RTF Doc. Uses CVE-2017-8759 Exploit to Execute Code | VMRay
| VTI by Category
Try VMRay Analyzer
|
VTI Score
96 / 100
|
|
| VTI Database Version | 2.6 |
| VTI Rule Match Count | 11 |
| VTI Rule Type | Documents |
|
Device |
|
|
|
Monitor keyboard input
|
|
|
Frequently read the state of a keyboard key by API.
|
||
|
|
Network |
|
|
|
Download data
|
|
|
URL "www.samyrai777m.p-host.in/t/tp.php?thread=0".
|
||
|
|
Perform DNS request
|
|
|
Resolve host name "www.samyrai777m.p-host.in".
|
||
|
|
Connect to remote host
|
|
|
Outgoing TCP connection to host "185.211.244.133:80".
|
||
|
|
Connect to HTTP server
|
|
|
URL "www.samyrai777m.p-host.in/t/tp.php?thread=0".
|
||
|
|
Process |
|
|
|
Create process
|
|
|
Create process ""C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\aETAdzjz\AppData\Local\Temp\91rxrejg.cmdline"".
|
||
|
Create process "C:\Windows\System32\mshta.exe".
|
||
|
Create process "C:\Windows\SYSteM32\windowspOweRSHeLL\V1.0\PoWErSHELL.Exe".
|
||
|
Create process ""C:\Windows\system32\taskkill.exe" /f /im winword.exe".
|
||
|
|
Execute encoded PowerShell script
|
|
|
Execute encoded PowerShell script to possibly hide malicious payload.
|
||
|
|
Create system object
|
|
|
Create mutex with name "Global\.net clr networking".
|
||
|
Create mutex with name "Local\!PrivacIE!SharedMemory!Mutex".
|
||
| - | Anti Analysis | |
| - | Browser | |
| - | OS | |
| - | File System | |
| - | Hide Tracks | |
| - | Information Stealing | |
| - | Injection | |
| - | Kernel | |
| - | Masquerade | |
| - | PE | |
| - | Persistence | |
| - | User | |
| - | VBA Macro | |
| - | YARA | |
