bc692c42c9c300e9ea559d6cdd74239d85339b60918b1c712db7078c1298421a

General

Target

Request for Quotation via ShipServ 7465649870 RFQ).ppt
Size

66KB
MD5

e4405847f94ce7a7ff1cf42754030467
SHA1

3c183881bab3a09576a24da6c6aceaf106e97f1b
SHA256

bc692c42c9c300e9ea559d6cdd74239d85339b60918b1c712db7078c1298421a
SHA512

cf8f7b945ae3df26e929cb28c1eeb0e3dd27620dd92c4c8749e2d18a226bcda6540ce36fcedd02c4f0d0333e5129b66d12e86b8a8d7298662d6b2dc3c027c6b9

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 16 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	584	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1416	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1508	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1808	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1796	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1748	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1700	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1424	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	240	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	384	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1836	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1880	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1480	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	600	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1400	1812	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	108	1812	ping.exe	POWERPNT.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

POWERPNT.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE

Modifies registry class 64 IoCs

Processes:

POWERPNT.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493492-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493498-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493499-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C3-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A57-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "ChartCharacters"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348D-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C8-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CB-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F7-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "ChartData"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6F-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493478-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493486-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EA-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EF-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6B-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6B-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345B-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493491-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493498-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A67-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6C-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493462-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493483-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CE-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DA-5A91-11CF-8700-00AA0060263B}\ = "DiagramNodes"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A53-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6A-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6E-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348E-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493494-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C9-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F6-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A53-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A56-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493465-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346C-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493489-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493496-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C6-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DB-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493470-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493451-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493481-5A91-11CF-8700-00AA0060263B}\ = "ConnectorFormat"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E553-4FF5-48F4-8215-5505F990966F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D9-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DC-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E555-4FF5-48F4-8215-5505F990966F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347F-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C3-5A91-11CF-8700-00AA0060263B}\ = "Table"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C6-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A61-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A65-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345B-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348A-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EC-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5F-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "ChartTitle"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E558-4FF5-48F4-8215-5505F990966F}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348F-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE

Runs ping.exe 1 TTPs 16 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1836	ping.exe
108	ping.exe
1416	ping.exe
1508	ping.exe
1796	ping.exe
1880	ping.exe
600	ping.exe
584	ping.exe
1808	ping.exe
1748	ping.exe
1424	ping.exe
240	ping.exe
1480	ping.exe
1400	ping.exe
1700	ping.exe
384	ping.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

1812 POWERPNT.EXE

pid	process
1812	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

POWERPNT.EXE

description	pid	process	target process
PID 1812 wrote to memory of 1988	1812	POWERPNT.EXE	splwow64.exe
PID 1812 wrote to memory of 1988	1812	POWERPNT.EXE	splwow64.exe
PID 1812 wrote to memory of 1988	1812	POWERPNT.EXE	splwow64.exe
PID 1812 wrote to memory of 1988	1812	POWERPNT.EXE	splwow64.exe
PID 1812 wrote to memory of 584	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 584	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 584	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 584	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1508	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1508	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1508	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1508	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1416	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1416	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1416	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1416	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1808	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1808	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1808	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1808	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1748	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1748	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1748	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1748	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1796	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1796	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1796	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1796	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1700	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1700	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1700	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1700	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1424	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1424	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1424	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1424	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 240	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 240	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 240	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 240	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 384	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 384	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 384	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 384	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1836	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1836	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1836	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1836	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1880	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1880	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1880	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1880	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1480	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1480	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1480	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1480	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 600	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 600	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 600	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 600	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1400	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1400	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1400	1812	POWERPNT.EXE	ping.exe
PID 1812 wrote to memory of 1400	1812	POWERPNT.EXE	ping.exe

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation via ShipServ 7465649870 RFQ).ppt"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1988

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:584

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1416

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1508

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1808

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1796

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1748

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1700

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1424

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:240

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:384

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1836

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1880

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1480

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:600

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1400

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:108

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-22-0x0000000000000000-mapping.dmp

Download
memory/240-15-0x0000000000000000-mapping.dmp

Download
memory/384-16-0x0000000000000000-mapping.dmp

Download
memory/584-7-0x0000000000000000-mapping.dmp

Download
memory/600-20-0x0000000000000000-mapping.dmp

Download
memory/1400-21-0x0000000000000000-mapping.dmp

Download
memory/1416-9-0x0000000000000000-mapping.dmp

Download
memory/1424-14-0x0000000000000000-mapping.dmp

Download
memory/1480-19-0x0000000000000000-mapping.dmp

Download
memory/1508-8-0x0000000000000000-mapping.dmp

Download
memory/1700-13-0x0000000000000000-mapping.dmp

Download
memory/1748-11-0x0000000000000000-mapping.dmp

Download
memory/1796-12-0x0000000000000000-mapping.dmp

Download
memory/1808-10-0x0000000000000000-mapping.dmp

Download
memory/1812-2-0x0000000073BA1000-0x0000000073BA5000-memory.dmp

Filesize
16KB

Download
memory/1812-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1812-3-0x0000000071241000-0x0000000071243000-memory.dmp

Filesize
8KB

Download
memory/1836-17-0x0000000000000000-mapping.dmp

Download
memory/1880-18-0x0000000000000000-mapping.dmp

Download
memory/1988-6-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmp

Filesize
8KB

Download
memory/1988-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads