metasploit | aa148483dfb6570d166b18430f7a1e6b0496ef687589b38ba5ab1b2b5bdff682

General

Target

3f717df21dee2bd51394424c8be036fe.doc
Size

365KB
MD5

3f717df21dee2bd51394424c8be036fe
SHA1

d20436e843e4159f29737fab5e812406eb6512d4
SHA256

aa148483dfb6570d166b18430f7a1e6b0496ef687589b38ba5ab1b2b5bdff682
SHA512

f79b8d1f53b243929fa307560aa605d522c5c71c606166557cd9bf095c8393c188bab9aaaff38456552e8a9b08457c36ca522369f40e2ccc097e86ee369ecad9

Score

10^/10

metasploit backdoor trojan

Malware Config

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2792	1628	powershell.exe	WINWORD.EXE

Executes dropped EXE 1 IoCs

Processes:

803d76071.exe

pid process

2580 803d76071.exe

pid	process
2580	803d76071.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1628 WINWORD.EXE
1628 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2792 powershell.exe
2792 powershell.exe
2792 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2792 powershell.exe

pid	process
2792	powershell.exe
2792	powershell.exe
2792	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2792	powershell.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

WINWORD.EXE

pid	process
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE
1628	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXEpowershell.exe

description	pid	process	target process
PID 1628 wrote to memory of 2792	1628	WINWORD.EXE	powershell.exe
PID 1628 wrote to memory of 2792	1628	WINWORD.EXE	powershell.exe
PID 2792 wrote to memory of 2580	2792	powershell.exe	803d76071.exe
PID 2792 wrote to memory of 2580	2792	powershell.exe	803d76071.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3f717df21dee2bd51394424c8be036fe.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -noexit -ep bypass -c .\aaa.ps1
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\programdata\803d76071.exe
"C:\programdata\803d76071.exe"
3⤵
- Executes dropped EXE
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
C:\programdata\803d76071.aaa
MD5
2bb165a96a9d2e77aa202b9ed6f30c48

SHA1
7120be00500f70ebceb9e24cdc692d390054a9e5

SHA256
bae2b1fe61602413ca6b39f7f8f35fcfcdd593c976f246942143313527dfe27f

SHA512
ba4a1c6360de1fdda0ae17afe7f441140620c7569842fdf407f9126e268dd436d478670d901648e2969b7fefaff9f15c0e4f4bd0ac282bc59871a8ebb1507567

Download Submit
C:\programdata\803d76071.exe
MD5
bef2bcb61c1fa9af265659c4123c11ac

SHA1
76993db88b0f0c3ed6252b114636cf39a30220d6

SHA256
14dce17f99955f86b05970aa13e35680e879aaa190e598bdcdc4dbf54ee90734

SHA512
9072c3eb4f1ef3a8f15807db618af9180dd0b02bfaa9c0fc2191f9ec548f1e8ea837f14aeedda30e95781a5935e134f8ee40aa5c4ff0df5a32a0382ebc6af7eb

Download Submit
C:\programdata\aaa.ps1
MD5
810a730741e2488360ec31da9103fe9c

SHA1
906010043149b15f38f40f8c98ef9e679a56b43a

SHA256
412a5f3572bfa31a27749c54b12c26302d75acfc2630c8627c9488b706e5327e

SHA512
125b5e8d34de6b6f3219ce89951570672857be92af8b8127344c0bdb1b1a5e8afa937cfc1e5e7e82772484d258214ae5e8a4f049d4dd5242d039995b71238c69

Download Submit
memory/1628-4-0x000002BD2C7BE000-0x000002BD2C7C3000-memory.dmp

Filesize
20KB

Download
memory/1628-3-0x000002BD2C7BC000-0x000002BD2C7BE000-memory.dmp

Filesize
8KB

Download
memory/1628-5-0x000002BD2C7BE000-0x000002BD2C7C3000-memory.dmp

Filesize
20KB

Download
memory/1628-6-0x000002BD2C7BE000-0x000002BD2C7C3000-memory.dmp

Filesize
20KB

Download
memory/1628-2-0x00007FF81BC20000-0x00007FF81C257000-memory.dmp

Filesize
6.2MB

Download
memory/2580-15-0x0000000000000000-mapping.dmp

Download
memory/2580-18-0x00000000006B0000-0x00000000006B2000-memory.dmp

Filesize
8KB

Download
memory/2792-12-0x000001FB350E0000-0x000001FB350E1000-memory.dmp

Filesize
4KB

Download
memory/2792-11-0x000001FB34CD0000-0x000001FB34CD1000-memory.dmp

Filesize
4KB

Download
memory/2792-10-0x000001FB1CA10000-0x000001FB1CA11000-memory.dmp

Filesize
4KB

Download
memory/2792-9-0x00007FF815430000-0x00007FF815E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads