Analysis
- max time kernel
121s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
16/06/2024, 04:31
General
- Target 03faa241bc0007574f0ced3ac593f28a.exe
- Size 7KB
- Sample240616-e5dcmszdja
- SHA256 3f122e8743aa6eb1f85ca9c84189ba0c58f078a2d9b45d026e941da8263c00e5
Malware Config
Extracted
-
metasploit
-
metasploit_stager
-
5.35.98.86:4444
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03faa241bc0007574f0ced3ac593f28a.exe"C:\Users\Admin\AppData\Local\Temp\03faa241bc0007574f0ced3ac593f28a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2396 -s 2443⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2160-21-0x0000000002190000-0x0000000002290000-memory.dmp
memory/2160-44-0x0000000000410000-0x0000000000449000-memory.dmp
memory/2160-2-0x0000000000410000-0x0000000000449000-memory.dmp
memory/2160-7-0x0000000000410000-0x0000000000449000-memory.dmp
memory/2160-8-0x0000000000410000-0x0000000000449000-memory.dmp
memory/2160-15-0x0000000000450000-0x00000000004BC000-memory.dmp
memory/2160-1-0x00000000003D0000-0x0000000000402000-memory.dmp
memory/2160-37-0x0000000002060000-0x000000000208B000-memory.dmp
memory/2160-0-0x0000000140000000-0x0000000140004278-memory.dmp
memory/2160-43-0x0000000002190000-0x0000000002290000-memory.dmp
memory/2160-22-0x0000000000410000-0x0000000000449000-memory.dmp
memory/2160-73-0x00000000003D0000-0x0000000000402000-memory.dmp
memory/2396-69-0x00000000002B0000-0x00000000002E2000-memory.dmp
memory/2396-68-0x00000000002B0000-0x00000000002E2000-memory.dmp
memory/2396-67-0x00000000002B0000-0x00000000002E2000-memory.dmp