Analysis
-
max time kernel
105s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 02:14
General
-
Target
774e1eb4c59ff11ff0278843076292a0b64326075d41a79536df154a76b8fc67.exe
-
Size
3.0MB
-
MD5
be7a9dd0b25c5ed86f4314baae9905fa
-
SHA1
2cea8306d8ce6e17da4cbabc700c993cb1c73db1
-
SHA256
774e1eb4c59ff11ff0278843076292a0b64326075d41a79536df154a76b8fc67
-
SHA512
c0fc7466e8a8733e82e7cb9ae8172f0e2f3e3ca431bf6a0a1a6b38852337bd9dde83cf7128db7e2e6021996f82892365c949aff79e0b5ca774e698f50c14d338
-
SSDEEP
49152:phBfJXAE4pq5PtDZebWSGUDHLtDEy2sr0mRu3ljzSTz7Lv14BBQpsEAvG8:phBfKE4wbZeaSrmy2s76jqPL9UksEAO8
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
192.168.119.191:4445
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\774e1eb4c59ff11ff0278843076292a0b64326075d41a79536df154a76b8fc67.exe"C:\Users\Admin\AppData\Local\Temp\774e1eb4c59ff11ff0278843076292a0b64326075d41a79536df154a76b8fc67.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB