Analysis
-
max time kernel
135s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-03-2021 19:53
Static task
static1
Behavioral task
behavioral1
Sample
New Purchase Order.ppt
Resource
win7v20201028
Behavioral task
behavioral2
Sample
New Purchase Order.ppt
Resource
win10v20201028
General
-
Target
New Purchase Order.ppt
-
Size
66KB
-
MD5
20884369d25aeb20f8a45c464cab0ff4
-
SHA1
c81fe784cb90f374d6790fad65a0144f9bfce85f
-
SHA256
0d8264e6c9f93db868184bedfd0c54b5ad4ab8dd81b90c2e2106da6c1e9a4d3b
-
SHA512
9a0779d95cbd8dcd73a827da6e3654b1a55508f4b6886e9cd7b5e628833b54bb5c147aa966d0afa39b8cd4fa47d9b4155be62e752aa331a5f872f67a82048c07
Malware Config
Signatures
-
Process spawned unexpected child process 16 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 1136 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3820 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3248 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 748 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 736 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3140 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2084 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 1228 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3928 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2668 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4100 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4156 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4248 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4200 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 2748 3564 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3156 3564 ping.exe POWERPNT.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
POWERPNT.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE -
Runs ping.exe 1 TTPs 16 IoCs
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exepid process 4156 ping.exe 4248 ping.exe 4200 ping.exe 2748 ping.exe 3820 ping.exe 2084 ping.exe 3928 ping.exe 2668 ping.exe 3156 ping.exe 748 ping.exe 736 ping.exe 4100 ping.exe 1136 ping.exe 3248 ping.exe 3140 ping.exe 1228 ping.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 3564 POWERPNT.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
POWERPNT.EXEpid process 3564 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
POWERPNT.EXEpid process 3564 POWERPNT.EXE 3564 POWERPNT.EXE 3564 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 3564 wrote to memory of 1136 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 1136 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3156 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3156 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3820 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3820 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3248 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3248 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 748 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 748 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 736 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 736 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3140 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3140 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 2084 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 2084 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 1228 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 1228 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3928 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 3928 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 2748 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 2748 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 2668 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 2668 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4100 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4100 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4156 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4156 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4200 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4200 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4248 3564 POWERPNT.EXE ping.exe PID 3564 wrote to memory of 4248 3564 POWERPNT.EXE ping.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\New Purchase Order.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1136 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:3820 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:3248 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:748 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:736 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:3140 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:2084 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:1228 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:3928 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:2668 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:4100 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:4156 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:4248 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:4200 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:2748 -
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
PID:3156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/736-12-0x0000000000000000-mapping.dmp
-
memory/748-11-0x0000000000000000-mapping.dmp
-
memory/1136-7-0x0000000000000000-mapping.dmp
-
memory/1228-15-0x0000000000000000-mapping.dmp
-
memory/2084-14-0x0000000000000000-mapping.dmp
-
memory/2668-18-0x0000000000000000-mapping.dmp
-
memory/2748-17-0x0000000000000000-mapping.dmp
-
memory/3140-13-0x0000000000000000-mapping.dmp
-
memory/3156-8-0x0000000000000000-mapping.dmp
-
memory/3248-10-0x0000000000000000-mapping.dmp
-
memory/3564-2-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmpFilesize
64KB
-
memory/3564-6-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmpFilesize
64KB
-
memory/3564-5-0x00007FFC9FA70000-0x00007FFCA00A7000-memory.dmpFilesize
6.2MB
-
memory/3564-4-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmpFilesize
64KB
-
memory/3564-3-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmpFilesize
64KB
-
memory/3820-9-0x0000000000000000-mapping.dmp
-
memory/3928-16-0x0000000000000000-mapping.dmp
-
memory/4100-19-0x0000000000000000-mapping.dmp
-
memory/4156-20-0x0000000000000000-mapping.dmp
-
memory/4200-21-0x0000000000000000-mapping.dmp
-
memory/4248-22-0x0000000000000000-mapping.dmp