metasploit | f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 23:27

Target

f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exe
Size

7KB
MD5

cde3035e08bb57f1d80f9af2f6b2e710
SHA1

8c355b7edd051a73f866314adee525a8b779c01f
SHA256

f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1
SHA512

a00e8e51bff34a0f4638df67575b8717607fd2fe0942665e55c8f5e5901a4608b54d43e6837befc1988aa6f8052de5a1c71b8e55c0974a049d155eadcf5643ce
SSDEEP

96:hgtfC+61j/9llDkc+kY9mnunYkDt6+1QF27d+7a17YNzNt:mg12kY9SSICQOd7in

Score

10^/10

Family

metasploit

Version

windows/reverse_tcp

192.168.1.20:4444

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exe

pid	Process
2380	f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exeExplorer.EXE

description	pid	Process
Token: SeDebugPrivilege	2380	f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exe
Token: SeShutdownPrivilege	1236	Explorer.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exeExplorer.EXE

description	pid	Process	procid_target
PID 2380 wrote to memory of 1236	2380	f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exe	21
PID 1236 wrote to memory of 2240	1236	Explorer.EXE	31
PID 1236 wrote to memory of 2240	1236	Explorer.EXE	31
PID 1236 wrote to memory of 2240	1236	Explorer.EXE	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exe
  "C:\Users\Admin\AppData\Local\Temp\f434868f9d05132bd1759bd890b85915e60cb665124caf8d9c9e53ccbd0930b1N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1236 -s 1992
  2⤵
  PID:2240

memory/1236-3-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1236-2-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/2380-0-0x000007FEF5BA3000-0x000007FEF5BA4000-memory.dmp

Filesize
4KB

Download
memory/2380-1-0x0000000000120000-0x0000000000128000-memory.dmp

Filesize
32KB

Download
memory/2380-4-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download