Analysis

  • max time kernel
    68s
  • max time network
    23s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    06/02/2022, 21:46

General

  • Target

    gunky.odp

  • Size

    33B

  • MD5

    4a455289420e873a304701f64709ee06

  • SHA1

    e59ec8c5c26ddf855696b4a730382e70f1a767e5

  • SHA256

    00e7fa423d51b6d53f30074503c824e372bd04b03938828c5471012facba9c1e

  • SHA512

    4a754e5a0e9002efa4b9275bf9aa276b12e551be199701fa90b29406a31b0b554ed3a390583c27335719612e88eb2a8d3d832a0f3129dfd9832f6afea660b16c

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\gunky.odp"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1164

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1164-57-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

            Filesize

            8KB

          • memory/1784-54-0x0000000073BC1000-0x0000000073BC5000-memory.dmp

            Filesize

            16KB

          • memory/1784-55-0x0000000070F71000-0x0000000070F73000-memory.dmp

            Filesize

            8KB

          • memory/1784-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1784-58-0x0000000075421000-0x0000000075423000-memory.dmp

            Filesize

            8KB

          • memory/1784-59-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB