Analysis

  • max time kernel
    125s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    06/02/2022, 21:46

General

  • Target

    gunky.odp

  • Size

    33B

  • MD5

    4a455289420e873a304701f64709ee06

  • SHA1

    e59ec8c5c26ddf855696b4a730382e70f1a767e5

  • SHA256

    00e7fa423d51b6d53f30074503c824e372bd04b03938828c5471012facba9c1e

  • SHA512

    4a754e5a0e9002efa4b9275bf9aa276b12e551be199701fa90b29406a31b0b554ed3a390583c27335719612e88eb2a8d3d832a0f3129dfd9832f6afea660b16c

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\gunky.odp" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1052
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3988

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1052-130-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-131-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-132-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-133-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-134-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-135-0x00007FFC645F0000-0x00007FFC64600000-memory.dmp

          Filesize

          64KB

        • memory/1052-136-0x00007FFC645F0000-0x00007FFC64600000-memory.dmp

          Filesize

          64KB

        • memory/1052-138-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-139-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-140-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/1052-141-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp

          Filesize

          64KB

        • memory/3988-154-0x000002C1A8590000-0x000002C1A8594000-memory.dmp

          Filesize

          16KB