Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2022 19:23
Static task
static1
Behavioral task
behavioral1
Sample
download.docm
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
download.docm
Resource
win10v2004-20220812-en
General
-
Target
download.docm
-
Size
83KB
-
MD5
5d8895658f591ef763911318426625b5
-
SHA1
70ec05bc05d088ea80c1cca506de8c7a32b6ccf3
-
SHA256
cce9741afca6a6094f337f53fd404f662561f4e1eae6ae18928ef18060edf559
-
SHA512
5095c62bc1687443c55d820aeb2fab5099ee7f7d1d2a08dd1583d2276a4beca96f5fb2b6b52b06e01ca47814818e81bb93fd517cf5ec92abc0f323aee7e8583f
-
SSDEEP
1536:Yl+WqQuctgdemxX7vORvXgCwofTAgGJlQLU3mNIVq4l4ovyi2OXClu:++X8YVLvQgFCxYQLYI4l4PbOC4
Malware Config
Extracted
metasploit
windows/reverse_http
http://sscweb.dyndns.info:1234/k3BFpJvgrTbNuMy5r0LLZQKYQ85t88utddGXU9Y3pPMQ84CRtCb-Bum5C-BsPXFQ5AGpb0qLTqjMHYVReIH7ZpvDcVKnMUslD20Zox30dXFPeth
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 1 IoCs
Processes:
rad2F03E.tmp.exepid process 4844 rad2F03E.tmp.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4712 WINWORD.EXE 4712 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
WINWORD.EXEpid process 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE 4712 WINWORD.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4712 wrote to memory of 4844 4712 WINWORD.EXE rad2F03E.tmp.exe PID 4712 wrote to memory of 4844 4712 WINWORD.EXE rad2F03E.tmp.exe PID 4712 wrote to memory of 4844 4712 WINWORD.EXE rad2F03E.tmp.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\download.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rad2F03E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\rad2F03E.tmp.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rad2F03E.tmp.exeFilesize
72KB
MD51071a0c808bf42d8423b60e6ce537212
SHA14cb5248e83c88992ce91ee0b23b7aea011c134f1
SHA256336198c2e68eeb4d3ba11b8746d9714121a286ff6e409c29f0bcfe26bc0f05ac
SHA512ebd46999fe22044bd7e60b007a848c85c93e1c83481cde3089155802f7237969e72b063f38b92b1295effe304ce23db9be31e9d2140a830f817f9333c7b91960
-
C:\Users\Admin\AppData\Local\Temp\rad2F03E.tmp.exeFilesize
72KB
MD51071a0c808bf42d8423b60e6ce537212
SHA14cb5248e83c88992ce91ee0b23b7aea011c134f1
SHA256336198c2e68eeb4d3ba11b8746d9714121a286ff6e409c29f0bcfe26bc0f05ac
SHA512ebd46999fe22044bd7e60b007a848c85c93e1c83481cde3089155802f7237969e72b063f38b92b1295effe304ce23db9be31e9d2140a830f817f9333c7b91960
-
memory/4712-133-0x00007FFC3FC30000-0x00007FFC3FC40000-memory.dmpFilesize
64KB
-
memory/4712-134-0x00007FFC3FC30000-0x00007FFC3FC40000-memory.dmpFilesize
64KB
-
memory/4712-135-0x00007FFC3FC30000-0x00007FFC3FC40000-memory.dmpFilesize
64KB
-
memory/4712-136-0x00007FFC3FC30000-0x00007FFC3FC40000-memory.dmpFilesize
64KB
-
memory/4712-137-0x00007FFC3FC30000-0x00007FFC3FC40000-memory.dmpFilesize
64KB
-
memory/4712-138-0x00007FFC3D500000-0x00007FFC3D510000-memory.dmpFilesize
64KB
-
memory/4712-139-0x00007FFC3D500000-0x00007FFC3D510000-memory.dmpFilesize
64KB
-
memory/4844-140-0x0000000000000000-mapping.dmp