Analysis
-
max time kernel
47s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 07:45
Behavioral task
behavioral1
Sample
d08608f55166b09ee456ae41b91c4a7c61c97e93bc6b73459abf2af1ba7c65b6.doc
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
d08608f55166b09ee456ae41b91c4a7c61c97e93bc6b73459abf2af1ba7c65b6.doc
Resource
win10v2004-20240508-en
General
-
Target
d08608f55166b09ee456ae41b91c4a7c61c97e93bc6b73459abf2af1ba7c65b6.doc
-
Size
89KB
-
MD5
9cfe249d2fdb722a8f31391c6b40df40
-
SHA1
52bde90ca7ff5a70e29b7fcc2bb69827ce024b16
-
SHA256
d08608f55166b09ee456ae41b91c4a7c61c97e93bc6b73459abf2af1ba7c65b6
-
SHA512
5e03b1514d1a8ad835c70a251bc44b91287ef0c222d77d5e015757bbc741588fc17a65f0cee48ffe3fe63fc39adec959bbf0a54d5e26908712a9b39c79f32fb3
-
SSDEEP
768:KG03gLqYrwYMRXDh+peBqr0WCTmHVxOBfPpTMJHJlyl68K:k3gLyYMRDh+peBk0WCTOxOBnpelyl6n
Malware Config
Extracted
metasploit
windows/download_exec
http://192.168.78.133:44444fengling
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;NLNL)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3080 2244 rundll32.exe WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2244 WINWORD.EXE 2244 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
WINWORD.EXEpid process 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE 2244 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe PID 2244 wrote to memory of 3080 2244 WINWORD.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d08608f55166b09ee456ae41b91c4a7c61c97e93bc6b73459abf2af1ba7c65b6.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCD88C4.tmp\gb.xslFilesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
memory/2244-16-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-4-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmpFilesize
64KB
-
memory/2244-10-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-1-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmpFilesize
64KB
-
memory/2244-5-0x00007FFD6D2AD000-0x00007FFD6D2AE000-memory.dmpFilesize
4KB
-
memory/2244-6-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-9-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-8-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-7-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-12-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-11-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-13-0x00007FFD2B000000-0x00007FFD2B010000-memory.dmpFilesize
64KB
-
memory/2244-14-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-0-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmpFilesize
64KB
-
memory/2244-530-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-3-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmpFilesize
64KB
-
memory/2244-17-0x00007FFD2B000000-0x00007FFD2B010000-memory.dmpFilesize
64KB
-
memory/2244-15-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-36-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-34-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-37-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-38-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-527-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-35-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-48-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/2244-2-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmpFilesize
64KB
-
memory/2244-508-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/3080-39-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/3080-529-0x00007FFD6D210000-0x00007FFD6D405000-memory.dmpFilesize
2.0MB
-
memory/3080-33-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB