7df670fa6de80e87fa03dfba84f5777054d5a55737f8fce07679a637342250a3

Analysis

max time kernel
135s
max time network
119s
platform
windows10_x64
resource
win10v20201028
submitted
24-02-2021 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Heur.19445.20366.pps
Size

143KB
MD5

c475bbc0142c89758cb3f15625f5dee7
SHA1

eea1ff58d1a0b6a471f9a34d97b102c2cd0a3431
SHA256

7df670fa6de80e87fa03dfba84f5777054d5a55737f8fce07679a637342250a3
SHA512

241a3575dd78dcc2b4f20d20a46f53f4910c7e613ba1dba87b5dd7c9aaa4cc5ebf83784c2560e60fee5ad11732cb3a36a445a6cc82ae851e10367fbbdda8ad9f

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

492 POWERPNT.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

POWERPNT.EXE

pid process

492 POWERPNT.EXE
492 POWERPNT.EXE

pid	process
492	POWERPNT.EXE

pid	process
492	POWERPNT.EXE
492	POWERPNT.EXE

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.19445.20366.pps" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-2-0x00007FF9F0570000-0x00007FF9F0580000-memory.dmp

Filesize
64KB

Download
memory/492-3-0x00007FF9F0570000-0x00007FF9F0580000-memory.dmp

Filesize
64KB

Download
memory/492-4-0x00007FF9F0570000-0x00007FF9F0580000-memory.dmp

Filesize
64KB

Download
memory/492-5-0x00007FFA13B50000-0x00007FFA14187000-memory.dmp

Filesize
6.2MB

Download
memory/492-6-0x00007FF9F0570000-0x00007FF9F0580000-memory.dmp

Filesize
64KB

Download