Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 03:43

General

  • Target

    7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe

  • Size

    17KB

  • MD5

    347f0f381f2fde5bf4ec57663e8a87c9

  • SHA1

    351b844994e6e213e25db99915da12248819c3c8

  • SHA256

    7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1

  • SHA512

    7225249e841e4cdaf45e5159a29e1ca00166719d28a1c06140685ca6d971de2eac9d00ab386fe541876c1c620e35376bb59cd1f683a58b4b43c410e2c2957255

  • SSDEEP

    384:XOHqX+I/ouf0b0eaXlfqL7Q2pa3c4AIY:6qp/rf08lfqL7R83zY

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

10.100.7.200:8443

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe
      "C:\Users\Admin\AppData\Local\Temp\7643b69465e4fe44e441adf35ecd82bcf7dadccdf5c76cecdd1528ca4e9f6cb1.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1196-0-0x00000000025B0000-0x00000000025B1000-memory.dmp
    Filesize

    4KB

  • memory/1196-1-0x00000000025B0000-0x00000000025B1000-memory.dmp
    Filesize

    4KB