Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/09/2024, 18:39
General
-
Target
file.exe
-
Size
522KB
-
MD5
06a0c92c691e980875b3345ce72fe78b
-
SHA1
ab38c20a9e04f0ffe951a194075c296373e3e367
-
SHA256
136e03127b12cc2b5242530339b24ad7c082741c152783d996b3fa63bc21f6de
-
SHA512
ea60783778989f0979e6edc25b4877d073ac7ea0a067fd7750a679eb6f380212e739ef07d6239911a4a3604e236ccdf65df6fd9faccd37f2c25116844e91f2cb
-
SSDEEP
12288:JzxzTDWikLSb4NS7QX+tjUXZkzF4Lyqe185h9pp3bQ/FO:zDWHSb4NkJ4S6hE/s
Malware Config
Extracted
metasploit
metasploit_stager
8.130.82.167:5544
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\windows\temp\i0C.exe"C:\windows\temp\i0C.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\windows\temp\3950.docx" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
30KB
MD5daadd19803a76add7d5d0d707172c1d1
SHA1c9d71423fca459786073a6bdfa48f4a1636335ad
SHA25679c64517400d205f149825cb196576cdf9a2ce7d41b554d5065de0ec71ef1c29
SHA512ce567bacb900ed86f89c987020781bd3cb6e9cfc78d346e508d81c3d17ae9526ea89f7ce6f8c532211e36116397ea15ac9dcb91131f58e12a2c3df12a5acffa6
-
Filesize
650KB
MD598ce25fcd5b58bf3a90ba1b4c306cbc1
SHA193f89bf4754809702df814db2be8f2d905128402
SHA256b3174a40b59341a5604ac5878c80ec7033f223c4122ff407c1c61a5231dea84e
SHA51201ca4d9bfd35944f8888713a296f857e9b7c7f72a4f1883cd56089b728c2056576e7e48dfd877b506653054beeee9a0982b48d4718dd7fac3f8830e9a26615c8
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
24KB