ATP Malware Behavior and Actions

Last updated
Save as PDF

Each ATP report captures the observed behavior of the analyzed file across static, AI/ML, multi-AV, and dynamic sandbox analysis. The sections below describe what malware actions and behaviors are documented.

ATP Report Sections and What They Capture

Section	What It Documents
Sample Identification	Filename, file size, file hash (e.g., MD5, SHA1, SHA25).
Verdict Scores	AI/ML score, Static verdict, MultiAV verdict, Dynamic Analysis (sandbox) score with a verdict of CLEAN / SUSPICIOUS / MALICIOUS).
MITRE ATT&CK Matrix	Detected tactics and techniques with a detection count per technique across the following: Initial access Execution Persistence Privilege escalation Defense evasion Credential access Discovery Lateral movement Collection, exfiltration Command and control Network effects Remote service effects and impact ATP automatically pre-maps its detections onto this framework, so each entry in the MITRE ATT&CK Matrix is part of a fingerprint of the attack that security teams can use for attribution to known adversaries, incident response, and reconstructing the full attack chain, even for samples that were blocked before completing their objective. This is not available for every verdict, but for most malicious/suspicious verdicts when available.
Risk Summary	Named behavior categories flagged for the sample, for example: Spreading Networking Persistence and installation behavior Data obfuscation, hooking and techniques for hiding and protection Malware analysis system evasion Anti-debugging Cryptography Software vulnerabilities Stealing of sensitive information Bitcoin miner
AV Engines Scan Summary	Per-engine verdict, including the specific malware family/classification name where an engine flags the file (for example, a named trojan, dropper, RAT, or ransomware family).
Behavior Analysis—System Startup Process	The process tree generated when the sample runs: parent and child processes, process ID (PID), full command line, and MD5 of each spawned binary. Note: For file types, the sandbox does not execute natively (see section on Cross-platform coverage); this section may be sparse or show only a generic host process.
URL Analysis	Every URL found in the sample's static content or contacted during dynamic execution, tagged with the source (the file itself, or a specific process/memory region).
IP Analysis	IP addresses contacted during execution, tagged by source process.
Domains Analysis	Domains extracted from the sample or observed during execution.
Static File Info	File type, entropy, TrID file-type identification, and fuzzy hashes (ssdeep, TLSH).

Documented Malware Actions by Category

Process Execution and Abuse of Legitimate Applications

Versa ATP identifies which application is used to open or execute the malicious file, and any further processes that application spawns. Each entry includes the PID, full command line, and the MD5 of the spawned binary. Examples:

WINWORD.EXE launching WaaSMedicAgent.exe—A legitimate Windows Update Medic Service binary (C:\Windows\System32\WaaSMedicAgent.exe) seen consistently across several malicious .doc/.rtf samples that exploits Office equation-editor/OLE vulnerabilities (CVE-2017-11882, CVE-2017-0199). These samples' MITRE matrices also flag process injection, masquerading, and virtualization/sandbox evasion for the sample as a whole.
EXCEL.EXE launching chrome.exe with a URL hardcoded by the macro (for example, a defense-industry-themed lure page), so the visible browser tab acts as a decoy while the macro's dropper logic runs in the background.
A PowerPoint add-in (.ppam, opened via POWERPNT.EXE) launching a cmd.exe, which in some samples goes on to spawn WaaSMedicAgent.exe as well, which is the same masquerading technique reached through a different Office host application.
A Windows Installer package (msiexec.exe) re-invoking itself with additional flags—The initial client call (msiexec.exe /i "<path>") hands off to a second msiexec.exe /V instance (same binary MD5, different PID), which is the persistent installer-engine process. One sample additionally shows this engine process side-loading WaaSMedicAgent.exe.
A JavaScript or VBScript file executed via wscript.exe (Windows Script Host), which in turn spawns cmd.exe and then curl.exe/PING.EXE to stage a second-stage payload from a hardcoded IP. For example, downloading a .sct scriptlet for execution via rundll32, or downloading an AutoIt3 interpreter plus a .au3 script and running it.
cmd.exe running an obfuscated PowerShell download cradle— A batch file builds a heavily obfuscated IEX (New-Object Net.WebClient).DownloadString(...) command (using techniques like backtick-character injection and piecemeal variable concatenation to evade static signatures) and launches powershell.exe -nop -win 1 to execute it.

Cross-Platform Coverage through AIML, Static and AV Analysis

For file types outside the dynamic sandbox's native execution scope—such as .sh scripts and Android .apk packages—ATP still delivers a verdict by drawing on its rich set of AI/ML models per file type (40+ and increasing), static and multi-AV analysis layers. A .sh file is opened for inspection (via Code.exe) and its embedded URLs, IPs, and commands are extracted directly from the script content, surfacing malicious indicators (for example, botnet download URLs or C2 domains) without needing native shell execution. Similarly, .apk files are processed through the Windows file-association handler while static analysis and AV engine classification (for example, flagging Android banking trojans) drive the verdict. This means Linux and Android samples get meaningful threat detection from ATP's static/AV pipeline even when the file type falls outside the sandbox's native runtime. Note that for these file types, the report's process tree will be minimal or generic, and the verdict reflects static/AV findings rather than an observed dynamic execution chain.

Network Communication with Untrusted Infrastructure

URL analysis, IP analysis, and domains analysis sections isolate network destinations contacted by the sample, tagged with their source (the originating file or process) to distinguish them from background/legitimate traffic generated by the sandbox environment itself. Observed patterns include:

Repeated Autodiscover requests across multiple TLDs—Excel macro documents making Autodiscover.xml requests to a long list of country-code and generic TLDs (.uk, .in, .it, .fr, .es, .com.cn, .com.br, .xyz, .sg, .online), generated via an abused Outlook/Excel rules file (excel.exe_Rules.xml)—a known Outlook-rule-abuse reconnaissance pattern, separate from any lure content in the document.
Live C2 and downloader infrastructure—For example, a Word-document downloader calling out to a set of .ru/generic-TLD domains to fetch a next-stage payload, and script samples fetching second-stage binaries from hardcoded IP addresses.
Lure/decoy domains embedded in document content and opened as a distraction (for example, a defense-industry-conference-themed URL opened via chrome.exe), distinct from the document's actual malicious network activity.
Spearphishing links in standalone PDF lures—PDF samples with no executable payload and no runtime process activity, but containing social-engineering text (fake wire-transfer confirmations, fake nonprofit donation pages) and an embedded malicious link, flagged via the MITRE Spearphishing Link technique and surfaced under static file information even though the sandbox shows no process tree for these samples.

Persistence and Privilege Behavior

The MITRE ATT&CK Matrix and Risk Summary flag persistence mechanisms (for example, Registry Run Keys / Startup Folder, or cron-based persistence on Linux samples), privilege escalation techniques (for example, Process Injection), and credential access attempts (for example, OS Credential Dumping, LSASS Memory access, or a Python-based credential-dumping tool flagged by AV as a Pwdump-family tool) when present in the sample.

Defense Evasion and Anti-Analysis Behavior

Reports flag evasion techniques including masquerading (disguising a malicious process as a legitimate one), virtualization/sandbox evasion, obfuscated or deobfuscatedfiles/information, and anti-debugging behavior, each with a detection count tied to the MITRE matrix. Obfuscation shows up in varied concrete forms across samples—case-randomized commands, backtick-character injection inside interpreter keywords, junk-token interleaving in variable names, and piecemeal variable concatenation—all aimed at evading static signature matching while remaining functionally valid to the interpreter. ISO-delivery samples have also been observed staging a payload via a PowerShell execution-policy bypass (-ExecutionPolicy bypass) combined with Mount-DiskImage.

Malware Family Attribution

The AV Engines Scan Summary reports a named classification from each detecting engine, giving analysts attribution context in addition to the raw behavioral data. Families observed across the sample set include Office macro downloaders (Donoff), an APT-linked macro dropper (Gamaredon), an HTML-smuggling dropper (Qakbot), a Java remote access trojan with live C2 (jRAT, calling back to jrat.io), a WannaCry/EternalBlue (CVE-2017-0147) ransomware sample, an Android banking trojan, and a Linux cryptomining worm (Rocke-family) that disables a cloud security agent and persists via cron.

File and Static Characteristics

Entropy, TrID classification, and fuzzy hashing (ssdeep, TLSH) are included to support similarity matching against other known samples, independent of the dynamic behavior observed. Report completeness varies by file type and by how the sandbox handles it—some samples produce a full process tree, MITRE matrix, and Risk Summary, while others (particularly very small or non-natively-executed files) show only Sample Identification and an AV Engines Scan Summary.