Analysis
-
max time kernel
71s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-03-2021 08:42
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-JTC-ACS PROJECT 4A.pps
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ-JTC-ACS PROJECT 4A.pps
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
RFQ-JTC-ACS PROJECT 4A.pps
-
Size
83KB
-
MD5
43d6c3f16b3af2b31f6db8cf8702b5c8
-
SHA1
51a1010f9b54cb916474d288694a8255809f7843
-
SHA256
9161bc0ac7fd107278182e5220134b057915525c78ef256713b9ef6a4ccab4b6
-
SHA512
20a5cbb63445b08e08f9cc03152a2577f4e8a7f19d899c0aaac4450199305529c1d9cacacb8193b863d4d7c278dee2e32a1ee9083dccb39fb0bee42476e4238f
Score
1/10
Malware Config
Signatures
-
Processes:
POWERPNT.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 1832 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 1832 wrote to memory of 1424 1832 POWERPNT.EXE splwow64.exe PID 1832 wrote to memory of 1424 1832 POWERPNT.EXE splwow64.exe PID 1832 wrote to memory of 1424 1832 POWERPNT.EXE splwow64.exe PID 1832 wrote to memory of 1424 1832 POWERPNT.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\RFQ-JTC-ACS PROJECT 4A.pps"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1424-5-0x0000000000000000-mapping.dmp
-
memory/1424-6-0x000007FEFC011000-0x000007FEFC013000-memory.dmpFilesize
8KB
-
memory/1832-2-0x0000000074781000-0x0000000074785000-memory.dmpFilesize
16KB
-
memory/1832-3-0x0000000071811000-0x0000000071813000-memory.dmpFilesize
8KB
-
memory/1832-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB