Analysis
-
max time kernel
138s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 01:22
Static task
static1
Behavioral task
behavioral1
Sample
Request for Quotation via ShipServ 7465649870 RFQ).ppt
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Request for Quotation via ShipServ 7465649870 RFQ).ppt
Resource
win10v20201028
General
-
Target
Request for Quotation via ShipServ 7465649870 RFQ).ppt
-
Size
66KB
-
MD5
e4405847f94ce7a7ff1cf42754030467
-
SHA1
3c183881bab3a09576a24da6c6aceaf106e97f1b
-
SHA256
bc692c42c9c300e9ea559d6cdd74239d85339b60918b1c712db7078c1298421a
-
SHA512
cf8f7b945ae3df26e929cb28c1eeb0e3dd27620dd92c4c8749e2d18a226bcda6540ce36fcedd02c4f0d0333e5129b66d12e86b8a8d7298662d6b2dc3c027c6b9
Malware Config
Signatures
-
Process spawned unexpected child process 16 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 916 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 204 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3792 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 500 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2228 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3564 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 428 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3552 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3496 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2176 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3796 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 1188 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2216 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3704 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2168 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3904 496 ping.exe POWERPNT.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
Runs ping.exe 1 TTPs 16 IoCs
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exepid process 2228 ping.exe 3552 ping.exe 3704 ping.exe 3904 ping.exe 916 ping.exe 428 ping.exe 2168 ping.exe 204 ping.exe 3792 ping.exe 500 ping.exe 3796 ping.exe 2216 ping.exe 3564 ping.exe 3496 ping.exe 2176 ping.exe 1188 ping.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 496 POWERPNT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
POWERPNT.EXEpid process 496 POWERPNT.EXE 496 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
POWERPNT.EXEpid process 496 POWERPNT.EXE 496 POWERPNT.EXE 496 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 496 wrote to memory of 916 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 916 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3792 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3792 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 204 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 204 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 500 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 500 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2228 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2228 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 428 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 428 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3564 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3564 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3552 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3552 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3496 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3496 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2176 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2176 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3796 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3796 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 1188 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 1188 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2168 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2168 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3704 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3704 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2216 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 2216 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3904 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3904 496 POWERPNT.EXE ping.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation via ShipServ 7465649870 RFQ).ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-9-0x0000000000000000-mapping.dmp
-
memory/428-12-0x0000000000000000-mapping.dmp
-
memory/496-3-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmpFilesize
64KB
-
memory/496-4-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmpFilesize
64KB
-
memory/496-5-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmpFilesize
64KB
-
memory/496-6-0x00007FF9E4FA0000-0x00007FF9E55D7000-memory.dmpFilesize
6.2MB
-
memory/496-2-0x00007FF9C2D80000-0x00007FF9C2D90000-memory.dmpFilesize
64KB
-
memory/500-10-0x0000000000000000-mapping.dmp
-
memory/916-7-0x0000000000000000-mapping.dmp
-
memory/1188-18-0x0000000000000000-mapping.dmp
-
memory/2168-19-0x0000000000000000-mapping.dmp
-
memory/2176-16-0x0000000000000000-mapping.dmp
-
memory/2216-21-0x0000000000000000-mapping.dmp
-
memory/2228-11-0x0000000000000000-mapping.dmp
-
memory/3496-15-0x0000000000000000-mapping.dmp
-
memory/3552-14-0x0000000000000000-mapping.dmp
-
memory/3564-13-0x0000000000000000-mapping.dmp
-
memory/3704-20-0x0000000000000000-mapping.dmp
-
memory/3792-8-0x0000000000000000-mapping.dmp
-
memory/3796-17-0x0000000000000000-mapping.dmp
-
memory/3904-22-0x0000000000000000-mapping.dmp