Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 03:43
Behavioral task
behavioral1
Sample
7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe
Resource
win10v2004-20240611-en
General
-
Target
7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe
-
Size
17KB
-
MD5
347f0f381f2fde5bf4ec57663e8a87c9
-
SHA1
351b844994e6e213e25db99915da12248819c3c8
-
SHA256
7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1
-
SHA512
7225249e841e4cdaf45e5159a29e1ca00166719d28a1c06140685ca6d971de2eac9d00ab386fe541876c1c620e35376bb59cd1f683a58b4b43c410e2c2957255
-
SSDEEP
384:XOHqX+I/ouf0b0eaXlfqL7Q2pa3c4AIY:6qp/rf08lfqL7R83zY
Malware Config
Extracted
metasploit
metasploit_stager
10.100.7.200:8443
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exepid process 1760 7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 1 IoCs
Processes:
7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exedescription pid process target process PID 1760 wrote to memory of 1196 1760 7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe"C:\Users\Admin\AppData\Local\Temp\7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory