Analysis
-
max time kernel
56s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-11-2020 19:21
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Heur.18131.22752.pps
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Heur.18131.22752.pps
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Heur.18131.22752.pps
-
Size
75KB
-
MD5
c58976da0ef0f00fa982bc6ce01809c0
-
SHA1
e97289611ed14768b9875c3425f2a4a25b19b7cd
-
SHA256
0d838d8636a88e63e0a6ed863f1bc32e5a95d8b835cc509a497dfb15fd540f82
-
SHA512
2702e4adb072e0de3ab7c890c2152d6a5644531f53c1cc7c51442439c59f381b8a733966b3ad31087a20285bd9c6e8d8b633f0c0bbf5dbbfc04ce58f85b1160f
Score
1/10
Malware Config
Signatures
-
Processes:
POWERPNT.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 2012 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 2012 wrote to memory of 832 2012 POWERPNT.EXE splwow64.exe PID 2012 wrote to memory of 832 2012 POWERPNT.EXE splwow64.exe PID 2012 wrote to memory of 832 2012 POWERPNT.EXE splwow64.exe PID 2012 wrote to memory of 832 2012 POWERPNT.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.18131.22752.pps"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-0-0x0000000000000000-mapping.dmp