metasploit | 70d44165f308acccfa77bfb60a7592fdd38c03e2a403745effec31e3fffdc3e4

General

Target

56cbbea8535c0e8ae967fcdec17db491_JaffaCakes118.doc
Size

6.4MB
MD5

56cbbea8535c0e8ae967fcdec17db491
SHA1

2829de0b258610b9e3279343661700ca16694a45
SHA256

70d44165f308acccfa77bfb60a7592fdd38c03e2a403745effec31e3fffdc3e4
SHA512

ed21ed9c5bb9db184a11167bf4452e63e434076d34522f36a2fc251805fae288aa3a25e515adef630636ab12bd865d110f9c60d08b09cc104aae65a84e9be7bd
SSDEEP

24576:nJBLCi8+IgnJMjDH9ZwiLC4JgGrM7vqNYeYwIstYXTLgQQ5MDcLQUrO/Z1WQ0mtD:JBLCph6rRDp72DwnH

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://193.70.125.186:443/PTbV

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhostdwm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\memdefrag.exe"	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

700 WINWORD.EXE
700 WINWORD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

WINWORD.EXE

pid	process
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE
700	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 700 wrote to memory of 5056	700	WINWORD.EXE	splwow64.exe
PID 700 wrote to memory of 5056	700	WINWORD.EXE	splwow64.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\56cbbea8535c0e8ae967fcdec17db491_JaffaCakes118.doc" /o ""
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:5056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-0-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/700-2-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-1-0x00007FFEE23ED000-0x00007FFEE23EE000-memory.dmp

Filesize
4KB

Download
memory/700-4-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/700-6-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/700-5-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/700-3-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/700-7-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-8-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-11-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-10-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-9-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-13-0x00007FFEA0370000-0x00007FFEA0380000-memory.dmp

Filesize
64KB

Download
memory/700-15-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-16-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-17-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-14-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-12-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-18-0x00007FFEA0370000-0x00007FFEA0380000-memory.dmp

Filesize
64KB

Download
memory/700-41-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-307-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-9927-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-12273-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-12265-0x00007FFEE23ED000-0x00007FFEE23EE000-memory.dmp

Filesize
4KB

Download
memory/700-14463-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-16199-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-18044-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/700-45017-0x0000022E40DA0000-0x0000022E40E49000-memory.dmp

Filesize
676KB

Download
memory/700-45019-0x0000022E44190000-0x0000022E4422B000-memory.dmp

Filesize
620KB

Download
memory/700-45018-0x0000022E440F0000-0x0000022E44185000-memory.dmp

Filesize
596KB

Download
memory/700-45024-0x0000022E3A7A0000-0x0000022E3A7A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads