Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 02:21
Behavioral task
behavioral1
Sample
nothingtoseehere.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
nothingtoseehere.exe
Resource
win10v2004-20240426-en
General
-
Target
nothingtoseehere.exe
-
Size
72KB
-
MD5
883b42bdb6847931b31aa465d0149635
-
SHA1
f6a8af6b1c498d19cccc7e2fe535d69ae81267c3
-
SHA256
07e19ef7c68d476ffdb47c77c236fc08eaacbe58aa51d8da417f14563a8e255c
-
SHA512
704351334493e88bf65f2f7ffd9c3f0590499182e7f2bbf557ea4c5130dd9e457999074d2a300fe7f5e09df81fa6f084577be4f12499f35b27474ee36f93b121
-
SSDEEP
1536:I20I2yXSDTVGDbgP4f0PWaKsEMb+KR0Nc8QsJq39:jlXSDTVDP+FaKsEe0Nc8QsC9
Malware Config
Extracted
metasploit
windows/reverse_tcp
192.168.44.55:4455
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2228 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\nothingtoseehere.exe"C:\Users\Admin\AppData\Local\Temp\nothingtoseehere.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\WaitStop.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
253B
MD5ac1b3890d9c60296a3bebadc5510fdd1
SHA1a99e6dbcf4dba237ce0c79637115658b98dc0dca
SHA256803a7075228f44e5093455114780557007014c1d113f08520a6d94c83a10251c
SHA5126e29090effc7ee42ddc25a9a0f7366a77a947ab2f1fffda69999548a484ea182aa9e3c272801d6b3a3ceb7f5ca7a790b256c7603cf9535742fdb9162a0e0813f
-
memory/2228-22-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-5-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-20-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-3-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-23-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-10-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-13-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-12-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-14-0x00007FFF60790000-0x00007FFF607A0000-memory.dmpFilesize
64KB
-
memory/2228-11-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-9-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-21-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-17-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-62-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-4-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-1-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-15-0x00007FFF60790000-0x00007FFF607A0000-memory.dmpFilesize
64KB
-
memory/2228-18-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-19-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-16-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-8-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-7-0x00007FFFA2770000-0x00007FFFA2965000-memory.dmpFilesize
2.0MB
-
memory/2228-6-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-2-0x00007FFFA280D000-0x00007FFFA280E000-memory.dmpFilesize
4KB
-
memory/2228-58-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-61-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-60-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/2228-59-0x00007FFF627F0000-0x00007FFF62800000-memory.dmpFilesize
64KB
-
memory/5008-0-0x0000000000450000-0x0000000000451000-memory.dmpFilesize
4KB