metasploit | 6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc

Resubmissions

07-11-2024 15:19

241107-sqffcavcpn 10

26-10-2024 21:50

241026-1pw1pszape 10

26-10-2024 21:43

241026-1k53tazhlq 10

Analysis

max time kernel
22s
max time network
28s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07-11-2024 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe
Size

2.8MB
MD5

e04ecdd8ffdc552a1487fc06fe7b7d32
SHA1

6bbc335e0a245fff6a76609cce91002a9b4fa4da
SHA256

6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc
SHA512

8c7d78d34efcfe4fff5657c2d77fa166e018705e0430472a1ed68404e1e2643dfc1216d1a4e10d6e900409edc301139ebd8513e06f9b1c63721f80ffa2a8e906
SSDEEP

49152:QTv13vUrb/TvvO90dL3BmAFd4A64nsfJ2O4w7mtxwenpxgmM9GgoW0D1/xhN/v38:m3vXR907bN/1XVK

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

192.168.65.128:9999

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe

description	pid	Process	procid_target
PID 5284 set thread context of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78

Modifies registry class 4 IoCs

Processes:

BackgroundTransferHost.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid	Process
980	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe

description	pid	Process	procid_target
PID 5284 wrote to memory of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78
PID 5284 wrote to memory of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78
PID 5284 wrote to memory of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78
PID 5284 wrote to memory of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78
PID 5284 wrote to memory of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78
PID 5284 wrote to memory of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78
PID 5284 wrote to memory of 1464	5284	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	78

C:\Users\Admin\AppData\Local\Temp\6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe
"C:\Users\Admin\AppData\Local\Temp\6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1464

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:980

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\605e2268-ca5f-45c8-8ff1-7ed120da8cc8.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
memory/1464-0-0x00007FF679810000-0x00007FF679815000-memory.dmp

Filesize
20KB

Download
memory/1464-1-0x00007FF679810000-0x00007FF679814278-memory.dmp

Filesize
16KB

Download
memory/1464-6-0x00007FF679810000-0x00007FF679815000-memory.dmp

Filesize
20KB

Download
memory/1464-7-0x00007FF679810000-0x00007FF679814278-memory.dmp

Filesize
16KB

Download