Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 20:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ir_agent.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ir_agent.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ir_agent.exe
-
Size
168KB
-
MD5
cd4d0398199d42561ceb70c9e1ce76d7
-
SHA1
d87aa727958d5f94df0b31e88f131e359c2d9084
-
SHA256
7f9bfaa0b8f5ed6a9666c0a09ea9708dd6e555672edee3ac96fb424317a1aff2
-
SHA512
f79d4d93a984e7794ff7d95ecd6383cc4b3033fd6104fda54187b0d059ba2ffd75b26bfa7eb8fb25e1093060ecf495d96f76353e24ef5955f93d7781d7471cc4
-
SSDEEP
3072:1Z8wQQ1w7+NmlcEm0SK4gRFVNrtu/T64fL6WT9t:UwA+NTD0SK4gRFVBtu/GTkt
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
157.230.10.115:443
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1848 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1848 taskmgr.exe Token: SeSystemProfilePrivilege 1848 taskmgr.exe Token: SeCreateGlobalPrivilege 1848 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe 1848 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ir_agent.exe"C:\Users\Admin\AppData\Local\Temp\ir_agent.exe"1⤵PID:2788
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1848