Analysis
-
max time kernel
136s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 01:22
Static task
static1
Behavioral task
behavioral1
Sample
New Purchase Order.ppt
Resource
win7v20201028
Behavioral task
behavioral2
Sample
New Purchase Order.ppt
Resource
win10v20201028
General
-
Target
New Purchase Order.ppt
-
Size
66KB
-
MD5
20884369d25aeb20f8a45c464cab0ff4
-
SHA1
c81fe784cb90f374d6790fad65a0144f9bfce85f
-
SHA256
0d8264e6c9f93db868184bedfd0c54b5ad4ab8dd81b90c2e2106da6c1e9a4d3b
-
SHA512
9a0779d95cbd8dcd73a827da6e3654b1a55508f4b6886e9cd7b5e628833b54bb5c147aa966d0afa39b8cd4fa47d9b4155be62e752aa331a5f872f67a82048c07
Malware Config
Signatures
-
Process spawned unexpected child process 16 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2840 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2856 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 192 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2788 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3648 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2276 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2416 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3972 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2128 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2148 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 768 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3668 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2300 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4160 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4200 804 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4100 804 ping.exe POWERPNT.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
Runs ping.exe 1 TTPs 16 IoCs
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exepid process 3648 ping.exe 768 ping.exe 4200 ping.exe 2840 ping.exe 2788 ping.exe 2416 ping.exe 2276 ping.exe 2128 ping.exe 2148 ping.exe 2300 ping.exe 4160 ping.exe 2856 ping.exe 192 ping.exe 3972 ping.exe 3668 ping.exe 4100 ping.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 804 POWERPNT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
POWERPNT.EXEpid process 804 POWERPNT.EXE 804 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
POWERPNT.EXEpid process 804 POWERPNT.EXE 804 POWERPNT.EXE 804 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 804 wrote to memory of 2840 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2840 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2856 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2856 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2788 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2788 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 192 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 192 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 3648 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 3648 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2276 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2276 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2416 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2416 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 3972 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 3972 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2128 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2128 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2148 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2148 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 768 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 768 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 3668 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 3668 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2300 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 2300 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 4100 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 4100 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 4160 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 4160 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 4200 804 POWERPNT.EXE ping.exe PID 804 wrote to memory of 4200 804 POWERPNT.EXE ping.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\New Purchase Order.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/192-10-0x0000000000000000-mapping.dmp
-
memory/768-17-0x0000000000000000-mapping.dmp
-
memory/804-3-0x00007FFA0DCD0000-0x00007FFA0DCE0000-memory.dmpFilesize
64KB
-
memory/804-4-0x00007FFA0DCD0000-0x00007FFA0DCE0000-memory.dmpFilesize
64KB
-
memory/804-5-0x00007FFA302E0000-0x00007FFA30917000-memory.dmpFilesize
6.2MB
-
memory/804-6-0x00007FFA0DCD0000-0x00007FFA0DCE0000-memory.dmpFilesize
64KB
-
memory/804-2-0x00007FFA0DCD0000-0x00007FFA0DCE0000-memory.dmpFilesize
64KB
-
memory/2128-15-0x0000000000000000-mapping.dmp
-
memory/2148-16-0x0000000000000000-mapping.dmp
-
memory/2276-12-0x0000000000000000-mapping.dmp
-
memory/2300-19-0x0000000000000000-mapping.dmp
-
memory/2416-13-0x0000000000000000-mapping.dmp
-
memory/2788-9-0x0000000000000000-mapping.dmp
-
memory/2840-7-0x0000000000000000-mapping.dmp
-
memory/2856-8-0x0000000000000000-mapping.dmp
-
memory/3648-11-0x0000000000000000-mapping.dmp
-
memory/3668-18-0x0000000000000000-mapping.dmp
-
memory/3972-14-0x0000000000000000-mapping.dmp
-
memory/4100-20-0x0000000000000000-mapping.dmp
-
memory/4160-21-0x0000000000000000-mapping.dmp
-
memory/4200-22-0x0000000000000000-mapping.dmp