Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-05-2024 12:57
General
-
Target
天神魔域.exe
-
Size
1.8MB
-
MD5
5e3b27ad011681c8f3a4338d82772e8a
-
SHA1
e6b4657011102a10dfbd1f54d4765f3422df40ca
-
SHA256
ceab7cefdbb9c62221c85cf138a2446c4460c3701e463487906eba23b6df6844
-
SHA512
ddcf1010e422babb2a13d1402d50209431f632ab8c349da2b8a708c6bb425c3bf2d655709c222b230f1044b94ce7be0c4bf9d79eab26946549ab8f0a1547d10a
-
SSDEEP
24576:/3vLRdVhZBK8NogWYO098OGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ18xJIiW0MbQxA
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
windows/shell_reverse_tcp
C2
1.15.12.73:4567
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\天神魔域.exe"C:\Users\Admin\AppData\Local\Temp\天神魔域.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.9MB