metasploit | 1b678899247d6239f5c03b9f017b6808524d3a5e9320e31f78a355017323db48

General

Target

1b678899247d6239f5c03b9f017b6808524d3a5e9320e31f78a355017323db48.msi
Size

156KB
MD5

ea86d9f4827f1b24baf14d0a62111c81
SHA1

dfbe48a8b76917ff03cf74d0519dda2c1ab76dfb
SHA256

1b678899247d6239f5c03b9f017b6808524d3a5e9320e31f78a355017323db48
SHA512

ab86da16e79c4d000ec736528f7e58e5973f2ff9654c1bcb0ba9ef7ef1d14ce3134f5d0f31a5803da93a6676c0c3f35dee0559fe66dda60f16e0098e56ca0d10
SSDEEP

384:iHpe4ZvJXK7gzFM7WuMOxceoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyuvDCUyWMDC

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

1.14.247.162:40001

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f763266.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f763266.msi	msiexec.exe
File created	C:\Windows\Installer\f763267.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f763267.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3360.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3371.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSI3371.tmp

pid process

2112 MSI3371.tmp
Loads dropped DLL 2 IoCs

Processes:

msiexec.exe

pid process

2780 msiexec.exe
2780 msiexec.exe

pid	process
2112	MSI3371.tmp

pid	process
2780	msiexec.exe
2780	msiexec.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2780 msiexec.exe
2780 msiexec.exe

pid	process
2780	msiexec.exe
2780	msiexec.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	3012	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3012	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeCreateTokenPrivilege	3012	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3012	msiexec.exe
Token: SeLockMemoryPrivilege	3012	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3012	msiexec.exe
Token: SeMachineAccountPrivilege	3012	msiexec.exe
Token: SeTcbPrivilege	3012	msiexec.exe
Token: SeSecurityPrivilege	3012	msiexec.exe
Token: SeTakeOwnershipPrivilege	3012	msiexec.exe
Token: SeLoadDriverPrivilege	3012	msiexec.exe
Token: SeSystemProfilePrivilege	3012	msiexec.exe
Token: SeSystemtimePrivilege	3012	msiexec.exe
Token: SeProfSingleProcessPrivilege	3012	msiexec.exe
Token: SeIncBasePriorityPrivilege	3012	msiexec.exe
Token: SeCreatePagefilePrivilege	3012	msiexec.exe
Token: SeCreatePermanentPrivilege	3012	msiexec.exe
Token: SeBackupPrivilege	3012	msiexec.exe
Token: SeRestorePrivilege	3012	msiexec.exe
Token: SeShutdownPrivilege	3012	msiexec.exe
Token: SeDebugPrivilege	3012	msiexec.exe
Token: SeAuditPrivilege	3012	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3012	msiexec.exe
Token: SeChangeNotifyPrivilege	3012	msiexec.exe
Token: SeRemoteShutdownPrivilege	3012	msiexec.exe
Token: SeUndockPrivilege	3012	msiexec.exe
Token: SeSyncAgentPrivilege	3012	msiexec.exe
Token: SeEnableDelegationPrivilege	3012	msiexec.exe
Token: SeManageVolumePrivilege	3012	msiexec.exe
Token: SeImpersonatePrivilege	3012	msiexec.exe
Token: SeCreateGlobalPrivilege	3012	msiexec.exe
Token: SeBackupPrivilege	2336	vssvc.exe
Token: SeRestorePrivilege	2336	vssvc.exe
Token: SeAuditPrivilege	2336	vssvc.exe
Token: SeBackupPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2396	DrvInst.exe
Token: SeRestorePrivilege	2396	DrvInst.exe
Token: SeRestorePrivilege	2396	DrvInst.exe
Token: SeRestorePrivilege	2396	DrvInst.exe
Token: SeRestorePrivilege	2396	DrvInst.exe
Token: SeRestorePrivilege	2396	DrvInst.exe
Token: SeRestorePrivilege	2396	DrvInst.exe
Token: SeLoadDriverPrivilege	2396	DrvInst.exe
Token: SeLoadDriverPrivilege	2396	DrvInst.exe
Token: SeLoadDriverPrivilege	2396	DrvInst.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3012 msiexec.exe
3012 msiexec.exe

pid	process
3012	msiexec.exe
3012	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2780 wrote to memory of 2112	2780	msiexec.exe	MSI3371.tmp
PID 2780 wrote to memory of 2112	2780	msiexec.exe	MSI3371.tmp
PID 2780 wrote to memory of 2112	2780	msiexec.exe	MSI3371.tmp
PID 2780 wrote to memory of 396	2780	msiexec.exe	MsiExec.exe
PID 2780 wrote to memory of 396	2780	msiexec.exe	MsiExec.exe
PID 2780 wrote to memory of 396	2780	msiexec.exe	MsiExec.exe
PID 2780 wrote to memory of 396	2780	msiexec.exe	MsiExec.exe
PID 2780 wrote to memory of 396	2780	msiexec.exe	MsiExec.exe
PID 2780 wrote to memory of 396	2780	msiexec.exe	MsiExec.exe
PID 2780 wrote to memory of 396	2780	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1b678899247d6239f5c03b9f017b6808524d3a5e9320e31f78a355017323db48.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3012

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ADAA38F5F84EF3DFBA71815924535ED7
2⤵
PID:396

C:\Windows\Installer\MSI3371.tmp
"C:\Windows\Installer\MSI3371.tmp"
2⤵
- Executes dropped EXE
PID:2112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002C8" "000000000000059C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Installer\MSI3371.tmp
Filesize
124KB

MD5
32bca63e32bfa7abf23e77edd30478d6

SHA1
57beba1d54428d559fd3ed8d258a691990cd0245

SHA256
c6b4471618c370d9216fc3632dc258ad460471e2385ded2f2929133e9b1e67ab

SHA512
3a0f987a78316728da4ee30ea307919a2b73c9b85c0cbe24e179f4c6bb6255d89fc056f1d3f9f56bd6ff6ad40e22521fc581f08630a8759bed9cc3892c81b553

Download Submit
memory/2112-16-0x0000000140000000-0x00000001400042A0-memory.dmp

Filesize
16KB

Download
memory/2780-15-0x0000000140000000-0x0000000140005000-memory.dmp

Filesize
20KB

Download
memory/2780-14-0x0000000140000000-0x0000000140005000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads