68c838c138ad66ecf2da106058fab6336867fc419360bc2d406b7b970f436a8c

Analysis

max time kernel
136s
max time network
131s
platform
windows10_x64
resource
win10v20201028
submitted
02-03-2021 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment Advice PDF.ppt
Size

74KB
MD5

80b5ed8ada114b945c52126e457c1bad
SHA1

0a9ccf44dfd056b868b80d270eb30272f462f572
SHA256

68c838c138ad66ecf2da106058fab6336867fc419360bc2d406b7b970f436a8c
SHA512

a23c8062538044d87c757c81d5cda81e0f5c4b7bda7f6a6205c7ae7a20f87f899de1dd741881bc71882028ca7e936ccd9f49f39cd70d9fcb6ca1b5acac814fe6

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

4700 POWERPNT.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

POWERPNT.EXE

pid process

4700 POWERPNT.EXE
4700 POWERPNT.EXE
4700 POWERPNT.EXE

pid	process
4700	POWERPNT.EXE

pid	process
4700	POWERPNT.EXE
4700	POWERPNT.EXE
4700	POWERPNT.EXE

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice PDF.ppt" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4700-2-0x00007FF82F820000-0x00007FF82F830000-memory.dmp

Filesize
64KB

Download
memory/4700-3-0x00007FF82F820000-0x00007FF82F830000-memory.dmp

Filesize
64KB

Download
memory/4700-4-0x00007FF82F820000-0x00007FF82F830000-memory.dmp

Filesize
64KB

Download
memory/4700-5-0x00007FF855280000-0x00007FF8558B7000-memory.dmp

Filesize
6.2MB

Download
memory/4700-6-0x00007FF82F820000-0x00007FF82F830000-memory.dmp

Filesize
64KB

Download
memory/4700-7-0x00007FF82C1F0000-0x00007FF82C200000-memory.dmp

Filesize
64KB

Download
memory/4700-8-0x000001D8150B0000-0x000001D8150B4000-memory.dmp

Filesize
16KB

Download