Analysis

  • max time kernel
    56s
  • max time network
    63s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 21:33

General

  • Target

    f450a953e6ece40fc0ae78bc361c0aaf54038690db22bdc2b8608a72e6466663.doc

  • Size

    36KB

  • MD5

    0e6e3300942d870111a63a58ec64fb46

  • SHA1

    3af3c237f928aae0c5af7aa130234f551c060e98

  • SHA256

    f450a953e6ece40fc0ae78bc361c0aaf54038690db22bdc2b8608a72e6466663

  • SHA512

    7afb7467b2a61ca8e545570e74caadd94ca0c42764b958664af6a245825d8dc787254867f5e6a3f6db9394369120bf5874382075418cc5d9f63883c586c94ba4

  • SSDEEP

    384:0iSsqdg1vA92TLVUG+PDA0jmH1HA/YFZDWutE/:M+1o98C0lg/YFZDW

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://192.168.45.208:443/i7icE0_nS8KkMqUzwk_20gv1OaXJpuIqVbVYm9SdUEDLP

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f450a953e6ece40fc0ae78bc361c0aaf54038690db22bdc2b8608a72e6466663.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:752
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2340

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/752-0-0x000000002F371000-0x000000002F372000-memory.dmp

      Filesize

      4KB

    • memory/752-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/752-2-0x000000007155D000-0x0000000071568000-memory.dmp

      Filesize

      44KB

    • memory/752-8-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-9-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-20-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-19-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-17-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-16-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-15-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-12-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-7-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-6-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-18-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-21-0x0000000002500000-0x0000000002501000-memory.dmp

      Filesize

      4KB

    • memory/752-27-0x000000007155D000-0x0000000071568000-memory.dmp

      Filesize

      44KB

    • memory/752-28-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/752-29-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB