bc692c42c9c300e9ea559d6cdd74239d85339b60918b1c712db7078c1298421a

General

Target

Request for Quotation via ShipServ 7465649870 RFQ).ppt
Size

66KB
MD5

e4405847f94ce7a7ff1cf42754030467
SHA1

3c183881bab3a09576a24da6c6aceaf106e97f1b
SHA256

bc692c42c9c300e9ea559d6cdd74239d85339b60918b1c712db7078c1298421a
SHA512

cf8f7b945ae3df26e929cb28c1eeb0e3dd27620dd92c4c8749e2d18a226bcda6540ce36fcedd02c4f0d0333e5129b66d12e86b8a8d7298662d6b2dc3c027c6b9

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 16 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1348	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1592	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	292	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	520	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	296	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	980	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1116	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	340	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1532	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1668	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1188	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1724	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	676	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	540	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1892	776	ping.exe	POWERPNT.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	560	776	ping.exe	POWERPNT.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

POWERPNT.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE

Modifies registry class 64 IoCs

Processes:

POWERPNT.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F7-5A91-11CF-8700-00AA0060263B}\ = "Research"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A50-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493482-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493488-5A91-11CF-8700-00AA0060263B}\ = "OLEFormat"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EC-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EE-5A91-11CF-8700-00AA0060263B}\ = "Options"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F3-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493491-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493499-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E3-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F0-5A91-11CF-8700-00AA0060263B}\ = "FilterEffect"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A54-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6E-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Legend"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6F-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493477-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493479-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A52-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A54-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A60-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EC-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F9-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "DropLines"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493482-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A72-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E55A-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C5-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DD-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E2-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493455-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493459-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346A-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493481-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C4-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493450-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493486-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348B-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493491-5A91-11CF-8700-00AA0060263B}\ = "RulerLevels"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E9-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347E-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CE-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E556-4FF5-48F4-8215-5505F990966F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493494-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E2-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A7B-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\ = "SoundEffect"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E0-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F3-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A65-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345D-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D6-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EB-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E558-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347D-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493493-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C4-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346A-5A91-11CF-8700-00AA0060263B}\ = "_Slide"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EC-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A59-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493478-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349B-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE

Runs ping.exe 1 TTPs 16 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	process
1892	ping.exe
1348	ping.exe
292	ping.exe
520	ping.exe
1532	ping.exe
1724	ping.exe
1116	ping.exe
1188	ping.exe
980	ping.exe
676	ping.exe
560	ping.exe
1592	ping.exe
296	ping.exe
340	ping.exe
1668	ping.exe
540	ping.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

776 POWERPNT.EXE

pid	process
776	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

POWERPNT.EXE

description	pid	process	target process
PID 776 wrote to memory of 1196	776	POWERPNT.EXE	splwow64.exe
PID 776 wrote to memory of 1196	776	POWERPNT.EXE	splwow64.exe
PID 776 wrote to memory of 1196	776	POWERPNT.EXE	splwow64.exe
PID 776 wrote to memory of 1196	776	POWERPNT.EXE	splwow64.exe
PID 776 wrote to memory of 1348	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1348	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1348	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1348	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1592	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1592	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1592	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1592	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 292	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 292	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 292	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 292	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 520	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 520	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 520	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 520	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 296	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 296	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 296	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 296	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 980	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 980	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 980	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 980	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1116	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1116	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1116	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1116	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 340	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 340	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 340	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 340	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1532	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1532	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1532	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1532	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1188	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1188	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1188	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1188	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1668	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1668	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1668	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1668	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1724	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1724	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1724	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 1724	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 676	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 676	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 676	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 676	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 540	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 540	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 540	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 540	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 560	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 560	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 560	776	POWERPNT.EXE	ping.exe
PID 776 wrote to memory of 560	776	POWERPNT.EXE	ping.exe

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Request for Quotation via ShipServ 7465649870 RFQ).ppt"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1196

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1348

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1592

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:292

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:520

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:296

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:980

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1116

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:340

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1532

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1668

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1188

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1724

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:676

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:540

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1892

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
2⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:560

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-9-0x0000000000000000-mapping.dmp

Download
memory/296-11-0x0000000000000000-mapping.dmp

Download
memory/340-14-0x0000000000000000-mapping.dmp

Download
memory/520-10-0x0000000000000000-mapping.dmp

Download
memory/540-20-0x0000000000000000-mapping.dmp

Download
memory/560-21-0x0000000000000000-mapping.dmp

Download
memory/676-19-0x0000000000000000-mapping.dmp

Download
memory/776-3-0x0000000071371000-0x0000000071373000-memory.dmp

Filesize
8KB

Download
memory/776-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/776-2-0x0000000073CC1000-0x0000000073CC5000-memory.dmp

Filesize
16KB

Download
memory/980-12-0x0000000000000000-mapping.dmp

Download
memory/1116-13-0x0000000000000000-mapping.dmp

Download
memory/1188-16-0x0000000000000000-mapping.dmp

Download
memory/1196-6-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp

Filesize
8KB

Download
memory/1196-5-0x0000000000000000-mapping.dmp

Download
memory/1348-7-0x0000000000000000-mapping.dmp

Download
memory/1532-15-0x0000000000000000-mapping.dmp

Download
memory/1592-8-0x0000000000000000-mapping.dmp

Download
memory/1668-17-0x0000000000000000-mapping.dmp

Download
memory/1724-18-0x0000000000000000-mapping.dmp

Download
memory/1892-22-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads