metasploit | 20b3f9f50049e2025cab5a3d230bcb9e72498c02ec3c8d4160092b1c8f308356

General

Target

20b3f9f50049e2025cab5a3d230bcb9e72498c02ec3c8d4160092b1c8f308356.msi
Size

156KB
MD5

0372fb862dc13979b09b5505ca32e6e3
SHA1

25cfbfefb6d8dfaf42870bc970ae2c834da44a8c
SHA256

20b3f9f50049e2025cab5a3d230bcb9e72498c02ec3c8d4160092b1c8f308356
SHA512

8eecd57b5df14c261ca7f38c7428f03ade00e427274bce1c76c8eed255364a0310aae86cf978a3a2871deb76445b3eb02e45ae8bee461eb20eb9470b0c1003e9
SSDEEP

384:iHpe4ZvJXK7gzFM7Wu8wxukoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyuZDCUyWMDC

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

1.14.247.162:40001

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76360e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76360e.msi	msiexec.exe
File created	C:\Windows\Installer\f76360f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3738.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76360f.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36F8.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSI3738.tmp

pid process

832 MSI3738.tmp
Loads dropped DLL 2 IoCs

Processes:

msiexec.exe

pid process

2948 msiexec.exe
2948 msiexec.exe

pid	process
832	MSI3738.tmp

pid	process
2948	msiexec.exe
2948	msiexec.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2948 msiexec.exe
2948 msiexec.exe

pid	process
2948	msiexec.exe
2948	msiexec.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2140	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeSecurityPrivilege	2948	msiexec.exe
Token: SeCreateTokenPrivilege	2140	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2140	msiexec.exe
Token: SeLockMemoryPrivilege	2140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2140	msiexec.exe
Token: SeMachineAccountPrivilege	2140	msiexec.exe
Token: SeTcbPrivilege	2140	msiexec.exe
Token: SeSecurityPrivilege	2140	msiexec.exe
Token: SeTakeOwnershipPrivilege	2140	msiexec.exe
Token: SeLoadDriverPrivilege	2140	msiexec.exe
Token: SeSystemProfilePrivilege	2140	msiexec.exe
Token: SeSystemtimePrivilege	2140	msiexec.exe
Token: SeProfSingleProcessPrivilege	2140	msiexec.exe
Token: SeIncBasePriorityPrivilege	2140	msiexec.exe
Token: SeCreatePagefilePrivilege	2140	msiexec.exe
Token: SeCreatePermanentPrivilege	2140	msiexec.exe
Token: SeBackupPrivilege	2140	msiexec.exe
Token: SeRestorePrivilege	2140	msiexec.exe
Token: SeShutdownPrivilege	2140	msiexec.exe
Token: SeDebugPrivilege	2140	msiexec.exe
Token: SeAuditPrivilege	2140	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2140	msiexec.exe
Token: SeChangeNotifyPrivilege	2140	msiexec.exe
Token: SeRemoteShutdownPrivilege	2140	msiexec.exe
Token: SeUndockPrivilege	2140	msiexec.exe
Token: SeSyncAgentPrivilege	2140	msiexec.exe
Token: SeEnableDelegationPrivilege	2140	msiexec.exe
Token: SeManageVolumePrivilege	2140	msiexec.exe
Token: SeImpersonatePrivilege	2140	msiexec.exe
Token: SeCreateGlobalPrivilege	2140	msiexec.exe
Token: SeBackupPrivilege	2960	vssvc.exe
Token: SeRestorePrivilege	2960	vssvc.exe
Token: SeAuditPrivilege	2960	vssvc.exe
Token: SeBackupPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2596	DrvInst.exe
Token: SeRestorePrivilege	2596	DrvInst.exe
Token: SeRestorePrivilege	2596	DrvInst.exe
Token: SeRestorePrivilege	2596	DrvInst.exe
Token: SeRestorePrivilege	2596	DrvInst.exe
Token: SeRestorePrivilege	2596	DrvInst.exe
Token: SeRestorePrivilege	2596	DrvInst.exe
Token: SeLoadDriverPrivilege	2596	DrvInst.exe
Token: SeLoadDriverPrivilege	2596	DrvInst.exe
Token: SeLoadDriverPrivilege	2596	DrvInst.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2140 msiexec.exe
2140 msiexec.exe

pid	process
2140	msiexec.exe
2140	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2948 wrote to memory of 624	2948	msiexec.exe	MsiExec.exe
PID 2948 wrote to memory of 624	2948	msiexec.exe	MsiExec.exe
PID 2948 wrote to memory of 624	2948	msiexec.exe	MsiExec.exe
PID 2948 wrote to memory of 624	2948	msiexec.exe	MsiExec.exe
PID 2948 wrote to memory of 624	2948	msiexec.exe	MsiExec.exe
PID 2948 wrote to memory of 624	2948	msiexec.exe	MsiExec.exe
PID 2948 wrote to memory of 624	2948	msiexec.exe	MsiExec.exe
PID 2948 wrote to memory of 832	2948	msiexec.exe	MSI3738.tmp
PID 2948 wrote to memory of 832	2948	msiexec.exe	MSI3738.tmp
PID 2948 wrote to memory of 832	2948	msiexec.exe	MSI3738.tmp

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\20b3f9f50049e2025cab5a3d230bcb9e72498c02ec3c8d4160092b1c8f308356.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2140

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1CA0F518032ED0855132C0A4B2CF20C0
2⤵
PID:624

C:\Windows\Installer\MSI3738.tmp
"C:\Windows\Installer\MSI3738.tmp"
2⤵
- Executes dropped EXE
PID:832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "0000000000000590"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2596

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Installer\MSI3738.tmp
Filesize
124KB

MD5
2dc392ce36491523764af744421ee210

SHA1
35fc5c27f6ca384810a059238f33044172cc14ce

SHA256
4132c01b4a1b027c4fe418d786c6a9db7ac8f1fe4b7c905e05db577a7c651778

SHA512
7061bb881eafc0e2f67ce30ecaa3ee31c17f69d57006c7a8a5daf1e383c61a8316fab3d75e33dda1d30949e6120a30f6b74847e85a8ae4bf001fd8b55054cc00

Download Submit
memory/832-15-0x0000000140000000-0x0000000140004278-memory.dmp

Filesize
16KB

Download
memory/2948-9-0x0000000140000000-0x0000000140005000-memory.dmp

Filesize
20KB

Download
memory/2948-29-0x0000000140000000-0x0000000140005000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads