee04471053b09cac3cd389400350d466376c643e4dbcb680a187b1f325b0b52dfd443ae602ff90810fe1d28c471c8e81b12397

  • SSDEEP

    196608:wlGKhkfvi9X4VwGKhkfvi9X4mta8nXe12EYtHHSO8LTOFM2JwfuQB:wlGKifK9cwGKifK9PZnXe12H9SOGTOFS

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

18.231.93.153:13655

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-30_7feb5b96fba211ec445788fbac87dcab_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-30_7feb5b96fba211ec445788fbac87dcab_avoslocker.exe"
    1⤵
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:708
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\febootimail80gdfxj.msi
    Filesize

    2.6MB

    MD5

    4c92b0496fa2cab42eec986f47e07ff4

    SHA1

    298f187d6a2bc23da7153ed3b1dab5f0d34f366b

    SHA256

    1badfb9794749d4de0d9fe419495202da2bfc621cf4248a5c6691671ad9b2837

    SHA512

    5fc19105fd3a64a39649721aa10bd33e66eb680e809964118491adb24edcb5a54eb12672ea878cc993a3313e6662d63fe8ad0ede7acc4e7579841d7b8b2aaf75

    Download Submit
  • memory/708-0-0x00000000018B0000-0x00000000018B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/708-1-0x00000000018B0000-0x00000000018B1000-memory.dmp
    Filesize

    4KB

    Download