f62126148a3e6cc7bc2662a8d3b4def7ba95af74265b8f13c2abf6254ea8f0f7

Analysis

max time kernel
76s
max time network
143s
platform
windows10_x64
resource
win10v20201028
submitted
11-03-2021 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL#AWB031121.ppt
Size

121KB
MD5

49c5e5cf4fec6d41cf03e25995e664d4
SHA1

d8bfbe0acf50553ddd7a8bb4160ebf3f163e608a
SHA256

f62126148a3e6cc7bc2662a8d3b4def7ba95af74265b8f13c2abf6254ea8f0f7
SHA512

6e2f2d9977b6666209d984be665dffa0fb6a13aee7814a4727eaf4eeb66d0017dcffcfac2ae8ba4679bf70b0c0f3ef2ea5640f12619959dcf114851bb25946a9

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

416 POWERPNT.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

POWERPNT.EXE

pid process

416 POWERPNT.EXE
416 POWERPNT.EXE
416 POWERPNT.EXE

pid	process
416	POWERPNT.EXE

pid	process
416	POWERPNT.EXE
416	POWERPNT.EXE
416	POWERPNT.EXE

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\DHL#AWB031121.ppt" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:416

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-2-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download
memory/416-3-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download
memory/416-4-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download
memory/416-5-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download
memory/416-6-0x00007FFD86CF0000-0x00007FFD87327000-memory.dmp

Filesize
6.2MB

Download
memory/416-7-0x00007FFD877B0000-0x00007FFD8938D000-memory.dmp

Filesize
27.9MB

Download
memory/416-9-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download
memory/416-8-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download
memory/416-10-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download
memory/416-11-0x00007FFD654A0000-0x00007FFD654B0000-memory.dmp

Filesize
64KB

Download