metasploit | d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 11:17

Target

d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e.exe
Size

320KB
MD5

c47e8c85b7b26c23f69d99170d4a59f4
SHA1

042e203a1e64e7bfa31a1a617189ec5f7430ff40
SHA256

d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e
SHA512

3c7be0df686084995dfdb04d56966ec271fecbe19b46eb05c79b7159985eeec23ae30db7d2c3e81ce581b4f6556f92d890f4d1ce19cf4eb85f4ee07c2115c970
SSDEEP

6144:fmRytfk48a9YIZZsjujUDtPVDkPgDyrDzi+RRvENqxIO:OgHTTZKqjUVVDkPgDyu+jvENV

Score

10^/10

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings calc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3488 OpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	calc.exe

pid	process
3488	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e.exe

description	pid	process	target process
PID 4800 wrote to memory of 2276	4800	d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e.exe	calc.exe
PID 4800 wrote to memory of 2276	4800	d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e.exe	calc.exe
PID 4800 wrote to memory of 2276	4800	d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e.exe
"C:\Users\Admin\AppData\Local\Temp\d835302b1fb14a37be34fad568f8ec8c1807de94e7b2765568c747a3a90ff39e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3488

memory/4800-0-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/4800-2-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/4800-3-0x0000000000660000-0x000000000069D000-memory.dmp

Filesize
244KB

Download
memory/4800-4-0x0000000000B40000-0x0000000000B88000-memory.dmp

Filesize
288KB

Download
memory/4800-5-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4800-7-0x0000000003E00000-0x0000000003E02000-memory.dmp

Filesize
8KB

Download