c45ecb10594b32cb49ec4e3356acd59b2e0819555c747657a7ce45993e5e57d7

Analysis

max time kernel
69s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
06/04/2021, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OrderSheet.pps
Size 111KB
Sample210406-ymvpf35thx
SHA256 c45ecb10594b32cb49ec4e3356acd59b2e0819555c747657a7ce45993e5e57d7
MD5 04772bbc01d2088b18a869755d93b9d0
SHA1 7b5672c1febeca9bc97d17951b57c9f59f9de708
SHA512 bd33b07e0a195e8e9148d00e447f55ef9197fc84f5d20df8d5bf9dfc6e2e2538b5def720e49f97ec5594ec77725a17793187c1169affdfed8a41a0b468af41a5
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1108	POWERPNT.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1116	1108	POWERPNT.EXE	26
PID 1108 wrote to memory of 1116	1108	POWERPNT.EXE	26
PID 1108 wrote to memory of 1116	1108	POWERPNT.EXE	26
PID 1108 wrote to memory of 1116	1108	POWERPNT.EXE	26

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\OrderSheet.pps"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-2-0x0000000073BA1000-0x0000000073BA5000-memory.dmp

Download

memory/1108-3-0x0000000071251000-0x0000000071253000-memory.dmp

Download

memory/1108-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1116-6-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads