Analysis
- max time kernel
92s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
19/06/2024, 09:50
General
- Target Счёт на оплату.docm
- Size 33KB
- Sample240619-lt5fbasfnn
- SHA256 3e7e321ca46b1337d69b9d39ad4dc1b268abb33c9331c06ad07fbb93f29fab89
Malware Config
Extracted
-
metasploit
-
windows/reverse_http
-
http://8.8.8.8:5555/zSE9R66S0rraBdsEuVDCbAcHm4d4HwfrCxUPZVx9puos4rwEtJYcq6pkDktx6eSFYy7kU5oq35RNY-dTUHVT8PkQK697FEhhVal855uLYDsu7kkGa5HPh-A_RSCMYlNagTI5RlAPwzzT3itpLVl0bgaf6gwEd8aYdSKGaoH77_3vcEsKMQlq6uuEh7qF8nE
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Счёт на оплату.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 45802⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 45803⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3800-42-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/3800-56-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/3800-57-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/3800-55-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/3800-59-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/3800-58-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/3800-41-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-0-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/4932-34-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-10-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-9-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-12-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-13-0x00007FFB7B850000-0x00007FFB7B860000-memory.dmp
memory/4932-11-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-14-0x00007FFB7B850000-0x00007FFB7B860000-memory.dmp
memory/4932-35-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-7-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-33-0x00000248C4EC0000-0x00000248C4EC1000-memory.dmp
memory/4932-8-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-1-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/4932-3-0x00007FFBBDAAD000-0x00007FFBBDAAE000-memory.dmp
memory/4932-4-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/4932-6-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/4932-5-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp
memory/4932-2-0x00007FFB7DA90000-0x00007FFB7DAA0000-memory.dmp
memory/4932-61-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmp