Analysis
-
max time kernel
37s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 05:25
Behavioral task
behavioral1
Sample
53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a/53c9a6fc60f1b68e23f9a4060452d035af7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a/53c9a6fc60f1b68e23f9a4060452d035af7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
6fc8b5b8a90cf8ba7e0eb930fcdde776f8eeb3f37913318df7766a365e13fa8e/6fc8b5b8a90cf8ba7e0eb930fcdde776f8e.exe
Resource
win7-20241010-en
windows7-x64
General
-
Target
53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a/53c9a6fc60f1b68e23f9a4060452d035af7.exe
-
Size
72KB
-
MD5
449c0175718415174c3961728c7b48ba
-
SHA1
573e1558ba736edefc6a41dda6505f07b9eddfd8
-
SHA256
53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a
-
SHA512
423841097e9711322c647735f69a40105ca1a9a5d4245b92d1334909f6fde9d4ef2df195296b929c052022ba677c6705cdea6779f43f3cd767261b5bf9065efe
-
SSDEEP
1536:Ij2YmZ2WQAZ+4DRkT4Us96osMiq1Mb+KR0Nc8QsJq39:Iq2e1ixoNiue0Nc8QsC9
Malware Config
Extracted
metasploit
windows/reverse_tcp
172.183.76.152:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53c9a6fc60f1b68e23f9a4060452d035af7.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2412 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe 2412 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a\53c9a6fc60f1b68e23f9a4060452d035af7.exe"C:\Users\Admin\AppData\Local\Temp\53c9a6fc60f1b68e23f9a4060452d035af7e2eb73fec2f42b6012fc98417115a\53c9a6fc60f1b68e23f9a4060452d035af7.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2096
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2412