Extracted

• • Target

    774e1eb4c59ff11ff0278843076292a0b64326075d41a79536df154a76b8fc67.exe

  • Size

    3.0MB

  • MD5

    be7a9dd0b25c5ed86f4314baae9905fa

  • SHA1

    2cea8306d8ce6e17da4cbabc700c993cb1c73db1

  • SHA256

    774e1eb4c59ff11ff0278843076292a0b64326075d41a79536df154a76b8fc67

  • SHA512

    c0fc7466e8a8733e82e7cb9ae8172f0e2f3e3ca431bf6a0a1a6b38852337bd9dde83cf7128db7e2e6021996f82892365c949aff79e0b5ca774e698f50c14d338

  • SSDEEP

    49152:phBfJXAE4pq5PtDZebWSGUDHLtDEy2sr0mRu3ljzSTz7Lv14BBQpsEAvG8:phBfKE4wbZeaSrmy2s76jqPL9UksEAO8

  Score

  10^/10

  metasploitbackdoordiscoverypersistenceprivilege_escalationtrojan

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2