Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/09/2024, 22:24 UTC
General
-
Target
8bf91d26e737b56aa4771761d591f405b5c04c6fd8f12e90e5b9ff9b580054db.exe
-
Size
648KB
-
MD5
ac4f755722808855003abb5244be8778
-
SHA1
43c782af8197e16c32548129041735e06bf24b24
-
SHA256
8bf91d26e737b56aa4771761d591f405b5c04c6fd8f12e90e5b9ff9b580054db
-
SHA512
c8ceff9755699726a40e44b1d9bdbc301c5925d06a800c1e852d6e9638b59cbce04992db8640a9606a11c11d0e3505812315a414d4b7a928dce85aa2a379cca9
-
SSDEEP
12288:dIOE6dhaTWbx953GSEpup1awv0c3HiIZNDE19Ko9N7rCsVmcoMA:dIBIaTWbp3Glgp7v0CHlNW9Kk/tlR
Malware Config
Extracted
metasploit
windows/download_exec
http://192.168.64.134:83/HzGS
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MDDCJS)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bf91d26e737b56aa4771761d591f405b5c04c6fd8f12e90e5b9ff9b580054db.exe"C:\Users\Admin\AppData\Local\Temp\8bf91d26e737b56aa4771761d591f405b5c04c6fd8f12e90e5b9ff9b580054db.exe"1⤵
- System Location Discovery: System Language Discovery
Network
- No results found
-
192.168.64.134:83 -
192.168.64.134:83
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB