Analysis
-
max time kernel
70s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-02-2021 19:31
Behavioral task
behavioral1
Sample
Video Drawing P.O.#4210020253.pps
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Video Drawing P.O.#4210020253.pps
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Video Drawing P.O.#4210020253.pps
-
Size
367KB
-
MD5
9ce5a1a804496ce739ecce3dcaaf21d1
-
SHA1
d1a695c3b9e4801bcb2b1cdc748cf6c800d41fa0
-
SHA256
82be061b2bfe48ee3a9f76ee99cf6f3ed712c0c1393ad4a9f064cfc4d11cb53d
-
SHA512
7ef0a0380f7baa72bbf6985b023b2346d6f8b1ea54d2e4dfb7da4ac0a9d0f3cdafb81e91eaa44c5568f6c1ca8f99abc13a1af8b082b158b04d6084fc3495daad
Score
1/10
Malware Config
Signatures
-
Processes:
POWERPNT.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 1068 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 1068 wrote to memory of 1224 1068 POWERPNT.EXE splwow64.exe PID 1068 wrote to memory of 1224 1068 POWERPNT.EXE splwow64.exe PID 1068 wrote to memory of 1224 1068 POWERPNT.EXE splwow64.exe PID 1068 wrote to memory of 1224 1068 POWERPNT.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\Video Drawing P.O.#4210020253.pps"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1068-2-0x00000000745E1000-0x00000000745E5000-memory.dmpFilesize
16KB
-
memory/1068-3-0x0000000071681000-0x0000000071683000-memory.dmpFilesize
8KB
-
memory/1068-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1224-5-0x0000000000000000-mapping.dmp
-
memory/1224-6-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmpFilesize
8KB